depcurfew 1.2.0 → 1.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "depcurfew",
-  "version": "1.2.0",
-  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
+  "version": "1.4.0",
+  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
   "license": "MIT",
   "author": "depcurfew",
   "repository": {
@@ -29,7 +29,7 @@
     "schema.json"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=18.3.0"
   },
   "packageManager": "npm@11.19.1",
   "scripts": {
@@ -42,7 +42,8 @@
     "docs:readme": "node scripts/generate-readme.ts",
     "data:popular": "node scripts/generate-popular.ts",
     "record:registry": "node scripts/record-registry.ts",
-    "schema": "node scripts/generate-schema.ts"
+    "schema": "node scripts/generate-schema.ts",
+    "site": "node scripts/site.ts"
   },
   "keywords": [
     "supply-chain",
@@ -58,18 +59,25 @@
     "poetry",
     "pdm",
     "pipenv",
+    "composer",
+    "php",
     "renovate",
     "dependabot",
     "minimum-release-age",
-    "cooldown"
+    "cooldown",
+    "mcp",
+    "model-context-protocol",
+    "claude-code",
+    "github-action",
+    "sarif"
   ],
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@types/node": "22.20.5",
+    "@types/node": "26.6.5",
     "publint": "0.3.25",
-    "tsdown": "0.22.14",
+    "tsdown": "0.23.2",
     "typescript": "6.0.3",
-    "vitest": "4.1.12"
+    "vitest": "5.0.5"
   },
   "dependencies": {
     "yaml": "2.9.1"

package/schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://unpkg.com/depcurfew/schema.json",
   "title": "depcurfew policy",
-  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot.",
+  "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Renovate and Dependabot.",
   "type": "object",
   "properties": {
     "$schema": {
@@ -32,9 +32,9 @@
           "description": "Packages that skip the release-age delay, e.g. your own scope.",
           "type": "array",
           "items": {
-            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
             "type": "string",
-            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
           },
           "uniqueItems": true,
           "default": []
@@ -55,11 +55,11 @@
       "additionalProperties": false
     },
     "installScripts": {
-      "description": "Code that dependencies run when they are installed: lifecycle scripts in npm, building from source in Python.",
+      "description": "Code that dependencies run when they are installed: lifecycle scripts in npm, building from source in Python, plugins in Composer.",
       "type": "object",
       "properties": {
         "default": {
-          "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default; for Python, whether packages may be built from source.",
+          "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default; for Python, whether packages may be built from source; for Composer, whether plugins may run.",
           "type": "string",
           "enum": [
             "allow",
@@ -67,23 +67,23 @@
           ]
         },
         "allow": {
-          "description": "Packages whose lifecycle scripts may run when the default is \"deny\"; Python packages listed here are always built from source.",
+          "description": "Packages whose lifecycle scripts may run when the default is \"deny\"; Python packages listed here are always built from source; Composer packages listed here are the plugins allow-plugins lets run.",
           "type": "array",
           "items": {
-            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
             "type": "string",
-            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
           },
           "uniqueItems": true,
           "default": []
         },
         "deny": {
-          "description": "Packages you reviewed that work without their lifecycle scripts, so the scripts stay blocked on purpose and doctor does not report them, for example \"fsevents\", which ships a prebuilt binary. A package cannot be in both lists, also not through two patterns that match the same name. Python packages listed here must not be built from source: doctor reports a tool that would still build one.",
+          "description": "Packages you reviewed that work without their lifecycle scripts, so the scripts stay blocked on purpose and doctor does not report them, for example \"fsevents\", which ships a prebuilt binary. depcurfew init fills it with the packages of the lockfile whose scripts depcurfew knows to be unneeded (esbuild, fsevents) or to do only a task of the project (lefthook). A package cannot be in both lists, also not through two patterns that match the same name. Python packages listed here must not be built from source: doctor reports a tool that would still build one. Composer packages listed here are plugins that allow-plugins disallows.",
           "type": "array",
           "items": {
-            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
+            "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
             "type": "string",
-            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
+            "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
           },
           "uniqueItems": true,
           "default": []
@@ -158,6 +158,7 @@
               "poetry",
               "pdm",
               "pipenv",
+              "composer",
               "renovate",
               "dependabot"
             ]
@@ -167,6 +168,36 @@
         }
       ],
       "default": "auto"
+    },
+    "projects": {
+      "description": "Directories of independent projects in this repository, each with its own manifest and lockfile (e.g. frontend and backend). depcurfew configures each one with this policy as a project of its own, and configures Renovate and Dependabot once, from the repository root, for all of them. The repository root is always configured as well. A project must not be inside another one, must not be a workspace package of the root and must not have a depcurfew.json of its own.",
+      "type": "array",
+      "items": {
+        "description": "A directory relative to the repository root, with / between directories, e.g. \"frontend\" or \"services/api\". No patterns, no \"..\", no / at either end.",
+        "type": "string",
+        "pattern": "^(?!\\.\\.?(?:/|$))(?!.*/\\.\\.?(?:/|$))(?!(?:.*/)?(?:node_modules|\\.git)(?:/|$))[^/\\\\:*?\"<>|\\u0000-\\u001f\\u007f]+(?:/[^/\\\\:*?\"<>|\\u0000-\\u001f\\u007f]+)*$",
+        "examples": [
+          "frontend",
+          "services/api"
+        ]
+      },
+      "uniqueItems": true,
+      "default": []
+    },
+    "doctor": {
+      "description": "How depcurfew doctor and the GitHub Action treat findings. Without this section only errors fail, as before; depcurfew init writes \"failOn\": \"warning\".",
+      "type": "object",
+      "properties": {
+        "failOn": {
+          "description": "Which findings make depcurfew doctor exit with 1 and fail the GitHub Action: \"error\" (only errors, also when left out) or \"warning\" (warnings too). Notes never fail. doctor --fail-on and the input fail-on of the Action override it.",
+          "type": "string",
+          "enum": [
+            "error",
+            "warning"
+          ]
+        }
+      },
+      "additionalProperties": false
     }
   },
   "required": [