depcurfew 1.0.0 → 1.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "depcurfew",
-  "version": "1.0.0",
-  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
+  "version": "1.2.0",
+  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
   "license": "MIT",
   "author": "depcurfew",
   "repository": {
@@ -40,6 +40,8 @@
     "check:pkg": "tsdown && publint && attw --pack . --profile esm-only",
     "docs:knowledge": "node scripts/generate-knowledge.ts",
     "docs:readme": "node scripts/generate-readme.ts",
+    "data:popular": "node scripts/generate-popular.ts",
+    "record:registry": "node scripts/record-registry.ts",
     "schema": "node scripts/generate-schema.ts"
   },
   "keywords": [
@@ -50,6 +52,12 @@
     "yarn",
     "bun",
     "deno",
+    "python",
+    "uv",
+    "pip",
+    "poetry",
+    "pdm",
+    "pipenv",
     "renovate",
     "dependabot",
     "minimum-release-age",
@@ -65,5 +73,8 @@
   },
   "dependencies": {
     "yaml": "2.9.1"
+  },
+  "allowScripts": {
+    "fsevents": false
   }
 }

package/schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://unpkg.com/depcurfew/schema.json",
   "title": "depcurfew policy",
-  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, Renovate and Dependabot.",
+  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot.",
   "type": "object",
   "properties": {
     "$schema": {
@@ -32,9 +32,9 @@
           "description": "Packages that skip the release-age delay, e.g. your own scope.",
           "type": "array",
           "items": {
-            "description": "A package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". No versions.",
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
             "type": "string",
-            "pattern": "^(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*-]*$"
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
           },
           "uniqueItems": true,
           "default": []
@@ -55,11 +55,11 @@
       "additionalProperties": false
     },
     "installScripts": {
-      "description": "Dependency lifecycle scripts.",
+      "description": "Code that dependencies run when they are installed: lifecycle scripts in npm, building from source in Python.",
       "type": "object",
       "properties": {
         "default": {
-          "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default.",
+          "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default; for Python, whether packages may be built from source.",
           "type": "string",
           "enum": [
             "allow",
@@ -67,12 +67,23 @@
           ]
         },
         "allow": {
-          "description": "Packages whose lifecycle scripts may run when the default is \"deny\".",
+          "description": "Packages whose lifecycle scripts may run when the default is \"deny\"; Python packages listed here are always built from source.",
           "type": "array",
           "items": {
-            "description": "A package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". No versions.",
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
             "type": "string",
-            "pattern": "^(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*-]*$"
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
+          },
+          "uniqueItems": true,
+          "default": []
+        },
+        "deny": {
+          "description": "Packages you reviewed that work without their lifecycle scripts, so the scripts stay blocked on purpose and doctor does not report them, for example \"fsevents\", which ships a prebuilt binary. A package cannot be in both lists, also not through two patterns that match the same name. Python packages listed here must not be built from source: doctor reports a tool that would still build one.",
+          "type": "array",
+          "items": {
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
+            "type": "string",
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
           },
           "uniqueItems": true,
           "default": []
@@ -142,6 +153,11 @@
               "yarn",
               "bun",
               "deno",
+              "uv",
+              "pip",
+              "poetry",
+              "pdm",
+              "pipenv",
               "renovate",
               "dependabot"
             ]