fg-devkit 1.3.3 → 1.4.0

package/README.md

@@ -70,6 +70,20 @@ Run full consumer setup in one command:
 pnpm exec fgd full-consumer-setup
 ```
 
+## Dependency policy update workflow
+
+Check outdated policy versions:
+
+```bash
+pnpm exec fgd policy-outdated
+```
+
+Upgrade policy versions interactively:
+
+```bash
+pnpm exec fgd policy-upgrade
+```
+
 ## tsconfig in consuming repos
 
 Use `fgd sync-project-configs` (or `fgd sync-tooling-configs`) to write the local `tsconfig.json` template from `fg-devkit`.

package/configs/dependency-policy.vue-workspace.json

@@ -10,8 +10,8 @@
       "@sentry/tracing": "7.37.2",
       "@sentry/vue": "7.37.2",
       "@sentry/wasm": "7.67.0",
-      "@tailwindcss/postcss": "4.2.2",
-      "@tanstack/vue-query": "5.96.2",
+      "@tailwindcss/postcss": "4.2.3",
+      "@tanstack/vue-query": "5.99.2",
       "@types/leaflet": "1.5.7",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -27,7 +27,7 @@
       "imask": "7.6.1",
       "leaflet": "1.8.0",
       "lexical": "0.30.0",
-      "lodash": "4.17.23",
+      "lodash": "4.18.1",
       "lodash-es": "4.18.1",
       "markdown-it": "14.1.1",
       "pinia": "3.0.4",
@@ -36,7 +36,7 @@
       "randexp": "0.5.3",
       "register-service-worker": "1.7.2",
       "vega-embed": "7.1.0",
-      "vega-lite": "6.4.1",
+      "vega-lite": "6.4.2",
       "vue-chartjs": "5.3.3",
       "vue-i18n": "11.3.2",
       "vue-quilly": "1.0.5",
@@ -56,14 +56,14 @@
       "@storybook/addon-vitest": "10.2.12",
       "@storybook/vue3": "10.2.12",
       "@storybook/vue3-vite": "10.2.12",
-      "@tanstack/vue-query-devtools": "6.1.13",
+      "@tanstack/vue-query-devtools": "6.1.18",
       "@tsconfig/node22": "22.0.5",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
       "@vitest/browser": "3.2.4",
-      "@vue/compiler-dom": "3.5.29",
+      "@vue/compiler-dom": "3.5.32",
       "@vue/eslint-config-standard": "8.0.1",
-      "@vue/server-renderer": "3.5.29",
+      "@vue/server-renderer": "3.5.32",
       "@vue/test-utils": "2.4.6",
       "@vuepic/vue-datepicker": "6.0.3",
       "arg": "5.0.2",
@@ -71,25 +71,25 @@
       "eslint-plugin-storybook": "10.1.10",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
-      "postcss": "8.5.6",
+      "postcss": "8.5.10",
       "sass": "1.97.3",
       "start-server-and-test": "2.1.3",
       "storybook": "10.2.12",
       "tsx": "4.21.0",
       "vega": "6.2.0",
       "vite-plugin-dts": "4.5.4",
-      "vite-plugin-vue-devtools": "8.0.7",
+      "vite-plugin-vue-devtools": "8.1.1",
       "vitest": "3.2.4",
       "yaml": "2.8.3"
     }
   },
   "managedAnywhere": {
-    "@tailwindcss/vite": "4.2.2",
-    "@vitejs/plugin-vue": "6.0.5",
-    "axios": "1.15.0",
+    "@tailwindcss/vite": "4.2.3",
+    "@vitejs/plugin-vue": "6.0.6",
+    "axios": "1.15.1",
     "dotenv": "16.4.5",
     "qrcode.vue": "3.8.1",
-    "tailwindcss": "4.2.2",
+    "tailwindcss": "4.2.3",
     "vite": "7.3.2",
     "vue": "3.5.32"
   }

package/configs/lefthook.yml

@@ -1,11 +1,6 @@
 pre-commit:
   commands:
     lint-check:
-      run: >
-        if [ -x "__FG_NODE_BIN__" ]; then
-          "__FG_NODE_BIN__" ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint .;
-        elif command -v node >/dev/null 2>&1; then
-          node ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint .;
-        else
-          /usr/bin/env node ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint .;
-        fi
+      run: zsh -lc "node ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint ."
+    typecheck:
+      run: zsh -lc "node ./node_modules/fg-devkit/scripts/fg-devkit.mjs typecheck"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -28,6 +28,8 @@
     "./scripts/sync-consumer-scripts.mjs": "./scripts/sync-consumer-scripts.mjs",
     "./scripts/sync-consumer-lefthook.mjs": "./scripts/sync-consumer-lefthook.mjs",
     "./scripts/prune-consumer-deps.mjs": "./scripts/prune-consumer-deps.mjs",
+    "./scripts/policy-outdated.mjs": "./scripts/policy-outdated.mjs",
+    "./scripts/policy-upgrade.mjs": "./scripts/policy-upgrade.mjs",
     "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
     "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",
     "./scripts/resolve-dependency-policy-path.mjs": "./scripts/resolve-dependency-policy-path.mjs",
@@ -70,6 +72,7 @@
     "eslint-plugin-prettier": "5.5.5",
     "eslint-plugin-vue": "10.8.0",
     "lefthook": "2.1.6",
+    "npm-check-updates": "21.0.3",
     "prettier": "3.8.3",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.0",

package/scripts/cz/cz-adapter.cjs

@@ -5,6 +5,9 @@
 module.exports = {
   prompter(cz, commit) {
     const defaultType = process.env.FG_DEVKIT_CZ_DEFAULT_TYPE;
+    const defaultPackages = process.env.FG_DEVKIT_CZ_DEFAULT_PACKAGES;
+    const defaultDepVersion = process.env.FG_DEVKIT_CZ_DEFAULT_DEP_VERSION;
+    const defaultDepChangeKind = process.env.FG_DEVKIT_CZ_DEFAULT_DEP_CHANGE_KIND;
     const types = [
       { value: "feat", name: "feat(scope): Added" },
       { value: "fix", name: "fix(scope): Fixed" },
@@ -36,6 +39,7 @@ module.exports = {
         name: "packages",
         when: (answers) => ["dep", "vuln"].includes(answers.change_type),
         message: "Packages:",
+        default: defaultType === "dep" && defaultPackages ? defaultPackages : undefined,
       },
       {
         type: "list",
@@ -64,12 +68,17 @@ module.exports = {
           { value: "update", name: "updated package" },
           { value: "remove", name: "removed package" },
         ],
+        default:
+          defaultType === "dep" && ["new", "update", "remove"].includes(defaultDepChangeKind)
+            ? defaultDepChangeKind
+            : "update",
       },
       {
         type: "input",
         name: "dep_version",
         when: (answers) => answers.change_type === "dep",
         message: "Version (x.y.z):",
+        default: defaultType === "dep" && defaultDepVersion ? defaultDepVersion : undefined,
         validate: (value) => (/^\d+\.\d+\.\d+$/.test(value) ? true : "Use format x.y.z"),
       },
       {

package/scripts/fg-devkit.mjs

@@ -5,6 +5,9 @@
  * Non-interactive (for scripts and automation):
  *   pnpm exec fg-devkit check-deps [policy-file]
  *   pnpm exec fg-devkit sync-deps [policy-file]
+ *   pnpm exec fg-devkit policy-outdated [policy-file]
+ *   pnpm exec fg-devkit policy-vulns [policy-file]
+ *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-vscode-settings
@@ -38,6 +41,7 @@ import { createRequire } from 'node:module'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const require = createRequire(import.meta.url)
+const fgRoot = path.resolve(scriptDir, '..')
 
 /** Run another script in this package via Node; inherits stdio and returns the child exit code. */
 function runNode(scriptRelative, args = [], options = {}) {
@@ -94,6 +98,24 @@ function runPnpmInstall() {
   return r.status ?? 1
 }
 
+/** Run pnpm audit in current repo and return normalized status info. */
+function runPnpmAuditCurrentRepo() {
+  const r = spawnSync('pnpm', ['audit'], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return { ok: false, hasVulns: false, exitCode: 1 }
+  }
+  const code = r.status ?? 1
+  if (code === 1) {
+    return { ok: true, hasVulns: true, exitCode: 0 }
+  }
+  return { ok: code === 0, hasVulns: false, exitCode: code }
+}
+
 /** Run Lefthook from fg-devkit bundled dependency set. */
 function runBundledLefthook(args = []) {
   let lefthookBin
@@ -153,6 +175,124 @@ function runFullConsumerSetup() {
   return runPnpmInstall()
 }
 
+function stageFiles(paths = []) {
+  const existing = paths.filter((p) => fs.existsSync(path.join(process.cwd(), p)))
+  if (existing.length === 0) return 0
+  const r = spawnSync('git', ['add', '--', ...existing], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+function commitStaged(message) {
+  const r = spawnSync('git', ['commit', '-m', message], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+function collectPolicyVersionChanges(beforePolicy, afterPolicy) {
+  const before = {
+    ...(beforePolicy.managedDependencies?.dependencies ?? {}),
+    ...(beforePolicy.managedDependencies?.devDependencies ?? {}),
+    ...(beforePolicy.managedAnywhere ?? {}),
+  }
+  const after = {
+    ...(afterPolicy.managedDependencies?.dependencies ?? {}),
+    ...(afterPolicy.managedDependencies?.devDependencies ?? {}),
+    ...(afterPolicy.managedAnywhere ?? {}),
+  }
+  const changed = []
+  for (const [name, newVersion] of Object.entries(after)) {
+    const prev = before[name]
+    if (prev !== undefined && prev !== newVersion) {
+      changed.push({ name, from: prev, to: newVersion })
+    }
+  }
+  return changed
+}
+
+/** Maintainer flow: run policy-upgrade, stage policy file, then auto-commit dep(package): bump to version. */
+function runMaintainerPolicyUpgradeAndCommit() {
+  const policyPath = path.join(process.cwd(), 'configs', 'dependency-policy.vue-workspace.json')
+  if (!fs.existsSync(policyPath)) {
+    console.error('[fg-devkit] Expected policy at configs/dependency-policy.vue-workspace.json')
+    return 1
+  }
+
+  let beforePolicy
+  try {
+    beforePolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  } catch (err) {
+    console.error(`[fg-devkit] Failed to read policy before upgrade: ${err.message}`)
+    return 1
+  }
+
+  const upgradeCode = runNode('policy-upgrade.mjs')
+  if (upgradeCode !== 0) return upgradeCode
+
+  let afterPolicy
+  try {
+    afterPolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  } catch (err) {
+    console.error(`[fg-devkit] Failed to read policy after upgrade: ${err.message}`)
+    return 1
+  }
+
+  const changed = collectPolicyVersionChanges(beforePolicy, afterPolicy)
+  if (changed.length === 0) {
+    console.log('[fg-devkit] No policy package version changes detected; skipping stage and commit flow.')
+    return 0
+  }
+  if (changed.length > 1) {
+    console.log('[fg-devkit] Multiple package changes detected in policy-upgrade:')
+    for (const item of changed) {
+      console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
+    }
+    console.log('[fg-devkit] Please commit manually (or rerun and select a single package).')
+    return 1
+  }
+
+  const [only] = changed
+  const stageCode = stageFiles(['configs/dependency-policy.vue-workspace.json'])
+  if (stageCode !== 0) return stageCode
+
+  const commitMessage = `dep(${only.name}): bump to ${only.to}`
+  console.log(`[fg-devkit] Staged policy change for ${only.name} -> ${only.to}`)
+  console.log(`[fg-devkit] Auto-committing: ${commitMessage}`)
+  return commitStaged(commitMessage)
+}
+
+/** Maintainer flow: run both policy vuln check and fg-devkit root audit. */
+function runMaintainerAuditAll() {
+  console.log('[fg-devkit] Running policy vulnerability scan...')
+  const policyCode = runNode('policy-vulns.mjs')
+  if (policyCode !== 0) return policyCode
+
+  console.log('[fg-devkit] Running fg-devkit repository audit...')
+  const repoAudit = runPnpmAuditCurrentRepo()
+  if (!repoAudit.ok) return repoAudit.exitCode
+
+  if (repoAudit.hasVulns) {
+    console.log('[fg-devkit] Completed: vulnerabilities were reported in fg-devkit repository audit.')
+  } else {
+    console.log('[fg-devkit] Completed: no vulnerabilities reported in fg-devkit repository audit.')
+  }
+  return 0
+}
+
 /** Prompt release type in CLI before invoking release.sh to avoid a "stuck" terminal feeling. */
 async function promptReleaseType(rl) {
   console.log('\nSelect release type:')
@@ -293,6 +433,9 @@ function runBundledTypeScript(args = []) {
 const DIRECT_COMMANDS = {
   'check-deps': 'check-dependency-policy.mjs',
   'sync-deps': 'sync-dependency-policy.mjs',
+  'policy-outdated': 'policy-outdated.mjs',
+  'policy-vulns': 'policy-vulns.mjs',
+  'policy-upgrade': 'policy-upgrade.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
@@ -308,6 +451,10 @@ function printHelp() {
 Commands:
   check-deps [policy-file]        Validate package.json + pins against policy
   sync-deps [policy-file]         Align declared versions to policy (existing keys only)
+  policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
+  policy-vulns [policy-file]      Check policy packages for vulnerabilities via pnpm audit
+  policy-upgrade [policy-file] [ncu-args...]
+                                 Upgrade policy packages via npm-check-updates (default interactive)
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -381,12 +528,63 @@ const MENU = [
   },
 ]
 
+const MAINTAINER_MENU = [
+  {
+    key: 'm1',
+    label: 'Maintainer: Show outdated dependency policy packages',
+    run: () => runNode('policy-outdated.mjs'),
+  },
+  {
+    key: 'm2',
+    label: 'Maintainer: Upgrade dependency policy (interactive)',
+    run: () => runNode('policy-upgrade.mjs'),
+  },
+  {
+    key: 'm3',
+    label: 'Maintainer: Refresh dependency policy from repos',
+    run: () => runNode('refresh-dependency-policy-from-repos.mjs'),
+  },
+  {
+    key: 'm4',
+    label: 'Maintainer: Upgrade one policy package, stage, and auto-commit',
+    run: () => runMaintainerPolicyUpgradeAndCommit(),
+  },
+  {
+    key: 'm5',
+    label: 'Maintainer: Check policy vulnerabilities (audit)',
+    run: () => runNode('policy-vulns.mjs'),
+  },
+  {
+    key: 'm6',
+    label: 'Maintainer: Check vulnerabilities (policy + fg-devkit repo)',
+    run: () => runMaintainerAuditAll(),
+  },
+]
+
+function isFgDevkitMaintainerContext() {
+  if (path.resolve(process.cwd()) !== fgRoot) {
+    return false
+  }
+  const pkgPath = path.join(process.cwd(), 'package.json')
+  if (!fs.existsSync(pkgPath)) {
+    return false
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+    return pkg?.name === 'fg-devkit'
+  } catch {
+    return false
+  }
+}
+
 async function runInteractiveMenu() {
   const rl = readline.createInterface({ input, output })
+  const isMaintainer = isFgDevkitMaintainerContext()
+  const menu = isMaintainer ? [...MENU, ...MAINTAINER_MENU] : MENU
 
   console.log(`\nfg-devkit — choose a task (cwd: ${process.cwd()})\n`)
 
-  for (const item of MENU) {
+  for (const item of menu) {
     console.log(`  ${item.key}) ${item.label}`)
   }
   console.log('  0) Exit\n')
@@ -398,7 +596,7 @@ async function runInteractiveMenu() {
     return 0
   }
 
-  const item = MENU.find((m) => m.key === choice)
+  const item = menu.find((m) => m.key === choice)
   if (!item) {
     console.error('[fg-devkit] Unknown option. Run again and choose a number from the list.')
     rl.close()

package/scripts/policy-outdated.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * Shows outdated packages for dependency policy entries by projecting policy data
+ * into a temporary package.json and running `pnpm outdated` there.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-outdated [policy-file]
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-outdated-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-outdated-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+console.log(`[policy-outdated] policy=${policyPath}`)
+const install = spawnSync('pnpm', ['install', '--lockfile-only', '--ignore-scripts'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (install.error) {
+  console.error('[policy-outdated]', install.error.message)
+  process.exit(1)
+}
+if ((install.status ?? 1) !== 0) {
+  process.exit(install.status ?? 1)
+}
+
+const result = spawnSync('pnpm', ['outdated'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (result.error) {
+  console.error('[policy-outdated]', result.error.message)
+  process.exit(1)
+}
+// pnpm outdated returns exit code 1 when outdated packages are found.
+if ((result.status ?? 1) === 1) {
+  process.exit(0)
+}
+process.exit(result.status ?? 1)

package/scripts/policy-upgrade.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * Upgrades dependency policy package versions through npm-check-updates.
+ * It projects the policy into a temporary package.json, runs ncu, then writes
+ * selected versions back to the policy file.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
+ *
+ * Defaults when no ncu args are given:
+ *   --interactive --format group --upgrade --packageManager pnpm --install never
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const require = createRequire(import.meta.url)
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  console.log(`Usage:
+  pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
+
+Examples:
+  pnpm exec fg-devkit policy-upgrade
+  pnpm exec fg-devkit policy-upgrade configs/dependency-policy.vue-workspace.json --interactive --format group --upgrade`)
+  process.exit(0)
+}
+
+const argPolicy = process.argv[2]
+const hasPolicyArg = Boolean(argPolicy) && !argPolicy.startsWith('-')
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+const ncuArgs = hasPolicyArg ? process.argv.slice(3) : process.argv.slice(2)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+
+const depNames = new Set(Object.keys(policy.managedDependencies?.dependencies ?? {}))
+const devNames = new Set(Object.keys(policy.managedDependencies?.devDependencies ?? {}))
+const anyNames = new Set(Object.keys(policy.managedAnywhere ?? {}))
+
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-upgrade-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-upgrade-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+let ncuBin
+try {
+  const ncuPkgPath = require.resolve('npm-check-updates/package.json')
+  ncuBin = path.join(path.dirname(ncuPkgPath), 'build', 'cli.js')
+} catch {
+  console.error('[policy-upgrade] Could not resolve npm-check-updates binary.')
+  process.exit(1)
+}
+
+const effectiveNcuArgs =
+  ncuArgs.length > 0
+    ? ncuArgs
+    : ['--interactive', '--format', 'group', '--upgrade', '--packageManager', 'pnpm', '--install', 'never']
+
+console.log(`[policy-upgrade] policy=${policyPath}`)
+const run = spawnSync(process.execPath, [ncuBin, ...effectiveNcuArgs], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (run.error) {
+  console.error('[policy-upgrade]', run.error.message)
+  process.exit(1)
+}
+if ((run.status ?? 1) !== 0) {
+  process.exit(run.status ?? 1)
+}
+
+const updatedPkg = readJson(pkgPath)
+const updatedDeps = updatedPkg.dependencies ?? {}
+const updatedDevDeps = updatedPkg.devDependencies ?? {}
+
+for (const [name, version] of Object.entries(updatedDeps)) {
+  if (anyNames.has(name)) policy.managedAnywhere[name] = version
+  else if (depNames.has(name)) policy.managedDependencies.dependencies[name] = version
+}
+for (const [name, version] of Object.entries(updatedDevDeps)) {
+  if (devNames.has(name)) policy.managedDependencies.devDependencies[name] = version
+}
+
+fs.writeFileSync(policyPath, `${JSON.stringify(policy, null, 2)}\n`, 'utf8')
+console.log('[policy-upgrade] Updated dependency policy from selected ncu changes.')

package/scripts/policy-vulns.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * Checks vulnerabilities for dependency policy entries by projecting policy data
+ * into a temporary package.json and running `pnpm audit` there.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-vulns [policy-file]
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-vulns-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-vulns-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+console.log(`[policy-vulns] policy=${policyPath}`)
+const install = spawnSync('pnpm', ['install', '--ignore-scripts'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (install.error) {
+  console.error('[policy-vulns]', install.error.message)
+  process.exit(1)
+}
+if ((install.status ?? 1) !== 0) {
+  process.exit(install.status ?? 1)
+}
+
+const audit = spawnSync('pnpm', ['audit'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (audit.error) {
+  console.error('[policy-vulns]', audit.error.message)
+  process.exit(1)
+}
+// pnpm audit returns exit code 1 when vulnerabilities are found.
+if ((audit.status ?? 1) === 1) {
+  process.exit(0)
+}
+process.exit(audit.status ?? 1)

package/scripts/sync-consumer-lefthook.mjs

@@ -55,9 +55,7 @@ if (pkg['lint-staged'] !== undefined) {
 }
 
 try {
-  const template = fs.readFileSync(lefthookTemplate, 'utf8')
-  const rendered = template.replaceAll('__FG_NODE_BIN__', process.execPath)
-  fs.writeFileSync(lefthookTarget, rendered, 'utf8')
+  fs.copyFileSync(lefthookTemplate, lefthookTarget)
   fs.writeFileSync(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8')
   if (fs.existsSync(huskyDir)) {
     fs.rmSync(huskyDir, { recursive: true, force: true })