depcurfew 1.3.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +151 -55
  2. package/dist/cli.js +1 -1
  3. package/dist/index.d.ts +416 -150
  4. package/dist/index.js +2 -2
  5. package/dist/{run-DYkP4HLQ.js → run-NcyQxpTd.js} +11172 -3459
  6. package/package.json +15 -7
  7. package/schema.json +12 -11
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "depcurfew",
3
- "version": "1.3.0",
4
- "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
3
+ "version": "1.4.0",
4
+ "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
5
5
  "license": "MIT",
6
6
  "author": "depcurfew",
7
7
  "repository": {
@@ -42,7 +42,8 @@
42
42
  "docs:readme": "node scripts/generate-readme.ts",
43
43
  "data:popular": "node scripts/generate-popular.ts",
44
44
  "record:registry": "node scripts/record-registry.ts",
45
- "schema": "node scripts/generate-schema.ts"
45
+ "schema": "node scripts/generate-schema.ts",
46
+ "site": "node scripts/site.ts"
46
47
  },
47
48
  "keywords": [
48
49
  "supply-chain",
@@ -58,18 +59,25 @@
58
59
  "poetry",
59
60
  "pdm",
60
61
  "pipenv",
62
+ "composer",
63
+ "php",
61
64
  "renovate",
62
65
  "dependabot",
63
66
  "minimum-release-age",
64
- "cooldown"
67
+ "cooldown",
68
+ "mcp",
69
+ "model-context-protocol",
70
+ "claude-code",
71
+ "github-action",
72
+ "sarif"
65
73
  ],
66
74
  "devDependencies": {
67
75
  "@arethetypeswrong/cli": "0.18.5",
68
- "@types/node": "22.20.5",
76
+ "@types/node": "26.6.5",
69
77
  "publint": "0.3.25",
70
- "tsdown": "0.22.14",
78
+ "tsdown": "0.23.2",
71
79
  "typescript": "6.0.3",
72
- "vitest": "4.1.12"
80
+ "vitest": "5.0.5"
73
81
  },
74
82
  "dependencies": {
75
83
  "yaml": "2.9.1"
package/schema.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "$schema": "http://json-schema.org/draft-07/schema#",
3
3
  "$id": "https://unpkg.com/depcurfew/schema.json",
4
4
  "title": "depcurfew policy",
5
- "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Renovate and Dependabot.",
5
+ "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Renovate and Dependabot.",
6
6
  "type": "object",
7
7
  "properties": {
8
8
  "$schema": {
@@ -32,9 +32,9 @@
32
32
  "description": "Packages that skip the release-age delay, e.g. your own scope.",
33
33
  "type": "array",
34
34
  "items": {
35
- "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
35
+ "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
36
36
  "type": "string",
37
- "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
37
+ "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
38
38
  },
39
39
  "uniqueItems": true,
40
40
  "default": []
@@ -55,11 +55,11 @@
55
55
  "additionalProperties": false
56
56
  },
57
57
  "installScripts": {
58
- "description": "Code that dependencies run when they are installed: lifecycle scripts in npm, building from source in Python.",
58
+ "description": "Code that dependencies run when they are installed: lifecycle scripts in npm, building from source in Python, plugins in Composer.",
59
59
  "type": "object",
60
60
  "properties": {
61
61
  "default": {
62
- "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default; for Python, whether packages may be built from source.",
62
+ "description": "Whether dependency lifecycle scripts (preinstall, install, postinstall) run by default; for Python, whether packages may be built from source; for Composer, whether plugins may run.",
63
63
  "type": "string",
64
64
  "enum": [
65
65
  "allow",
@@ -67,23 +67,23 @@
67
67
  ]
68
68
  },
69
69
  "allow": {
70
- "description": "Packages whose lifecycle scripts may run when the default is \"deny\"; Python packages listed here are always built from source.",
70
+ "description": "Packages whose lifecycle scripts may run when the default is \"deny\"; Python packages listed here are always built from source; Composer packages listed here are the plugins allow-plugins lets run.",
71
71
  "type": "array",
72
72
  "items": {
73
- "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
73
+ "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
74
74
  "type": "string",
75
- "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
75
+ "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
76
76
  },
77
77
  "uniqueItems": true,
78
78
  "default": []
79
79
  },
80
80
  "deny": {
81
- "description": "Packages you reviewed that work without their lifecycle scripts, so the scripts stay blocked on purpose and doctor does not report them, for example \"fsevents\", which ships a prebuilt binary. A package cannot be in both lists, also not through two patterns that match the same name. Python packages listed here must not be built from source: doctor reports a tool that would still build one.",
81
+ "description": "Packages you reviewed that work without their lifecycle scripts, so the scripts stay blocked on purpose and doctor does not report them, for example \"fsevents\", which ships a prebuilt binary. depcurfew init fills it with the packages of the lockfile whose scripts depcurfew knows to be unneeded (esbuild, fsevents) or to do only a task of the project (lefthook). A package cannot be in both lists, also not through two patterns that match the same name. Python packages listed here must not be built from source: doctor reports a tool that would still build one. Composer packages listed here are plugins that allow-plugins disallows.",
82
82
  "type": "array",
83
83
  "items": {
84
- "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\". No versions.",
84
+ "description": "An npm package name such as \"esbuild\" or \"@scope/name\", or a pattern with *, such as \"@scope/*\". Python packages take the prefix pypi:, e.g. \"pypi:requests\" or \"pypi:acme-*\", and Composer packages the prefix composer:, e.g. \"composer:monolog/monolog\" or \"composer:acme/*\". No versions.",
85
85
  "type": "string",
86
- "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
86
+ "pattern": "^(?:pypi:(?!\\*+$)[A-Za-z0-9*](?:[A-Za-z0-9._*-]*[A-Za-z0-9*])?|composer:(?!\\*+/\\*+$)[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?|(?!\\*+$)(@[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*/)?[A-Za-z0-9~*-][A-Za-z0-9._~*_-]*)$"
87
87
  },
88
88
  "uniqueItems": true,
89
89
  "default": []
@@ -158,6 +158,7 @@
158
158
  "poetry",
159
159
  "pdm",
160
160
  "pipenv",
161
+ "composer",
161
162
  "renovate",
162
163
  "dependabot"
163
164
  ]