fg-devkit 1.3.4 → 1.5.0

package/README.md

@@ -70,6 +70,50 @@ Run full consumer setup in one command:
 pnpm exec fgd full-consumer-setup
 ```
 
+## Dependency policy update workflow
+
+Check outdated policy versions:
+
+```bash
+pnpm exec fgd policy-outdated
+```
+
+Check vulnerabilities for all policy packages together (including transitive dependencies):
+
+```bash
+pnpm exec fgd policy-vulns
+```
+
+Check vulnerabilities for all dependencies in the current repo:
+
+```bash
+pnpm exec fgd repo-vulns
+```
+
+Check vulnerabilities across all Vue repositories under the projects root:
+
+```bash
+pnpm exec fgd fleet-vulns
+```
+
+For summary-only mode (no full per-repo pnpm audit output):
+
+```bash
+pnpm exec fgd fleet-vulns --summary-only
+```
+
+If npm audit is rate-limited (429), slow the scan down:
+
+```bash
+pnpm exec fgd fleet-vulns --delay-ms=8000
+```
+
+Upgrade policy versions interactively:
+
+```bash
+pnpm exec fgd policy-upgrade
+```
+
 ## tsconfig in consuming repos
 
 Use `fgd sync-project-configs` (or `fgd sync-tooling-configs`) to write the local `tsconfig.json` template from `fg-devkit`.

package/configs/dependency-policy.vue-workspace.json

@@ -10,8 +10,8 @@
       "@sentry/tracing": "7.37.2",
       "@sentry/vue": "7.37.2",
       "@sentry/wasm": "7.67.0",
-      "@tailwindcss/postcss": "4.2.2",
-      "@tanstack/vue-query": "5.96.2",
+      "@tailwindcss/postcss": "4.2.3",
+      "@tanstack/vue-query": "5.99.2",
       "@types/leaflet": "1.5.7",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -27,7 +27,7 @@
       "imask": "7.6.1",
       "leaflet": "1.8.0",
       "lexical": "0.30.0",
-      "lodash": "4.17.23",
+      "lodash": "4.18.1",
       "lodash-es": "4.18.1",
       "markdown-it": "14.1.1",
       "pinia": "3.0.4",
@@ -36,7 +36,7 @@
       "randexp": "0.5.3",
       "register-service-worker": "1.7.2",
       "vega-embed": "7.1.0",
-      "vega-lite": "6.4.1",
+      "vega-lite": "6.4.2",
       "vue-chartjs": "5.3.3",
       "vue-i18n": "11.3.2",
       "vue-quilly": "1.0.5",
@@ -56,14 +56,14 @@
       "@storybook/addon-vitest": "10.2.12",
       "@storybook/vue3": "10.2.12",
       "@storybook/vue3-vite": "10.2.12",
-      "@tanstack/vue-query-devtools": "6.1.13",
+      "@tanstack/vue-query-devtools": "6.1.18",
       "@tsconfig/node22": "22.0.5",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
       "@vitest/browser": "3.2.4",
-      "@vue/compiler-dom": "3.5.29",
+      "@vue/compiler-dom": "3.5.32",
       "@vue/eslint-config-standard": "8.0.1",
-      "@vue/server-renderer": "3.5.29",
+      "@vue/server-renderer": "3.5.32",
       "@vue/test-utils": "2.4.6",
       "@vuepic/vue-datepicker": "6.0.3",
       "arg": "5.0.2",
@@ -71,26 +71,32 @@
       "eslint-plugin-storybook": "10.1.10",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
-      "postcss": "8.5.6",
+      "postcss": "8.5.10",
       "sass": "1.97.3",
       "start-server-and-test": "2.1.3",
       "storybook": "10.2.12",
       "tsx": "4.21.0",
       "vega": "6.2.0",
       "vite-plugin-dts": "4.5.4",
-      "vite-plugin-vue-devtools": "8.0.7",
+      "vite-plugin-vue-devtools": "8.1.1",
       "vitest": "3.2.4",
       "yaml": "2.8.3"
     }
   },
   "managedAnywhere": {
-    "@tailwindcss/vite": "4.2.2",
-    "@vitejs/plugin-vue": "6.0.5",
-    "axios": "1.15.0",
+    "@tailwindcss/vite": "4.2.3",
+    "@vitejs/plugin-vue": "6.0.6",
+    "axios": "1.15.1",
     "dotenv": "16.4.5",
     "qrcode.vue": "3.8.1",
-    "tailwindcss": "4.2.2",
+    "tailwindcss": "4.2.3",
     "vite": "7.3.2",
     "vue": "3.5.32"
+  },
+  "overrides": {
+    "lodash@<=4.17.23": ">=4.18.0",
+    "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+    "lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
+    "tmp@<=0.2.3": ">=0.2.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.3.4",
+  "version": "1.5.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -28,6 +28,11 @@
     "./scripts/sync-consumer-scripts.mjs": "./scripts/sync-consumer-scripts.mjs",
     "./scripts/sync-consumer-lefthook.mjs": "./scripts/sync-consumer-lefthook.mjs",
     "./scripts/prune-consumer-deps.mjs": "./scripts/prune-consumer-deps.mjs",
+    "./scripts/policy-outdated.mjs": "./scripts/policy-outdated.mjs",
+    "./scripts/policy-vulns.mjs": "./scripts/policy-vulns.mjs",
+    "./scripts/repo-vulns.mjs": "./scripts/repo-vulns.mjs",
+    "./scripts/fleet-vulns.mjs": "./scripts/fleet-vulns.mjs",
+    "./scripts/policy-upgrade.mjs": "./scripts/policy-upgrade.mjs",
     "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
     "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",
     "./scripts/resolve-dependency-policy-path.mjs": "./scripts/resolve-dependency-policy-path.mjs",
@@ -70,6 +75,7 @@
     "eslint-plugin-prettier": "5.5.5",
     "eslint-plugin-vue": "10.8.0",
     "lefthook": "2.1.6",
+    "npm-check-updates": "21.0.3",
     "prettier": "3.8.3",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.0",

package/scripts/check-dependency-policy.mjs

@@ -21,6 +21,7 @@ import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mj
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
+const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
 
@@ -42,6 +43,30 @@ const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
 const policy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
 const mismatches = []
 
+function getOverridePackageName(overrideKey) {
+  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : overrideKey
+}
+
+function getRelevantPolicyOverrides(policyOverrides) {
+  const entries = Object.entries(policyOverrides ?? {})
+  if (entries.length === 0) {
+    return {}
+  }
+  if (!fs.existsSync(lockfilePath)) {
+    return Object.fromEntries(entries)
+  }
+  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
+  const relevant = {}
+  for (const [name, version] of entries) {
+    const pkgName = getOverridePackageName(name)
+    if (lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)) {
+      relevant[name] = version
+    }
+  }
+  return relevant
+}
+
 /** True if this package+section is governed by the policy (so global pin checks skip it). */
 function isPolicyManagedInSection(section, name) {
   if (policy.managedAnywhere?.[name] !== undefined) {
@@ -56,7 +81,6 @@ for (const [section, dependencies] of Object.entries(policy.managedDependencies
 }
 
 mismatches.push(...collectPinViolations('[policy] managedAnywhere.', policy.managedAnywhere ?? {}))
-mismatches.push(...collectPinViolations('[policy] overrides.', policy.overrides ?? {}))
 
 // Intersection: only packages that exist in both policy and consumer are compared.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
@@ -98,12 +122,10 @@ for (const [name, expected] of Object.entries(policy.managedAnywhere ?? {})) {
 
 // Optional: policy may define pnpm.overrides entries the consumer must mirror.
 const overrides = pkg.pnpm?.overrides ?? {}
-for (const [name, expected] of Object.entries(policy.overrides ?? {})) {
+for (const [name, expected] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
   const actual = overrides[name]
   if (actual !== expected) {
     mismatches.push(`pnpm.overrides.${name}: expected ${expected}, got ${actual ?? '(missing)'}`)
-  } else if (actual !== undefined && !isPinnedDependencyVersion(actual)) {
-    mismatches.push(`pnpm.overrides.${name}: must be pinned, got ${JSON.stringify(actual)}`)
   }
 }
 
@@ -121,9 +143,6 @@ for (const section of ['dependencies', 'devDependencies', 'optionalDependencies'
   }
 }
 
-// Consumer pnpm.overrides must be pinned (ranges reported even if not in policy).
-mismatches.push(...collectPinViolations('[pins] pnpm.overrides.', pkg.pnpm?.overrides ?? {}))
-
 if (mismatches.length > 0) {
   console.error('[check-deps] Dependency policy mismatches found:')
   for (const mismatch of mismatches) {

package/scripts/cz/cz-adapter.cjs

@@ -5,6 +5,9 @@
 module.exports = {
   prompter(cz, commit) {
     const defaultType = process.env.FG_DEVKIT_CZ_DEFAULT_TYPE;
+    const defaultPackages = process.env.FG_DEVKIT_CZ_DEFAULT_PACKAGES;
+    const defaultDepVersion = process.env.FG_DEVKIT_CZ_DEFAULT_DEP_VERSION;
+    const defaultDepChangeKind = process.env.FG_DEVKIT_CZ_DEFAULT_DEP_CHANGE_KIND;
     const types = [
       { value: "feat", name: "feat(scope): Added" },
       { value: "fix", name: "fix(scope): Fixed" },
@@ -36,6 +39,7 @@ module.exports = {
         name: "packages",
         when: (answers) => ["dep", "vuln"].includes(answers.change_type),
         message: "Packages:",
+        default: defaultType === "dep" && defaultPackages ? defaultPackages : undefined,
       },
       {
         type: "list",
@@ -64,12 +68,17 @@ module.exports = {
           { value: "update", name: "updated package" },
           { value: "remove", name: "removed package" },
         ],
+        default:
+          defaultType === "dep" && ["new", "update", "remove"].includes(defaultDepChangeKind)
+            ? defaultDepChangeKind
+            : "update",
       },
       {
         type: "input",
         name: "dep_version",
         when: (answers) => answers.change_type === "dep",
         message: "Version (x.y.z):",
+        default: defaultType === "dep" && defaultDepVersion ? defaultDepVersion : undefined,
         validate: (value) => (/^\d+\.\d+\.\d+$/.test(value) ? true : "Use format x.y.z"),
       },
       {

package/scripts/fg-devkit.mjs

@@ -5,6 +5,11 @@
  * Non-interactive (for scripts and automation):
  *   pnpm exec fg-devkit check-deps [policy-file]
  *   pnpm exec fg-devkit sync-deps [policy-file]
+ *   pnpm exec fg-devkit policy-outdated [policy-file]
+ *   pnpm exec fg-devkit policy-vulns [policy-file]
+ *   pnpm exec fg-devkit repo-vulns
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+ *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-vscode-settings
@@ -38,6 +43,7 @@ import { createRequire } from 'node:module'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const require = createRequire(import.meta.url)
+const fgRoot = path.resolve(scriptDir, '..')
 
 /** Run another script in this package via Node; inherits stdio and returns the child exit code. */
 function runNode(scriptRelative, args = [], options = {}) {
@@ -153,6 +159,111 @@ function runFullConsumerSetup() {
   return runPnpmInstall()
 }
 
+function stageFiles(paths = []) {
+  const existing = paths.filter((p) => fs.existsSync(path.join(process.cwd(), p)))
+  if (existing.length === 0) return 0
+  const r = spawnSync('git', ['add', '--', ...existing], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+function commitStaged(message) {
+  const r = spawnSync('git', ['commit', '-m', message], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+function collectPolicyVersionChanges(beforePolicy, afterPolicy) {
+  const before = {
+    ...(beforePolicy.managedDependencies?.dependencies ?? {}),
+    ...(beforePolicy.managedDependencies?.devDependencies ?? {}),
+    ...(beforePolicy.managedAnywhere ?? {}),
+  }
+  const after = {
+    ...(afterPolicy.managedDependencies?.dependencies ?? {}),
+    ...(afterPolicy.managedDependencies?.devDependencies ?? {}),
+    ...(afterPolicy.managedAnywhere ?? {}),
+  }
+  const changed = []
+  for (const [name, newVersion] of Object.entries(after)) {
+    const prev = before[name]
+    if (prev !== undefined && prev !== newVersion) {
+      changed.push({ name, from: prev, to: newVersion })
+    }
+  }
+  return changed
+}
+
+/** Maintainer flow: run policy-upgrade, stage policy file, then auto-commit dep(package): bump to version. */
+function runMaintainerPolicyUpgradeAndCommit() {
+  const policyPath = path.join(process.cwd(), 'configs', 'dependency-policy.vue-workspace.json')
+  if (!fs.existsSync(policyPath)) {
+    console.error('[fg-devkit] Expected policy at configs/dependency-policy.vue-workspace.json')
+    return 1
+  }
+
+  let beforePolicy
+  try {
+    beforePolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  } catch (err) {
+    console.error(`[fg-devkit] Failed to read policy before upgrade: ${err.message}`)
+    return 1
+  }
+
+  const upgradeCode = runNode('policy-upgrade.mjs')
+  if (upgradeCode !== 0) return upgradeCode
+
+  let afterPolicy
+  try {
+    afterPolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  } catch (err) {
+    console.error(`[fg-devkit] Failed to read policy after upgrade: ${err.message}`)
+    return 1
+  }
+
+  const changed = collectPolicyVersionChanges(beforePolicy, afterPolicy)
+  if (changed.length === 0) {
+    console.log('[fg-devkit] No policy package version changes detected; skipping stage and commit flow.')
+    return 0
+  }
+  if (changed.length > 1) {
+    console.log('[fg-devkit] Multiple package changes detected in policy-upgrade:')
+    for (const item of changed) {
+      console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
+    }
+    console.log('[fg-devkit] Please commit manually (or rerun and select a single package).')
+    return 1
+  }
+
+  const [only] = changed
+  const stageCode = stageFiles(['configs/dependency-policy.vue-workspace.json'])
+  if (stageCode !== 0) return stageCode
+
+  const commitMessage = `dep(${only.name}): bump to ${only.to}`
+  console.log(`[fg-devkit] Staged policy change for ${only.name} -> ${only.to}`)
+  console.log(`[fg-devkit] Auto-committing: ${commitMessage}`)
+  return commitStaged(commitMessage)
+}
+
+/** Maintainer flow: run full repo vulnerability audit in fg-devkit root. */
+function runMaintainerAuditAll() {
+  return runNode('repo-vulns.mjs')
+}
+
 /** Prompt release type in CLI before invoking release.sh to avoid a "stuck" terminal feeling. */
 async function promptReleaseType(rl) {
   console.log('\nSelect release type:')
@@ -293,6 +404,11 @@ function runBundledTypeScript(args = []) {
 const DIRECT_COMMANDS = {
   'check-deps': 'check-dependency-policy.mjs',
   'sync-deps': 'sync-dependency-policy.mjs',
+  'policy-outdated': 'policy-outdated.mjs',
+  'policy-vulns': 'policy-vulns.mjs',
+  'repo-vulns': 'repo-vulns.mjs',
+  'fleet-vulns': 'fleet-vulns.mjs',
+  'policy-upgrade': 'policy-upgrade.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
@@ -308,6 +424,13 @@ function printHelp() {
 Commands:
   check-deps [policy-file]        Validate package.json + pins against policy
   sync-deps [policy-file]         Align declared versions to policy (existing keys only)
+  policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
+  policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
+  repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
+  fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+                                 Run pnpm audit across Vue repos (full output + combined summary)
+  policy-upgrade [policy-file] [ncu-args...]
+                                 Upgrade policy packages via npm-check-updates (default interactive)
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -381,12 +504,68 @@ const MENU = [
   },
 ]
 
+const MAINTAINER_MENU = [
+  {
+    key: 'm1',
+    label: 'Maintainer: Show outdated dependency policy packages',
+    run: () => runNode('policy-outdated.mjs'),
+  },
+  {
+    key: 'm2',
+    label: 'Maintainer: Upgrade dependency policy (interactive)',
+    run: () => runNode('policy-upgrade.mjs'),
+  },
+  {
+    key: 'm3',
+    label: 'Maintainer: Refresh dependency policy from repos',
+    run: () => runNode('refresh-dependency-policy-from-repos.mjs'),
+  },
+  {
+    key: 'm4',
+    label: 'Maintainer: Upgrade one policy package, stage, and auto-commit',
+    run: () => runMaintainerPolicyUpgradeAndCommit(),
+  },
+  {
+    key: 'm5',
+    label: 'Maintainer: Check policy vulnerabilities (audit)',
+    run: () => runNode('policy-vulns.mjs'),
+  },
+  {
+    key: 'm6',
+    label: 'Maintainer: Check fg-devkit repo vulnerabilities',
+    run: () => runMaintainerAuditAll(),
+  },
+  {
+    key: 'm7',
+    label: 'Maintainer: Check vulnerabilities across all Vue repos',
+    run: () => runNode('fleet-vulns.mjs'),
+  },
+]
+
+function isFgDevkitMaintainerContext() {
+  if (path.resolve(process.cwd()) !== fgRoot) {
+    return false
+  }
+  const pkgPath = path.join(process.cwd(), 'package.json')
+  if (!fs.existsSync(pkgPath)) {
+    return false
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+    return pkg?.name === 'fg-devkit'
+  } catch {
+    return false
+  }
+}
+
 async function runInteractiveMenu() {
   const rl = readline.createInterface({ input, output })
+  const isMaintainer = isFgDevkitMaintainerContext()
+  const menu = isMaintainer ? [...MENU, ...MAINTAINER_MENU] : MENU
 
   console.log(`\nfg-devkit — choose a task (cwd: ${process.cwd()})\n`)
 
-  for (const item of MENU) {
+  for (const item of menu) {
     console.log(`  ${item.key}) ${item.label}`)
   }
   console.log('  0) Exit\n')
@@ -398,7 +577,7 @@ async function runInteractiveMenu() {
     return 0
   }
 
-  const item = MENU.find((m) => m.key === choice)
+  const item = menu.find((m) => m.key === choice)
   if (!item) {
     console.error('[fg-devkit] Unknown option. Run again and choose a number from the list.')
     rl.close()

package/scripts/fleet-vulns.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+/**
+ * Runs vulnerability audits across Vue repositories and prints both per-repo
+ * pnpm audit output and a combined summary.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const cliArgs = process.argv.slice(2)
+const summaryOnly = cliArgs.includes('--summary-only')
+const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
+const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
+const delayArg = cliArgs.find((a) => a.startsWith('--delay-ms='))
+const delayMs = Number(delayArg?.split('=')[1] ?? 2500)
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function walk(dir, acc = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (item.name === 'node_modules' || item.name === '.git') continue
+    const p = path.join(dir, item.name)
+    if (item.isDirectory()) walk(p, acc)
+    else if (item.name === 'package.json') acc.push(p)
+  }
+  return acc
+}
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+function isVueProject(pkg) {
+  return Boolean(pkg.dependencies?.vue || pkg.devDependencies?.vue)
+}
+
+function countTotal(severityMap = {}) {
+  return Object.values(severityMap).reduce((sum, n) => sum + Number(n || 0), 0)
+}
+
+const packageJsonFiles = walk(projectsRoot)
+const repos = []
+for (const packageJsonPath of packageJsonFiles) {
+  try {
+    const pkg = readJson(packageJsonPath)
+    const repoDir = path.dirname(packageJsonPath)
+    if (!isVueProject(pkg)) continue
+    if (pkg.name === 'fg-devkit') continue
+    repos.push(repoDir)
+  } catch {
+    // Ignore invalid package.json files.
+  }
+}
+
+const uniqueRepos = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+if (uniqueRepos.length === 0) {
+  console.log(`[fleet-vulns] No Vue repositories found under ${projectsRoot}`)
+  process.exit(0)
+}
+
+console.log(`[fleet-vulns] projectsRoot=${projectsRoot}`)
+console.log(`[fleet-vulns] repositories=${uniqueRepos.length}`)
+
+const results = []
+let hasFailures = false
+let hasVulnerabilities = false
+
+for (const repoDir of uniqueRepos) {
+  const repoName = path.basename(repoDir)
+  const lockfilePath = path.join(repoDir, 'pnpm-lock.yaml')
+  if (!fs.existsSync(lockfilePath)) {
+    console.log(`[fleet-vulns] SKIP ${repoName}: missing pnpm-lock.yaml`)
+    continue
+  }
+
+  console.log(`\n[fleet-vulns] Auditing ${repoName}`)
+  if (!summaryOnly) {
+    const prettyAudit = spawnSync('pnpm', ['audit'], {
+      cwd: repoDir,
+      env: process.env,
+      stdio: 'inherit',
+    })
+
+    if (prettyAudit.error) {
+      hasFailures = true
+      console.error(`[fleet-vulns] FAIL ${repoName}: ${prettyAudit.error.message}`)
+      continue
+    }
+    const prettyCode = prettyAudit.status ?? 1
+    if (prettyCode !== 0 && prettyCode !== 1) {
+      hasFailures = true
+      console.error(`[fleet-vulns] FAIL ${repoName}: pnpm audit exited with code ${prettyCode}`)
+      continue
+    }
+  }
+
+  const audit = spawnSync('pnpm', ['audit', '--json'], {
+    cwd: repoDir,
+    env: process.env,
+    encoding: 'utf8',
+  })
+
+  if (audit.error) {
+    hasFailures = true
+    console.error(`[fleet-vulns] FAIL ${repoName}: ${audit.error.message}`)
+    continue
+  }
+
+  let report = null
+  try {
+    report = JSON.parse(audit.stdout || '{}')
+  } catch {
+    report = null
+  }
+
+  if (!report || typeof report !== 'object') {
+    hasFailures = true
+    console.error(`[fleet-vulns] FAIL ${repoName}: could not parse pnpm audit --json output`)
+    continue
+  }
+
+  const vulnerabilities = report.metadata?.vulnerabilities ?? {}
+  const total = countTotal(vulnerabilities)
+  if (total > 0) hasVulnerabilities = true
+
+  results.push({
+    repoName,
+    vulnerabilities,
+    total,
+    dependencies: report.metadata?.totalDependencies ?? 0,
+  })
+
+  if (delayMs > 0) {
+    await sleep(delayMs)
+  }
+}
+
+console.log('\n[fleet-vulns] Summary')
+for (const r of results) {
+  const v = r.vulnerabilities
+  console.log(
+    `- ${r.repoName}: total=${r.total} (critical=${v.critical ?? 0}, high=${v.high ?? 0}, moderate=${v.moderate ?? 0}, low=${v.low ?? 0}, info=${v.info ?? 0}) deps=${r.dependencies}`,
+  )
+}
+
+if (results.length === 0) {
+  console.log('[fleet-vulns] No repositories were audited.')
+}
+
+if (hasFailures) {
+  process.exit(1)
+}
+if (hasVulnerabilities) {
+  process.exit(1)
+}
+process.exit(0)

package/scripts/policy-outdated.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * Shows outdated packages for dependency policy entries by projecting policy data
+ * into a temporary package.json and running `pnpm outdated` there.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-outdated [policy-file]
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-outdated-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-outdated-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+console.log(`[policy-outdated] policy=${policyPath}`)
+const install = spawnSync('pnpm', ['install', '--lockfile-only', '--ignore-scripts'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (install.error) {
+  console.error('[policy-outdated]', install.error.message)
+  process.exit(1)
+}
+if ((install.status ?? 1) !== 0) {
+  process.exit(install.status ?? 1)
+}
+
+const result = spawnSync('pnpm', ['outdated'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (result.error) {
+  console.error('[policy-outdated]', result.error.message)
+  process.exit(1)
+}
+// pnpm outdated returns exit code 1 when outdated packages are found.
+if ((result.status ?? 1) === 1) {
+  process.exit(0)
+}
+process.exit(result.status ?? 1)

package/scripts/policy-upgrade.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * Upgrades dependency policy package versions through npm-check-updates.
+ * It projects the policy into a temporary package.json, runs ncu, then writes
+ * selected versions back to the policy file.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
+ *
+ * Defaults when no ncu args are given:
+ *   --interactive --format group --upgrade --packageManager pnpm --install never
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const require = createRequire(import.meta.url)
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  console.log(`Usage:
+  pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
+
+Examples:
+  pnpm exec fg-devkit policy-upgrade
+  pnpm exec fg-devkit policy-upgrade configs/dependency-policy.vue-workspace.json --interactive --format group --upgrade`)
+  process.exit(0)
+}
+
+const argPolicy = process.argv[2]
+const hasPolicyArg = Boolean(argPolicy) && !argPolicy.startsWith('-')
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+const ncuArgs = hasPolicyArg ? process.argv.slice(3) : process.argv.slice(2)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+
+const depNames = new Set(Object.keys(policy.managedDependencies?.dependencies ?? {}))
+const devNames = new Set(Object.keys(policy.managedDependencies?.devDependencies ?? {}))
+const anyNames = new Set(Object.keys(policy.managedAnywhere ?? {}))
+
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-upgrade-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-upgrade-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+let ncuBin
+try {
+  const ncuPkgPath = require.resolve('npm-check-updates/package.json')
+  ncuBin = path.join(path.dirname(ncuPkgPath), 'build', 'cli.js')
+} catch {
+  console.error('[policy-upgrade] Could not resolve npm-check-updates binary.')
+  process.exit(1)
+}
+
+const effectiveNcuArgs =
+  ncuArgs.length > 0
+    ? ncuArgs
+    : ['--interactive', '--format', 'group', '--upgrade', '--packageManager', 'pnpm', '--install', 'never']
+
+console.log(`[policy-upgrade] policy=${policyPath}`)
+const run = spawnSync(process.execPath, [ncuBin, ...effectiveNcuArgs], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (run.error) {
+  console.error('[policy-upgrade]', run.error.message)
+  process.exit(1)
+}
+if ((run.status ?? 1) !== 0) {
+  process.exit(run.status ?? 1)
+}
+
+const updatedPkg = readJson(pkgPath)
+const updatedDeps = updatedPkg.dependencies ?? {}
+const updatedDevDeps = updatedPkg.devDependencies ?? {}
+
+for (const [name, version] of Object.entries(updatedDeps)) {
+  if (anyNames.has(name)) policy.managedAnywhere[name] = version
+  else if (depNames.has(name)) policy.managedDependencies.dependencies[name] = version
+}
+for (const [name, version] of Object.entries(updatedDevDeps)) {
+  if (devNames.has(name)) policy.managedDependencies.devDependencies[name] = version
+}
+
+fs.writeFileSync(policyPath, `${JSON.stringify(policy, null, 2)}\n`, 'utf8')
+console.log('[policy-upgrade] Updated dependency policy from selected ncu changes.')

package/scripts/policy-vulns.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/**
+ * Checks vulnerabilities for all dependency policy entries together by projecting
+ * policy data into one temporary package.json and running `pnpm audit` there.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit policy-vulns [policy-file]
+ */
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const policyPath = resolveDependencyPolicyPath(scriptDir, process.cwd(), process.argv)
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+const policy = readJson(policyPath)
+console.log(`[policy-vulns] policy=${policyPath}`)
+const deps = {
+  ...(policy.managedDependencies?.dependencies ?? {}),
+  ...(policy.managedAnywhere ?? {}),
+}
+const devDeps = {
+  ...(policy.managedDependencies?.devDependencies ?? {}),
+}
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fgd-policy-vulns-'))
+const pkgPath = path.join(tmpDir, 'package.json')
+fs.writeFileSync(
+  pkgPath,
+  `${JSON.stringify(
+    {
+      name: 'fgd-policy-vulns-temp',
+      private: true,
+      version: '0.0.0',
+      dependencies: deps,
+      devDependencies: devDeps,
+    },
+    null,
+    2,
+  )}\n`,
+  'utf8',
+)
+
+const install = spawnSync('pnpm', ['install', '--ignore-scripts'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (install.error) {
+  console.error('[policy-vulns]', install.error.message)
+  process.exit(1)
+}
+if ((install.status ?? 1) !== 0) {
+  process.exit(install.status ?? 1)
+}
+
+const audit = spawnSync('pnpm', ['audit'], {
+  cwd: tmpDir,
+  stdio: 'inherit',
+  env: process.env,
+})
+if (audit.error) {
+  console.error('[policy-vulns]', audit.error.message)
+  process.exit(1)
+}
+process.exit(audit.status ?? 1)

package/scripts/refresh-dependency-policy-from-repos.mjs

@@ -39,6 +39,15 @@ const policyPath = process.argv[3]
   ? path.resolve(process.cwd(), process.argv[3])
   : path.join(fgDevkitRoot, 'configs/dependency-policy.vue-workspace.json')
 
+let existingPolicy = {}
+try {
+  if (fs.existsSync(policyPath)) {
+    existingPolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  }
+} catch {
+  existingPolicy = {}
+}
+
 /** Relative paths under projectsRoot whose package.json files are ignored (maintainer choice). */
 /** Relative path prefixes under projectsRoot to skip when scanning (add repo names as needed). */
 const SKIP_DIR_PREFIXES = []
@@ -180,6 +189,7 @@ const policy = {
     devDependencies: sortRecord(outDev),
   },
   managedAnywhere: sortRecord(outAny),
+  overrides: sortRecord(existingPolicy.overrides ?? {}),
 }
 
 const policyErrors = [

package/scripts/repo-vulns.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * Checks vulnerabilities for the full dependency graph in the current repository
+ * by running `pnpm audit` in the working directory.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit repo-vulns
+ */
+
+import { spawnSync } from 'node:child_process'
+
+console.log(`[repo-vulns] cwd=${process.cwd()}`)
+const audit = spawnSync('pnpm', ['audit'], {
+  cwd: process.cwd(),
+  stdio: 'inherit',
+  env: process.env,
+})
+if (audit.error) {
+  console.error('[repo-vulns]', audit.error.message)
+  process.exit(1)
+}
+// pnpm audit returns exit code 1 when vulnerabilities are found.
+if ((audit.status ?? 1) === 1) {
+  process.exit(0)
+}
+process.exit(audit.status ?? 1)

package/scripts/sync-dependency-policy.mjs

@@ -20,6 +20,7 @@ import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mj
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
+const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
 
@@ -43,7 +44,6 @@ const policyErrors = [
     collectPinViolations(`managedDependencies.${section}.`, deps),
   ),
   ...collectPinViolations('managedAnywhere.', policy.managedAnywhere ?? {}),
-  ...collectPinViolations('overrides.', policy.overrides ?? {}),
 ]
 
 if (policyErrors.length > 0) {
@@ -57,6 +57,31 @@ if (policyErrors.length > 0) {
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
 const changes = []
 
+function getOverridePackageName(overrideKey) {
+  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : overrideKey
+}
+
+function getRelevantPolicyOverrides(policyOverrides) {
+  const entries = Object.entries(policyOverrides ?? {})
+  if (entries.length === 0) {
+    return {}
+  }
+  if (!fs.existsSync(lockfilePath)) {
+    return Object.fromEntries(entries)
+  }
+  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
+  const relevant = {}
+  for (const [name, version] of entries) {
+    const pkgName = getOverridePackageName(name)
+    // Conservative: only apply overrides for packages present in lockfile.
+    if (lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)) {
+      relevant[name] = version
+    }
+  }
+  return relevant
+}
+
 // Bump versions for managed dependencies / devDependencies where the key already exists.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
   pkg[section] ||= {}
@@ -104,7 +129,7 @@ pkg.pnpm ||= {}
 pkg.pnpm.overrides ||= {}
 
 // Apply policy-defined override versions when present in the policy.
-for (const [name, version] of Object.entries(policy.overrides ?? {})) {
+for (const [name, version] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
   if (pkg.pnpm.overrides[name] !== version) {
     changes.push(`pnpm.overrides.${name}: ${pkg.pnpm.overrides[name] ?? '(missing)'} -> ${version}`)
     pkg.pnpm.overrides[name] = version