@visulima/vis 1.0.0-alpha.22 → 1.0.0-alpha.24

package/schemas/vis-config.schema.json

@@ -1062,8 +1062,8 @@
                     "properties": {
                         "advisoryCacheTtlMs": {
                             "type": "number",
-                            "description": "Cache TTL for advisory entries (immutable once published).",
-                            "default": "604_800_000 (7 days)"
+                            "description": "Cache TTL for advisory entries (immutable once published). 7 days.",
+                            "default": 604800000
                         },
                         "enabled": {
                             "type": "boolean",
@@ -1072,23 +1072,36 @@
                         },
                         "projectCacheTtlMs": {
                             "type": "number",
-                            "description": "Cache TTL for OpenSSF Scorecard project data (refreshes weekly).",
-                            "default": "86_400_000 (24 hours)"
+                            "description": "Cache TTL for OpenSSF Scorecard project data (refreshes weekly). 24 hours.",
+                            "default": 86400000
                         },
                         "timeoutMs": {
                             "type": "number",
                             "description": "Request timeout in milliseconds.",
-                            "default": "15_000"
+                            "default": 15000
                         },
                         "versionCacheTtlMs": {
                             "type": "number",
-                            "description": "Cache TTL for npm version metadata (immutable).",
-                            "default": "604_800_000 (7 days)"
+                            "description": "Cache TTL for npm version metadata (immutable). 7 days.",
+                            "default": 604800000
                         }
                     },
                     "additionalProperties": false,
                     "description": "deps.dev (Google Open Source Insights) data-source configuration. Public, unauthenticated; pulls Scorecard data + advisories from `api.deps.dev`. Complements or replaces Socket.dev. Heavily cached."
                 },
+                "exoticSubdepsAllow": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Package names exempted from the `blockExoticSubdeps` check. Bare names and a trailing `*` glob (`@scope/*`) are supported. Use for an internal package legitimately published as a git or tarball dependency.",
+                    "examples": [
+                        [
+                            "@myorg/legacy",
+                            "internal-*"
+                        ]
+                    ]
+                },
                 "marshalls": {
                     "type": "object",
                     "properties": {
@@ -1602,9 +1615,45 @@
                     "type": "string",
                     "enum": [
                         "deps-dev",
+                        "snyk",
                         "socket"
                     ],
-                    "description": "Which provider wins merge conflicts when multiple are enabled (e.g. both Socket.dev and deps.dev return data for the same package). The primary provider's `score` is kept; alerts from secondaries are appended and deduped by `key`. Defaults to whichever provider is enabled first in this order: socket → deps-dev."
+                    "description": "Which provider wins merge conflicts when multiple are enabled (e.g. both Socket.dev and deps.dev return data for the same package). The primary provider's `score` is kept; alerts from secondaries are appended and deduped by `key`. Defaults to whichever provider is enabled first in this order: socket → deps-dev → snyk."
+                },
+                "snyk": {
+                    "type": "object",
+                    "properties": {
+                        "apiToken": {
+                            "type": "string",
+                            "description": "Snyk API token. Set via VIS_SNYK_TOKEN environment variable or here."
+                        },
+                        "apiVersion": {
+                            "type": "string",
+                            "description": "Snyk REST API version date sent as the `version` query param.",
+                            "default": "2024-10-15"
+                        },
+                        "cacheTtlMs": {
+                            "type": "number",
+                            "description": "Cache TTL in milliseconds for Snyk issue lookups. 6 hours.",
+                            "default": 21600000
+                        },
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Enable Snyk security scanning on install/update/check/audit commands.",
+                            "default": false
+                        },
+                        "orgId": {
+                            "type": "string",
+                            "description": "Snyk organization id (the REST endpoint is org-scoped). Set via VIS_SNYK_ORG environment variable or here."
+                        },
+                        "timeoutMs": {
+                            "type": "number",
+                            "description": "Request timeout in milliseconds for the Snyk API. 15 seconds.",
+                            "default": 15000
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Snyk data-source configuration. Snyk only contributes vulnerability data (no maintenance / quality / supply-chain / license signal); those axes stay neutral. Requires both an org id and an API token — if either is missing the provider is skipped."
                 },
                 "socket": {
                     "type": "object",
@@ -1615,8 +1664,8 @@
                         },
                         "cacheTtlMs": {
                             "type": "number",
-                            "description": "Cache TTL in milliseconds for Socket.dev reports.",
-                            "default": "3_600_000 (1 hour)"
+                            "description": "Cache TTL in milliseconds for Socket.dev reports. 1 hour.",
+                            "default": 3600000
                         },
                         "enabled": {
                             "type": "boolean",
@@ -1625,8 +1674,8 @@
                         },
                         "timeoutMs": {
                             "type": "number",
-                            "description": "Request timeout in milliseconds for the Socket.dev API.",
-                            "default": "15_000 (15 seconds)"
+                            "description": "Request timeout in milliseconds for the Socket.dev API. 15 seconds.",
+                            "default": 15000
                         }
                     },
                     "additionalProperties": false,