pr-checkmate 1.23.16 → 1.23.18

package/dist/cli.js

@@ -54,9 +54,28 @@ const COMMAND_TO_CHECK = {
     'ruby-lint': 'RuboCop',
     'php-format': 'PHP CS Fixer',
 };
-const cmd = process.argv[2];
+/** Commands that run the whole pipeline (or no pipeline at all) and take no siblings. */
+const STANDALONE_COMMANDS = ['init', 'all', 'precommit'];
+const args = process.argv.slice(2);
+const cmd = args[0];
+/**
+ * Reject extra arguments after a standalone command. Silently ignoring them would
+ * report success for work that never ran — `pr-checkmate init lint` must not look
+ * like it linted anything.
+ *
+ * Driven by {@link STANDALONE_COMMANDS} so the list stays the single source of truth:
+ * a per-branch guard would leave the next standalone command unguarded the day it is
+ * added to the list but not to the branch.
+ */
+function rejectExtraArgs() {
+    if (!cmd || !STANDALONE_COMMANDS.includes(cmd) || args.length <= 1)
+        return;
+    utils_1.logger.error(`[cli]: "${cmd}" takes no other arguments, got: ${args.slice(1).join(', ')}. Run them as a separate command.`);
+    process.exit(1);
+}
 void (async () => {
     try {
+        rejectExtraArgs();
         if (cmd === 'init') {
             await (0, init_1.init)();
             process.exit(0);
@@ -81,12 +100,16 @@ void (async () => {
             const report = await (0, core_1.runChecks)({ staged: true, reporter: 'stdout', write: false });
             process.exit(report.ok ? 0 : 1);
         }
-        const checkName = COMMAND_TO_CHECK[cmd];
-        if (!checkName) {
-            utils_1.logger.warn(`[cli]: Unknown command "${cmd}". Available: all, init, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
+        // Every remaining argument is a check name, so `pr-checkmate lint spellcheck`
+        // runs both in one pass. Unknown names abort the whole run — a typo must never
+        // shrink the requested check set silently.
+        const unknown = args.filter(arg => !COMMAND_TO_CHECK[arg]);
+        if (unknown.length > 0) {
+            utils_1.logger.error(`[cli]: Unknown command(s) "${unknown.join('", "')}". Available: ${STANDALONE_COMMANDS.join(', ')}, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
             process.exit(1);
         }
-        const report = await (0, core_1.runChecks)({ only: [checkName], reporter: 'stdout', write: true });
+        const checkNames = [...new Set(args.map(arg => COMMAND_TO_CHECK[arg]))];
+        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true });
         process.exit(report.ok ? 0 : 1);
     }
     catch (err) {

package/dist/core/checks/dependencies/dependency-check.d.ts

@@ -1,2 +1,14 @@
 import { Check } from '../../types';
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+export declare function toKnipIgnorePattern(entry: string): string;
 export declare const dependencyCheck: Check;

package/dist/core/checks/dependencies/dependency-check.js

@@ -4,11 +4,69 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dependencyCheck = void 0;
+exports.toKnipIgnorePattern = toKnipIgnorePattern;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
+/**
+ * Config files knip discovers on its own. When a client ships one, it is the source
+ * of truth and pr-checkmate passes no config of its own — the same rule spellcheck
+ * follows for cspell.json.
+ *
+ * Mirrors knip's own `KNIP_CONFIG_LOCATIONS` exactly. Listing a name knip does not
+ * read (`knip.config.mjs`, say) would be worse than useless: the repo would count as
+ * "configures knip itself", so `dependency.ignore` would be dropped, while knip
+ * ignored that file too — leaving the client with warnings they had silenced.
+ */
+const KNIP_CONFIG_FILES = [
+    'knip.json',
+    'knip.jsonc',
+    '.knip.json',
+    '.knip.jsonc',
+    'knip.ts',
+    'knip.js',
+    'knip.config.ts',
+    'knip.config.js',
+];
+/** Regex metacharacters to neutralise before a glob is compiled. */
+const REGEX_SPECIALS = /[.*+?^${}()|[\]\\]/g;
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+function toKnipIgnorePattern(entry) {
+    const escaped = entry.replace(REGEX_SPECIALS, '\\$&');
+    return `^${escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.')}$`;
+}
+/** knip also reads a `knip` key from package.json. */
+function hasPackageJsonConfig(cwd) {
+    try {
+        return 'knip' in JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Collect the names reported for one issue type across every file in the report. */
+function collectNames(issues, key) {
+    return [...new Set(issues.flatMap(issue => (issue[key] ?? []).map(entry => entry.name)))];
+}
+/** Files a given unlisted dependency is imported from, for the failure message. */
+function filesUsing(issues, name) {
+    return issues
+        .filter(issue => (issue.unlisted ?? []).some(entry => entry.name === name))
+        .map(issue => issue.file);
+}
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',
@@ -18,51 +76,80 @@ exports.dependencyCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
-        // Resolve the bundled depcheck binary and run it via the current node — never
-        // shell out to `npx`, which fails (exit 127) when depcheck isn't on the path.
-        let depcheckBin;
+        // Resolve the bundled knip binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when knip isn't on the path.
+        let knipBin;
         try {
-            depcheckBin = (0, utils_1.resolvePackageBin)('depcheck', 'bin/depcheck.js');
+            knipBin = (0, utils_1.resolvePackageBin)('knip', 'bin/knip.js');
         }
         catch {
-            return (0, types_1.skip)('depcheck unavailable');
+            return (0, types_1.skip)('knip unavailable');
         }
-        // Dependency names/globs to skip, configured in pr-checkmate.json. Passed via
-        // --ignores so a single pr-checkmate.json is the source of truth; depcheck's
-        // CLI --ignores overrides any .depcheckrc, so we only pass it when non-empty
-        // (letting a client's own .depcheckrc still apply when nothing is configured).
+        // Dependency names to skip, configured in pr-checkmate.json. knip takes these
+        // from a config file only, so they go into a temp one — but a client's own knip
+        // config wins outright, exactly as it does for cspell.
         const ignore = ctx.config.dependency?.ignore ?? [];
-        const args = [depcheckBin, '--json'];
-        if (ignore.length > 0)
-            args.push(`--ignores=${ignore.join(',')}`);
-        // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-        const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
-            cwd: ctx.cwd,
-            reject: false,
-        });
-        const start = stdout.indexOf('{');
-        const end = stdout.lastIndexOf('}');
-        // No JSON at all → the tool couldn't produce a result; skip rather than fail the client's PR.
-        if (start === -1 || end === -1)
-            return (0, types_1.skip)('depcheck produced no output');
-        const json = stdout.slice(start, end + 1);
-        let result;
-        try {
-            result = JSON.parse(json);
+        const clientOwnsConfig = (0, config_1.hasLocalConfig)(KNIP_CONFIG_FILES) || hasPackageJsonConfig(ctx.cwd);
+        let tempConfigPath = null;
+        if (ignore.length > 0 && clientOwnsConfig) {
+            // Say so out loud: a silently ignored `ignore` list looks like a broken check.
+            utils_1.logger.info(`[Dependencies]: ℹ️ this repo has its own knip config, so dependency.ignore (${ignore.join(', ')}) is not applied — add those names to knip's ignoreDependencies instead.`);
         }
-        catch {
-            return (0, types_1.fail)('depcheck produced invalid JSON');
+        if (ignore.length > 0 && !clientOwnsConfig) {
+            tempConfigPath = node_path_1.default.join(ctx.cwd, '.knip.temp.json');
+            node_fs_1.default.writeFileSync(tempConfigPath, JSON.stringify({ ignoreDependencies: ignore.map(toKnipIgnorePattern) }, null, 2));
         }
-        const unused = result.dependencies ?? [];
-        const missing = Object.keys(result.missing ?? {});
-        if (missing.length > 0) {
-            missing.forEach(dep => utils_1.logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${result.missing[dep]?.join(', ')})`));
-            return (0, types_1.fail)(`missing: ${missing.join(', ')}`);
+        // Only unused prod dependencies and imports missing from package.json are
+        // reported. knip's other issue types (unused devDependencies, binaries,
+        // unresolved paths) are noise here: CLI tools and shell commands legitimately
+        // have no import to find.
+        const args = [
+            knipBin,
+            '--reporter',
+            'json',
+            '--include',
+            'dependencies,unlisted',
+            '--no-config-hints',
+            '--no-exit-code',
+            '--no-progress',
+        ];
+        if (tempConfigPath)
+            args.push('--config', tempConfigPath);
+        try {
+            // reject:false — knip can still exit non-zero (e.g. config hints) while
+            // writing a perfectly good report to stdout.
+            const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
+                cwd: ctx.cwd,
+                reject: false,
+            });
+            const start = stdout.indexOf('{');
+            const end = stdout.lastIndexOf('}');
+            // No JSON at all → the tool couldn't produce a result; skip rather than fail the client's PR.
+            if (start === -1 || end === -1)
+                return (0, types_1.skip)('knip produced no output');
+            let result;
+            try {
+                result = JSON.parse(stdout.slice(start, end + 1));
+            }
+            catch {
+                return (0, types_1.fail)('knip produced invalid JSON');
+            }
+            const issues = result.issues ?? [];
+            const unused = collectNames(issues, 'dependencies');
+            const missing = collectNames(issues, 'unlisted');
+            if (missing.length > 0) {
+                missing.forEach(dep => utils_1.logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${filesUsing(issues, dep).join(', ')})`));
+                return (0, types_1.fail)(`missing: ${missing.join(', ')}`);
+            }
+            if (unused.length > 0) {
+                unused.forEach(dep => utils_1.logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
+                return (0, types_1.warn)(`${unused.length} unused dependency(ies)`);
+            }
+            return (0, types_1.pass)();
         }
-        if (unused.length > 0) {
-            unused.forEach(dep => utils_1.logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
-            return (0, types_1.warn)(`${unused.length} unused dependency(ies)`);
+        finally {
+            if (tempConfigPath)
+                (0, utils_1.cleanupTempFile)(tempConfigPath);
         }
-        return (0, types_1.pass)();
     },
 };

package/dist/core/checks/dependencies/grype-scan.d.ts

@@ -13,5 +13,10 @@ import { Check } from '../../types';
  * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
  * ecosystem has no manifest we can parse are suppressed too, and the count of
  * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
  */
 export declare const grypeScanCheck: Check;

package/dist/core/checks/dependencies/grype-scan.js

@@ -14,6 +14,11 @@ const TYPE_TO_ECOSYSTEM = {
     gem: 'ruby',
     'php-composer': 'php',
 };
+/**
+ * Cap for the scan. grype has no internal limit, so without this a slow scan just
+ * looks like a hung commit — an advisory check must never be able to do that.
+ */
+const DEFAULT_TIMEOUT_MS = 120000;
 function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
@@ -31,6 +36,11 @@ function severityRank(severity) {
  * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
  * ecosystem has no manifest we can parse are suppressed too, and the count of
  * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
  */
 exports.grypeScanCheck = {
     name: 'Grype Scan',
@@ -42,14 +52,27 @@ exports.grypeScanCheck = {
         const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
         const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
-        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q'], {
+        // Never walk `ignoreDirs` — the same contract every other check honours, and
+        // here it is the difference between a usable check and an unusable one. A bare
+        // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
+        // 355s versus 0.8s with the directory excluded, for byte-for-byte the same
+        // findings: grype resolves package versions from the lockfile, and installed
+        // third-party code is not something the client could fix anyway (see below).
+        const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
+        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
+            timeout,
         });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
             return (0, types_1.skip)('grype not installed');
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Grype Scan]: ⚠️ grype timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('grype timed out');
+        }
         let report;
         try {
             report = JSON.parse(result.stdout);

package/dist/core/checks/dependencies/license-check.js

@@ -33,7 +33,7 @@ exports.licenseCheck = {
         // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
         let licenseCheckerBin;
         try {
-            licenseCheckerBin = (0, utils_1.resolvePackageBin)('license-checker', 'bin/license-checker');
+            licenseCheckerBin = (0, utils_1.resolvePackageBin)('license-checker-rseidelsohn', 'bin/license-checker-rseidelsohn.js');
         }
         catch {
             return (0, types_1.skip)('license-checker unavailable');

package/dist/core/checks/dependencies/vuln-scan.d.ts

@@ -1,9 +1,2 @@
 import { Check } from '../../types';
-/**
- * Cross-language dependency vulnerability scan via osv-scanner, which reads
- * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
- * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
- * must be on the runner, and the check skips gracefully when it is absent.
- * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
- */
 export declare const vulnScanCheck: Check;

package/dist/core/checks/dependencies/vuln-scan.js

@@ -10,7 +10,12 @@ const types_1 = require("../../types");
  * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
  * must be on the runner, and the check skips gracefully when it is absent.
  * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ *
+ * `-r .` walks the tree, so the run is capped: an advisory check must never be able
+ * to look like a hung commit, which is exactly what an uncapped directory scan does
+ * on a repo with dependencies installed.
  */
+const DEFAULT_TIMEOUT_MS = 120000;
 exports.vulnScanCheck = {
     name: 'Vuln Scan',
     phase: 'informational',
@@ -18,11 +23,20 @@ exports.vulnScanCheck = {
         return ctx.config.vulnScan?.enabled === true;
     },
     async run(ctx) {
-        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], { cwd: ctx.cwd, reject: false });
+        const timeout = ctx.config.vulnScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], {
+            cwd: ctx.cwd,
+            reject: false,
+            timeout,
+        });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
             return (0, types_1.skip)('osv-scanner not installed');
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Vuln Scan]: ⚠️ osv-scanner timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('osv-scanner timed out');
+        }
         if (result.exitCode === 0) {
             utils_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
             return (0, types_1.pass)();

package/dist/init.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Merge current defaults into an existing config, recursively.
+ *
+ * The user's value always wins, so hand-tuned settings survive an `init` re-run,
+ * while every new default field — at any nesting depth — gets added. Arrays are
+ * replaced wholesale rather than concatenated: lists like `ignoreDirs` or
+ * `cspell.words` are meant to be edited, and merging them would resurrect entries
+ * the user deliberately removed. {@link REPLACED_OBJECT_PATHS} extends that rule to
+ * the object-shaped lists.
+ *
+ * Informational `//`-prefixed keys are the one exception — they are documentation,
+ * not settings, so the refreshed default text wins whenever a default exists.
+ *
+ * @param defaults Current defaults for this level of the config tree.
+ * @param user The existing pr-checkmate.json content for the same level.
+ * @param path Dot-joined position of `defaults` in the config tree, used to match
+ * {@link REPLACED_OBJECT_PATHS}. Internal to the recursion; callers pass nothing.
+ */
+export declare function mergeWithDefaults(defaults: Record<string, unknown>, user: Record<string, unknown>, path?: string): Record<string, unknown>;
 /**
  * Initialize (or refresh) pr-checkmate configuration in the current project.
  */

package/dist/init.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeWithDefaults = mergeWithDefaults;
 exports.init = init;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -101,11 +102,11 @@ const DEFAULT_CONFIG = {
         // are intentionally absent — add them here to detect duplication in them too.
         formats: config_1.DUPLICATE_CODE_FORMATS,
     },
-    // Dependency usage check (depcheck)
+    // Dependency usage check (knip)
     dependency: {
         enabled: true,
-        // Dependency names/globs to skip (e.g. CLI-only tools invoked as binaries,
-        // which depcheck can't see as imports and would report as unused).
+        // Dependency names to skip (e.g. CLI-only tools invoked as binaries,
+        // which knip can't see as imports and would report as unused).
         ignore: [],
     },
     // Unused-exports check (ts-unused-exports)
@@ -144,7 +145,9 @@ const DEFAULT_CONFIG = {
     dockerfileSecurity: { enabled: true }, // Dockerfile: :latest, USER root, curl|bash, …
     caseCollision: { enabled: true }, // files differing only by case
     vulnScan: { enabled: false }, // cross-language dep vulns (osv-scanner, runner-dependency)
-    grypeScan: { enabled: true, minSeverity: 'medium' }, // dep vulns (grype, non-blocking, runner-dependency; skips if grype absent)
+    // dep vulns (grype, non-blocking, runner-dependency; skips if grype absent).
+    // Never walks `ignoreDirs`; `timeoutMs` caps the scan so it cannot stall a commit.
+    grypeScan: { enabled: true, minSeverity: 'medium', timeoutMs: 120000 },
     // Test-coverage presence. Opt-in: enable once your CI produces a coverage
     // report (lcov/cobertura/jacoco/…); warns if none is found.
     coverage: { enabled: false },
@@ -270,6 +273,52 @@ async function createConfig(root) {
     setupWorkflow(root);
     setupTsConfig(root, sourcePath);
 }
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Config paths whose object value is a curated list, not a set of settings — the
+ * user is meant to add and remove entries, exactly like an array.
+ *
+ * These are merged the way arrays are: the user's object replaces the default one
+ * wholesale. Deep-merging them would hand back every rule the user deleted, and for
+ * `eslint.rules` that is not cosmetic — Lint is a blocking check, so a re-run of
+ * `init` would silently reinstate rules and start failing the next PR on them. The
+ * documented way to switch a rule off is `"off"`, which survives either way.
+ */
+const REPLACED_OBJECT_PATHS = new Set(['eslint.rules', 'prettier.rules', 'markdownlint.rules']);
+/**
+ * Merge current defaults into an existing config, recursively.
+ *
+ * The user's value always wins, so hand-tuned settings survive an `init` re-run,
+ * while every new default field — at any nesting depth — gets added. Arrays are
+ * replaced wholesale rather than concatenated: lists like `ignoreDirs` or
+ * `cspell.words` are meant to be edited, and merging them would resurrect entries
+ * the user deliberately removed. {@link REPLACED_OBJECT_PATHS} extends that rule to
+ * the object-shaped lists.
+ *
+ * Informational `//`-prefixed keys are the one exception — they are documentation,
+ * not settings, so the refreshed default text wins whenever a default exists.
+ *
+ * @param defaults Current defaults for this level of the config tree.
+ * @param user The existing pr-checkmate.json content for the same level.
+ * @param path Dot-joined position of `defaults` in the config tree, used to match
+ * {@link REPLACED_OBJECT_PATHS}. Internal to the recursion; callers pass nothing.
+ */
+function mergeWithDefaults(defaults, user, path = '') {
+    const merged = { ...defaults };
+    for (const [key, userValue] of Object.entries(user)) {
+        const defaultValue = defaults[key];
+        const keyPath = path ? `${path}.${key}` : key;
+        if (key.startsWith('//') && defaultValue !== undefined)
+            continue;
+        merged[key] =
+            isPlainObject(defaultValue) && isPlainObject(userValue) && !REPLACED_OBJECT_PATHS.has(keyPath)
+                ? mergeWithDefaults(defaultValue, userValue, keyPath)
+                : userValue;
+    }
+    return merged;
+}
 /** Re-run setup: merge the existing config with current defaults. */
 async function updateConfig(root) {
     utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
@@ -278,19 +327,13 @@ async function updateConfig(root) {
         const json = JSON.parse(raw);
         const languages = await (0, utils_1.detectLanguages)(root);
         utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
-        // Merge with defaults to add new fields
+        // Merge with defaults to add new fields at every depth — a hand-maintained
+        // list of sections to merge would silently stop delivering new defaults to
+        // existing configs the moment a section is forgotten.
         const updated = {
-            ...DEFAULT_CONFIG,
-            ...json,
+            ...mergeWithDefaults(DEFAULT_CONFIG, json),
             // Refresh detected languages on every init so new source dirs are picked up
             languages,
-            eslint: { ...DEFAULT_CONFIG.eslint, ...(json.eslint || {}) },
-            prettier: { ...DEFAULT_CONFIG.prettier, ...(json.prettier || {}) },
-            cspell: { ...DEFAULT_CONFIG.cspell, ...(json.cspell || {}) },
-            typecheck: { ...DEFAULT_CONFIG.typecheck, ...(json.typecheck || {}) },
-            diffSmell: { ...DEFAULT_CONFIG.diffSmell, ...(json.diffSmell || {}) },
-            prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
-            duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
         };
         fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2));
         utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');

package/dist/interfaces/index.d.ts

@@ -145,11 +145,13 @@ export interface PRCheckMateConfig {
     dependency?: {
         enabled?: boolean;
         /**
-         * Dependency names to exclude from the unused/missing check (depcheck).
-         * Supports globs, e.g. "@types/*". Use for packages that are invoked only as
-         * CLI binaries or referenced from config — depcheck sees no `import` for them
-         * and would otherwise report them as unused. Passed to depcheck's `--ignores`,
-         * which takes precedence over any `.depcheckrc` file.
+         * Dependency names to exclude from the unused/missing check (knip).
+         * Supports globs matched against the whole name, e.g. "@types/*" — so
+         * "eslint-*" covers "eslint-plugin-x" but never "eslint" itself. Use for
+         * packages that are invoked only as CLI binaries or referenced from config —
+         * knip sees no `import` for them and would otherwise report them as unused.
+         * Compiled into a temporary knip config, so a repo that ships its own knip
+         * config keeps full control instead.
          */
         ignore?: string[];
     };
@@ -204,11 +206,19 @@ export interface PRCheckMateConfig {
     };
     vulnScan?: {
         enabled?: boolean;
+        timeoutMs?: number;
     };
     grypeScan?: {
         enabled?: boolean;
         minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
         ignore?: string[];
+        /**
+         * Max time (ms) for the grype scan before the check skips. Default 120000.
+         * `ignoreDirs` already keeps `node_modules`, `dist` and friends out of the walk,
+         * which is what makes the scan fast; this is the backstop so an advisory check
+         * can never stall a commit.
+         */
+        timeoutMs?: number;
     };
     bannedImports?: Array<{
         name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.16",
+    "version": "1.23.18",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -83,7 +83,6 @@
         "@typescript-eslint/parser": "^8.62.1",
         "@wasm-fmt/clang-format": "^22.1.8",
         "cspell": "^10.0.1",
-        "depcheck": "^1.4.7",
         "eslint": "^10.6.0",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-import-x": "^4.17.1",
@@ -94,7 +93,8 @@
         "gitleaks-secret-scanner-fixed": "^2.1.3",
         "inquirer": "^14.0.2",
         "jscpd": "^5.0.11",
-        "license-checker": "^25.0.1",
+        "knip": "^6.29.0",
+        "license-checker-rseidelsohn": "^5.0.1",
         "markdownlint-cli2": "^0.23.1",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",

package/pr-checkmate.schema.json

@@ -87,7 +87,7 @@
     },
     "vulnScan": {
       "type": "object",
-      "properties": { "enabled": { "type": "boolean" } }
+      "properties": { "enabled": { "type": "boolean" }, "timeoutMs": { "type": "number" } }
     },
     "grypeScan": {
       "type": "object",
@@ -97,7 +97,8 @@
           "type": "string",
           "enum": ["negligible", "low", "medium", "high", "critical"]
         },
-        "ignore": { "type": "array", "items": { "type": "string" } }
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
       }
     },
     "security": {

package/src/config/pr-checkmate.schema.json

@@ -87,7 +87,7 @@
     },
     "vulnScan": {
       "type": "object",
-      "properties": { "enabled": { "type": "boolean" } }
+      "properties": { "enabled": { "type": "boolean" }, "timeoutMs": { "type": "number" } }
     },
     "grypeScan": {
       "type": "object",
@@ -97,7 +97,8 @@
           "type": "string",
           "enum": ["negligible", "low", "medium", "high", "critical"]
         },
-        "ignore": { "type": "array", "items": { "type": "string" } }
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
       }
     },
     "security": {