@vinean/dependency-analyzer 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/dist/dependency-analyzer-darwin-amd64 +0 -0
- package/dist/dependency-analyzer-darwin-arm64 +0 -0
- package/dist/dependency-analyzer-linux-amd64 +0 -0
- package/dist/dependency-analyzer-linux-arm64 +0 -0
- package/dist/dependency-analyzer-windows-amd64.exe +0 -0
- package/package.json +3 -4
package/README.md
CHANGED
|
@@ -23,6 +23,20 @@ npm install -g @vinean/dependency-analyzer
|
|
|
23
23
|
- `--ecosystem <type>`: Force ecosystem detection (`npm` or `go`). Auto-detected by default.
|
|
24
24
|
- `--open=false`: Disable auto-opening the generated HTML report.
|
|
25
25
|
- `--json`: Print the raw analysis summary (JSON) to stdout.
|
|
26
|
+
- `--no-ghost` (**npm only**): Do not fetch package tarballs from the registry when `node_modules` is missing. Analysis uses only what is installed locally.
|
|
27
|
+
- `--no-registry` (**npm only**): Skip npm registry metadata (weekly downloads, maintenance heuristics, React Native directory). Does not disable tarball fetch for code analysis; use `--no-ghost` for that.
|
|
28
|
+
|
|
29
|
+
### NPM: local install first, registry fallback
|
|
30
|
+
|
|
31
|
+
By default, dependencies are read from `node_modules` when present. If a direct dependency is missing on disk, the tool downloads its **exact** version from the registry (using `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, or a pinned version in `package.json`), analyzes the unpacked sources, and cleans up temp files per package.
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
# Air-gapped or CI: require a full local install
|
|
35
|
+
npx @vinean/dependency-analyzer --no-ghost
|
|
36
|
+
|
|
37
|
+
# Skip registry metadata but still allow tarball fetch for missing packages
|
|
38
|
+
npx @vinean/dependency-analyzer --no-registry
|
|
39
|
+
```
|
|
26
40
|
|
|
27
41
|
## 📊 Key Features
|
|
28
42
|
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vinean/dependency-analyzer",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"description": "Dependency Analyzer for npm and go packages with replaceability analysis",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
"build:binaries": "node ./scripts/build-binaries.mjs",
|
|
16
16
|
"prepublishOnly": "npm run build:binaries"
|
|
17
17
|
},
|
|
18
|
-
"author": "Hakan Olgun <
|
|
18
|
+
"author": "Hakan Olgun <hakanolgun@tutamail.com>",
|
|
19
19
|
"repository": {
|
|
20
20
|
"type": "git",
|
|
21
21
|
"url": "git+https://github.com/hakanolgun/dependency-analyzer.git",
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"bugs": {
|
|
25
25
|
"url": "https://github.com/hakanolgun/dependency-analyzer/issues"
|
|
26
26
|
},
|
|
27
|
-
"homepage": "https://github.
|
|
27
|
+
"homepage": "https://hakanolgun.github.io/dependency-analyzer",
|
|
28
28
|
"keywords": [
|
|
29
29
|
"dependency",
|
|
30
30
|
"analyzer",
|
|
@@ -32,7 +32,6 @@
|
|
|
32
32
|
"replaceability",
|
|
33
33
|
"npm",
|
|
34
34
|
"go",
|
|
35
|
-
"security",
|
|
36
35
|
"cli",
|
|
37
36
|
"scan"
|
|
38
37
|
],
|