fg-devkit 1.4.0 → 1.5.0

package/README.md

@@ -78,6 +78,36 @@ Check outdated policy versions:
 pnpm exec fgd policy-outdated
 ```
 
+Check vulnerabilities for all policy packages together (including transitive dependencies):
+
+```bash
+pnpm exec fgd policy-vulns
+```
+
+Check vulnerabilities for all dependencies in the current repo:
+
+```bash
+pnpm exec fgd repo-vulns
+```
+
+Check vulnerabilities across all Vue repositories under the projects root:
+
+```bash
+pnpm exec fgd fleet-vulns
+```
+
+For summary-only mode (no full per-repo pnpm audit output):
+
+```bash
+pnpm exec fgd fleet-vulns --summary-only
+```
+
+If npm audit is rate-limited (429), slow the scan down:
+
+```bash
+pnpm exec fgd fleet-vulns --delay-ms=8000
+```
+
 Upgrade policy versions interactively:
 
 ```bash

package/configs/dependency-policy.vue-workspace.json

@@ -92,5 +92,11 @@
     "tailwindcss": "4.2.3",
     "vite": "7.3.2",
     "vue": "3.5.32"
+  },
+  "overrides": {
+    "lodash@<=4.17.23": ">=4.18.0",
+    "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+    "lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
+    "tmp@<=0.2.3": ">=0.2.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -29,6 +29,9 @@
     "./scripts/sync-consumer-lefthook.mjs": "./scripts/sync-consumer-lefthook.mjs",
     "./scripts/prune-consumer-deps.mjs": "./scripts/prune-consumer-deps.mjs",
     "./scripts/policy-outdated.mjs": "./scripts/policy-outdated.mjs",
+    "./scripts/policy-vulns.mjs": "./scripts/policy-vulns.mjs",
+    "./scripts/repo-vulns.mjs": "./scripts/repo-vulns.mjs",
+    "./scripts/fleet-vulns.mjs": "./scripts/fleet-vulns.mjs",
     "./scripts/policy-upgrade.mjs": "./scripts/policy-upgrade.mjs",
     "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
     "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",

package/scripts/check-dependency-policy.mjs

@@ -21,6 +21,7 @@ import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mj
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
+const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
 
@@ -42,6 +43,30 @@ const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
 const policy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
 const mismatches = []
 
+function getOverridePackageName(overrideKey) {
+  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : overrideKey
+}
+
+function getRelevantPolicyOverrides(policyOverrides) {
+  const entries = Object.entries(policyOverrides ?? {})
+  if (entries.length === 0) {
+    return {}
+  }
+  if (!fs.existsSync(lockfilePath)) {
+    return Object.fromEntries(entries)
+  }
+  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
+  const relevant = {}
+  for (const [name, version] of entries) {
+    const pkgName = getOverridePackageName(name)
+    if (lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)) {
+      relevant[name] = version
+    }
+  }
+  return relevant
+}
+
 /** True if this package+section is governed by the policy (so global pin checks skip it). */
 function isPolicyManagedInSection(section, name) {
   if (policy.managedAnywhere?.[name] !== undefined) {
@@ -56,7 +81,6 @@ for (const [section, dependencies] of Object.entries(policy.managedDependencies
 }
 
 mismatches.push(...collectPinViolations('[policy] managedAnywhere.', policy.managedAnywhere ?? {}))
-mismatches.push(...collectPinViolations('[policy] overrides.', policy.overrides ?? {}))
 
 // Intersection: only packages that exist in both policy and consumer are compared.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
@@ -98,12 +122,10 @@ for (const [name, expected] of Object.entries(policy.managedAnywhere ?? {})) {
 
 // Optional: policy may define pnpm.overrides entries the consumer must mirror.
 const overrides = pkg.pnpm?.overrides ?? {}
-for (const [name, expected] of Object.entries(policy.overrides ?? {})) {
+for (const [name, expected] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
   const actual = overrides[name]
   if (actual !== expected) {
     mismatches.push(`pnpm.overrides.${name}: expected ${expected}, got ${actual ?? '(missing)'}`)
-  } else if (actual !== undefined && !isPinnedDependencyVersion(actual)) {
-    mismatches.push(`pnpm.overrides.${name}: must be pinned, got ${JSON.stringify(actual)}`)
   }
 }
 
@@ -121,9 +143,6 @@ for (const section of ['dependencies', 'devDependencies', 'optionalDependencies'
   }
 }
 
-// Consumer pnpm.overrides must be pinned (ranges reported even if not in policy).
-mismatches.push(...collectPinViolations('[pins] pnpm.overrides.', pkg.pnpm?.overrides ?? {}))
-
 if (mismatches.length > 0) {
   console.error('[check-deps] Dependency policy mismatches found:')
   for (const mismatch of mismatches) {

package/scripts/fg-devkit.mjs

@@ -7,6 +7,8 @@
  *   pnpm exec fg-devkit sync-deps [policy-file]
  *   pnpm exec fg-devkit policy-outdated [policy-file]
  *   pnpm exec fg-devkit policy-vulns [policy-file]
+ *   pnpm exec fg-devkit repo-vulns
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
@@ -98,24 +100,6 @@ function runPnpmInstall() {
   return r.status ?? 1
 }
 
-/** Run pnpm audit in current repo and return normalized status info. */
-function runPnpmAuditCurrentRepo() {
-  const r = spawnSync('pnpm', ['audit'], {
-    stdio: 'inherit',
-    cwd: process.cwd(),
-    env: process.env,
-  })
-  if (r.error) {
-    console.error('[fg-devkit]', r.error.message)
-    return { ok: false, hasVulns: false, exitCode: 1 }
-  }
-  const code = r.status ?? 1
-  if (code === 1) {
-    return { ok: true, hasVulns: true, exitCode: 0 }
-  }
-  return { ok: code === 0, hasVulns: false, exitCode: code }
-}
-
 /** Run Lefthook from fg-devkit bundled dependency set. */
 function runBundledLefthook(args = []) {
   let lefthookBin
@@ -275,22 +259,9 @@ function runMaintainerPolicyUpgradeAndCommit() {
   return commitStaged(commitMessage)
 }
 
-/** Maintainer flow: run both policy vuln check and fg-devkit root audit. */
+/** Maintainer flow: run full repo vulnerability audit in fg-devkit root. */
 function runMaintainerAuditAll() {
-  console.log('[fg-devkit] Running policy vulnerability scan...')
-  const policyCode = runNode('policy-vulns.mjs')
-  if (policyCode !== 0) return policyCode
-
-  console.log('[fg-devkit] Running fg-devkit repository audit...')
-  const repoAudit = runPnpmAuditCurrentRepo()
-  if (!repoAudit.ok) return repoAudit.exitCode
-
-  if (repoAudit.hasVulns) {
-    console.log('[fg-devkit] Completed: vulnerabilities were reported in fg-devkit repository audit.')
-  } else {
-    console.log('[fg-devkit] Completed: no vulnerabilities reported in fg-devkit repository audit.')
-  }
-  return 0
+  return runNode('repo-vulns.mjs')
 }
 
 /** Prompt release type in CLI before invoking release.sh to avoid a "stuck" terminal feeling. */
@@ -435,6 +406,8 @@ const DIRECT_COMMANDS = {
   'sync-deps': 'sync-dependency-policy.mjs',
   'policy-outdated': 'policy-outdated.mjs',
   'policy-vulns': 'policy-vulns.mjs',
+  'repo-vulns': 'repo-vulns.mjs',
+  'fleet-vulns': 'fleet-vulns.mjs',
   'policy-upgrade': 'policy-upgrade.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
@@ -452,7 +425,10 @@ Commands:
   check-deps [policy-file]        Validate package.json + pins against policy
   sync-deps [policy-file]         Align declared versions to policy (existing keys only)
   policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
-  policy-vulns [policy-file]      Check policy packages for vulnerabilities via pnpm audit
+  policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
+  repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
+  fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+                                 Run pnpm audit across Vue repos (full output + combined summary)
   policy-upgrade [policy-file] [ncu-args...]
                                  Upgrade policy packages via npm-check-updates (default interactive)
   sync-project-configs            VS Code + tooling sync (overwrites config files)
@@ -556,9 +532,14 @@ const MAINTAINER_MENU = [
   },
   {
     key: 'm6',
-    label: 'Maintainer: Check vulnerabilities (policy + fg-devkit repo)',
+    label: 'Maintainer: Check fg-devkit repo vulnerabilities',
     run: () => runMaintainerAuditAll(),
   },
+  {
+    key: 'm7',
+    label: 'Maintainer: Check vulnerabilities across all Vue repos',
+    run: () => runNode('fleet-vulns.mjs'),
+  },
 ]
 
 function isFgDevkitMaintainerContext() {

package/scripts/fleet-vulns.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+/**
+ * Runs vulnerability audits across Vue repositories and prints both per-repo
+ * pnpm audit output and a combined summary.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const cliArgs = process.argv.slice(2)
+const summaryOnly = cliArgs.includes('--summary-only')
+const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
+const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
+const delayArg = cliArgs.find((a) => a.startsWith('--delay-ms='))
+const delayMs = Number(delayArg?.split('=')[1] ?? 2500)
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function walk(dir, acc = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (item.name === 'node_modules' || item.name === '.git') continue
+    const p = path.join(dir, item.name)
+    if (item.isDirectory()) walk(p, acc)
+    else if (item.name === 'package.json') acc.push(p)
+  }
+  return acc
+}
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, 'utf8'))
+}
+
+function isVueProject(pkg) {
+  return Boolean(pkg.dependencies?.vue || pkg.devDependencies?.vue)
+}
+
+function countTotal(severityMap = {}) {
+  return Object.values(severityMap).reduce((sum, n) => sum + Number(n || 0), 0)
+}
+
+const packageJsonFiles = walk(projectsRoot)
+const repos = []
+for (const packageJsonPath of packageJsonFiles) {
+  try {
+    const pkg = readJson(packageJsonPath)
+    const repoDir = path.dirname(packageJsonPath)
+    if (!isVueProject(pkg)) continue
+    if (pkg.name === 'fg-devkit') continue
+    repos.push(repoDir)
+  } catch {
+    // Ignore invalid package.json files.
+  }
+}
+
+const uniqueRepos = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+if (uniqueRepos.length === 0) {
+  console.log(`[fleet-vulns] No Vue repositories found under ${projectsRoot}`)
+  process.exit(0)
+}
+
+console.log(`[fleet-vulns] projectsRoot=${projectsRoot}`)
+console.log(`[fleet-vulns] repositories=${uniqueRepos.length}`)
+
+const results = []
+let hasFailures = false
+let hasVulnerabilities = false
+
+for (const repoDir of uniqueRepos) {
+  const repoName = path.basename(repoDir)
+  const lockfilePath = path.join(repoDir, 'pnpm-lock.yaml')
+  if (!fs.existsSync(lockfilePath)) {
+    console.log(`[fleet-vulns] SKIP ${repoName}: missing pnpm-lock.yaml`)
+    continue
+  }
+
+  console.log(`\n[fleet-vulns] Auditing ${repoName}`)
+  if (!summaryOnly) {
+    const prettyAudit = spawnSync('pnpm', ['audit'], {
+      cwd: repoDir,
+      env: process.env,
+      stdio: 'inherit',
+    })
+
+    if (prettyAudit.error) {
+      hasFailures = true
+      console.error(`[fleet-vulns] FAIL ${repoName}: ${prettyAudit.error.message}`)
+      continue
+    }
+    const prettyCode = prettyAudit.status ?? 1
+    if (prettyCode !== 0 && prettyCode !== 1) {
+      hasFailures = true
+      console.error(`[fleet-vulns] FAIL ${repoName}: pnpm audit exited with code ${prettyCode}`)
+      continue
+    }
+  }
+
+  const audit = spawnSync('pnpm', ['audit', '--json'], {
+    cwd: repoDir,
+    env: process.env,
+    encoding: 'utf8',
+  })
+
+  if (audit.error) {
+    hasFailures = true
+    console.error(`[fleet-vulns] FAIL ${repoName}: ${audit.error.message}`)
+    continue
+  }
+
+  let report = null
+  try {
+    report = JSON.parse(audit.stdout || '{}')
+  } catch {
+    report = null
+  }
+
+  if (!report || typeof report !== 'object') {
+    hasFailures = true
+    console.error(`[fleet-vulns] FAIL ${repoName}: could not parse pnpm audit --json output`)
+    continue
+  }
+
+  const vulnerabilities = report.metadata?.vulnerabilities ?? {}
+  const total = countTotal(vulnerabilities)
+  if (total > 0) hasVulnerabilities = true
+
+  results.push({
+    repoName,
+    vulnerabilities,
+    total,
+    dependencies: report.metadata?.totalDependencies ?? 0,
+  })
+
+  if (delayMs > 0) {
+    await sleep(delayMs)
+  }
+}
+
+console.log('\n[fleet-vulns] Summary')
+for (const r of results) {
+  const v = r.vulnerabilities
+  console.log(
+    `- ${r.repoName}: total=${r.total} (critical=${v.critical ?? 0}, high=${v.high ?? 0}, moderate=${v.moderate ?? 0}, low=${v.low ?? 0}, info=${v.info ?? 0}) deps=${r.dependencies}`,
+  )
+}
+
+if (results.length === 0) {
+  console.log('[fleet-vulns] No repositories were audited.')
+}
+
+if (hasFailures) {
+  process.exit(1)
+}
+if (hasVulnerabilities) {
+  process.exit(1)
+}
+process.exit(0)

package/scripts/policy-vulns.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
- * Checks vulnerabilities for dependency policy entries by projecting policy data
- * into a temporary package.json and running `pnpm audit` there.
+ * Checks vulnerabilities for all dependency policy entries together by projecting
+ * policy data into one temporary package.json and running `pnpm audit` there.
  *
  * Usage:
  *   pnpm exec fg-devkit policy-vulns [policy-file]
@@ -22,6 +22,7 @@ function readJson(p) {
 }
 
 const policy = readJson(policyPath)
+console.log(`[policy-vulns] policy=${policyPath}`)
 const deps = {
   ...(policy.managedDependencies?.dependencies ?? {}),
   ...(policy.managedAnywhere ?? {}),
@@ -48,7 +49,6 @@ fs.writeFileSync(
   'utf8',
 )
 
-console.log(`[policy-vulns] policy=${policyPath}`)
 const install = spawnSync('pnpm', ['install', '--ignore-scripts'], {
   cwd: tmpDir,
   stdio: 'inherit',
@@ -71,8 +71,4 @@ if (audit.error) {
   console.error('[policy-vulns]', audit.error.message)
   process.exit(1)
 }
-// pnpm audit returns exit code 1 when vulnerabilities are found.
-if ((audit.status ?? 1) === 1) {
-  process.exit(0)
-}
 process.exit(audit.status ?? 1)

package/scripts/refresh-dependency-policy-from-repos.mjs

@@ -39,6 +39,15 @@ const policyPath = process.argv[3]
   ? path.resolve(process.cwd(), process.argv[3])
   : path.join(fgDevkitRoot, 'configs/dependency-policy.vue-workspace.json')
 
+let existingPolicy = {}
+try {
+  if (fs.existsSync(policyPath)) {
+    existingPolicy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+  }
+} catch {
+  existingPolicy = {}
+}
+
 /** Relative paths under projectsRoot whose package.json files are ignored (maintainer choice). */
 /** Relative path prefixes under projectsRoot to skip when scanning (add repo names as needed). */
 const SKIP_DIR_PREFIXES = []
@@ -180,6 +189,7 @@ const policy = {
     devDependencies: sortRecord(outDev),
   },
   managedAnywhere: sortRecord(outAny),
+  overrides: sortRecord(existingPolicy.overrides ?? {}),
 }
 
 const policyErrors = [

package/scripts/repo-vulns.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * Checks vulnerabilities for the full dependency graph in the current repository
+ * by running `pnpm audit` in the working directory.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit repo-vulns
+ */
+
+import { spawnSync } from 'node:child_process'
+
+console.log(`[repo-vulns] cwd=${process.cwd()}`)
+const audit = spawnSync('pnpm', ['audit'], {
+  cwd: process.cwd(),
+  stdio: 'inherit',
+  env: process.env,
+})
+if (audit.error) {
+  console.error('[repo-vulns]', audit.error.message)
+  process.exit(1)
+}
+// pnpm audit returns exit code 1 when vulnerabilities are found.
+if ((audit.status ?? 1) === 1) {
+  process.exit(0)
+}
+process.exit(audit.status ?? 1)

package/scripts/sync-dependency-policy.mjs

@@ -20,6 +20,7 @@ import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mj
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
+const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
 
@@ -43,7 +44,6 @@ const policyErrors = [
     collectPinViolations(`managedDependencies.${section}.`, deps),
   ),
   ...collectPinViolations('managedAnywhere.', policy.managedAnywhere ?? {}),
-  ...collectPinViolations('overrides.', policy.overrides ?? {}),
 ]
 
 if (policyErrors.length > 0) {
@@ -57,6 +57,31 @@ if (policyErrors.length > 0) {
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
 const changes = []
 
+function getOverridePackageName(overrideKey) {
+  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : overrideKey
+}
+
+function getRelevantPolicyOverrides(policyOverrides) {
+  const entries = Object.entries(policyOverrides ?? {})
+  if (entries.length === 0) {
+    return {}
+  }
+  if (!fs.existsSync(lockfilePath)) {
+    return Object.fromEntries(entries)
+  }
+  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
+  const relevant = {}
+  for (const [name, version] of entries) {
+    const pkgName = getOverridePackageName(name)
+    // Conservative: only apply overrides for packages present in lockfile.
+    if (lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)) {
+      relevant[name] = version
+    }
+  }
+  return relevant
+}
+
 // Bump versions for managed dependencies / devDependencies where the key already exists.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
   pkg[section] ||= {}
@@ -104,7 +129,7 @@ pkg.pnpm ||= {}
 pkg.pnpm.overrides ||= {}
 
 // Apply policy-defined override versions when present in the policy.
-for (const [name, version] of Object.entries(policy.overrides ?? {})) {
+for (const [name, version] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
   if (pkg.pnpm.overrides[name] !== version) {
     changes.push(`pnpm.overrides.${name}: ${pkg.pnpm.overrides[name] ?? '(missing)'} -> ${version}`)
     pkg.pnpm.overrides[name] = version