pr-checkmate 1.23.17 → 1.23.19

package/README.md

@@ -10,7 +10,6 @@
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 [![Security scan](https://img.shields.io/badge/security-SBOM_%2B_VirusTotal-2ea44f)](https://github.com/Mybono/pr_checkmate_public/releases/latest)
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Mybono/pr_checkmate_public/badge)](https://scorecard.dev/viewer/?uri=github.com/Mybono/pr_checkmate_public)
 
 > PR CheckMate is a universal PR quality checker: one `npm install`, 51 checks across
 > 11 languages, running in CI on every pull request. The bundled languages need no
@@ -20,8 +19,6 @@ Every release is published with a CycloneDX SBOM and an independent
 [VirusTotal scan report](https://github.com/Mybono/pr_checkmate_public/releases/latest)
 of the exact npm tarball, attached to that version's
 [GitHub release notes](https://github.com/Mybono/pr_checkmate_public/releases/latest).
-The public repo also runs an [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/Mybono/pr_checkmate_public)
-analysis of its own supply-chain hygiene.
 
 ## Why PR CheckMate
 

package/cspell.json

@@ -309,6 +309,7 @@
     "dont",
     "Dorg",
     "dotenv",
+    "dotenvx",
     "dotnet",
     "DPARALLEL",
     "dpdm",
@@ -343,6 +344,7 @@
     "endtable",
     "engineio",
     "ENOENT",
+    "ENOLOCK",
     "eoilist",
     "Escaneá",
     "Escaneás",

package/dist/cli.js

@@ -54,9 +54,28 @@ const COMMAND_TO_CHECK = {
     'ruby-lint': 'RuboCop',
     'php-format': 'PHP CS Fixer',
 };
-const cmd = process.argv[2];
+/** Commands that run the whole pipeline (or no pipeline at all) and take no siblings. */
+const STANDALONE_COMMANDS = ['init', 'all', 'precommit'];
+const args = process.argv.slice(2);
+const cmd = args[0];
+/**
+ * Reject extra arguments after a standalone command. Silently ignoring them would
+ * report success for work that never ran — `pr-checkmate init lint` must not look
+ * like it linted anything.
+ *
+ * Driven by {@link STANDALONE_COMMANDS} so the list stays the single source of truth:
+ * a per-branch guard would leave the next standalone command unguarded the day it is
+ * added to the list but not to the branch.
+ */
+function rejectExtraArgs() {
+    if (!cmd || !STANDALONE_COMMANDS.includes(cmd) || args.length <= 1)
+        return;
+    utils_1.logger.error(`[cli]: "${cmd}" takes no other arguments, got: ${args.slice(1).join(', ')}. Run them as a separate command.`);
+    process.exit(1);
+}
 void (async () => {
     try {
+        rejectExtraArgs();
         if (cmd === 'init') {
             await (0, init_1.init)();
             process.exit(0);
@@ -81,12 +100,16 @@ void (async () => {
             const report = await (0, core_1.runChecks)({ staged: true, reporter: 'stdout', write: false });
             process.exit(report.ok ? 0 : 1);
         }
-        const checkName = COMMAND_TO_CHECK[cmd];
-        if (!checkName) {
-            utils_1.logger.warn(`[cli]: Unknown command "${cmd}". Available: all, init, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
+        // Every remaining argument is a check name, so `pr-checkmate lint spellcheck`
+        // runs both in one pass. Unknown names abort the whole run — a typo must never
+        // shrink the requested check set silently.
+        const unknown = args.filter(arg => !COMMAND_TO_CHECK[arg]);
+        if (unknown.length > 0) {
+            utils_1.logger.error(`[cli]: Unknown command(s) "${unknown.join('", "')}". Available: ${STANDALONE_COMMANDS.join(', ')}, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
             process.exit(1);
         }
-        const report = await (0, core_1.runChecks)({ only: [checkName], reporter: 'stdout', write: true });
+        const checkNames = [...new Set(args.map(arg => COMMAND_TO_CHECK[arg]))];
+        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true });
         process.exit(report.ok ? 0 : 1);
     }
     catch (err) {

package/dist/config/constants.js

@@ -251,6 +251,7 @@ exports.KNOWN_CONFIG_KEYS = new Set([
     'migrationSafety',
     // dependencies
     'dependency',
+    'circularDeps',
     'outdatedDeps',
     'licenseCheck',
     'vulnScan',

package/dist/core/checks/dependencies/circular-deps.js

@@ -1,33 +1,151 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.circularDepsCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Cap for the analysis. dpdm builds the whole module graph, which on a large repo
+ * is the slowest part of a run — an uncapped analysis looks like a hung commit.
+ */
+const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Ceiling for the assembled argument list. Passing every tracked source file as a
+ * separate argument overflows the OS argument limit (`E2BIG`) on a large repo, and
+ * a spawn that never starts writes no report. Past the ceiling dpdm gets globs
+ * instead — it expands them itself, over the same source paths.
+ */
+const MAX_ARGV_CHARS = 100000;
+/** Extensions dpdm resolves for us; also the globs used in the fallback. */
+const SOURCE_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx'];
+/**
+ * Resolve dpdm, preferring the consumer project's own copy (so a repo pinned to a
+ * different major keeps its own behaviour) and falling back to the copy bundled
+ * with pr-checkmate — the order `lint` and `typecheck` use for eslint/tsc.
+ *
+ * Returns null instead of throwing: an unresolvable analyzer is a skip, never a
+ * failed PR. This check used to shell out to `npx dpdm`, which silently fetched
+ * dpdm from the registry on first use — and when that fetch could not happen
+ * (offline or locked-down CI, private registry, exit 127) nothing was analyzed.
+ */
+function resolveDpdm(cwd) {
+    for (const options of [{ paths: [cwd] }, undefined]) {
+        try {
+            return (0, utils_1.resolvePackageBin)('dpdm', 'lib/bin/dpdm.js', options);
+        }
+        catch {
+            // Try the next location; both failing is a skip, handled by the caller.
+        }
+    }
+    return null;
+}
+/**
+ * Build the file arguments for dpdm, falling back to globs when the explicit list
+ * would overflow the OS argument limit. `sourcePaths` scopes the globs the same way
+ * `listTrackedFiles` scopes the explicit list.
+ */
+function toFileArgs(files, sourcePaths) {
+    const explicitLength = files.reduce((sum, file) => sum + file.length + 1, 0);
+    if (explicitLength <= MAX_ARGV_CHARS)
+        return files;
+    const roots = sourcePaths.length > 0 ? sourcePaths : ['.'];
+    const globs = roots.flatMap(root => SOURCE_GLOBS.map(ext => `${root.replace(/\/+$/, '')}/**/${ext}`));
+    utils_1.logger.info(`[Circular Deps]: ${files.length} files exceed the argument limit — analyzing via globs (${globs.join(', ')})`);
+    return globs;
+}
+/** Read dpdm's report file; null when it is absent or unparseable. */
+function readReport(reportPath) {
+    try {
+        return JSON.parse(node_fs_1.default.readFileSync(reportPath, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
 exports.circularDepsCheck = {
     name: 'Circular Deps',
     phase: 'blocking',
     applies(ctx) {
+        if (ctx.config.circularDeps?.enabled === false)
+            return false;
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
+        const allFiles = await (0, targets_1.listTrackedFiles)(ctx, SOURCE_GLOBS, (0, config_1.getSourcePaths)());
+        if (allFiles.length === 0)
             return (0, types_1.pass)();
-        const result = await (0, execa_1.execa)('npx', ['dpdm', '--no-warning', '--no-tree', '--circular', ...files], {
-            cwd: ctx.cwd,
-            reject: false,
-        });
-        const output = (result.stdout + result.stderr).trim();
-        // dpdm's success message also contains "circular" — match only its error shapes:
-        // the "Circular Dependencies:" header or a numbered entry "[1] src/a.ts -> src/b.ts".
-        const hasCircular = /circular dependencies:/i.test(output) || /^\s*\[\d+\]/m.test(output);
-        if (hasCircular) {
-            utils_1.logger.error(`[Circular Deps]: ❌ circular dependencies detected:\n${output}`);
-            return (0, types_1.fail)('circular dependencies found');
+        // Files the client exempted (generated code, vendored bundles) are dropped
+        // before analysis — and again from the cycles below, since the graph can reach
+        // an ignored file by following imports from one that is analyzed.
+        const ignore = ctx.config.circularDeps?.ignore ?? [];
+        const files = ignore.length > 0 ? allFiles.filter(f => !(0, utils_1.matchesAnyGlob)(f, ignore)) : allFiles;
+        if (files.length === 0)
+            return (0, types_1.skip)('all files ignored');
+        const dpdmBin = resolveDpdm(ctx.cwd);
+        if (!dpdmBin) {
+            utils_1.logger.warn('[Circular Deps]: ⚠️ dpdm could not be resolved — skipping');
+            return (0, types_1.skip)('dpdm unavailable');
+        }
+        const timeout = ctx.config.circularDeps?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const reportPath = node_path_1.default.join(ctx.cwd, '.dpdm.temp.json');
+        try {
+            // Read the cycles from dpdm's JSON report rather than its console output.
+            // The console shapes this check used to grep for ("Circular Dependencies:",
+            // "[1] a -> b") are not what dpdm 4 prints ("• Circular Dependencies",
+            // "1) a -> b"), so no cycle ever matched and the check passed every repo,
+            // including one built solely out of a cycle. `--exit-code circular:1` gives
+            // the same answer independently: dpdm otherwise exits 0 even when it finds
+            // cycles, so the exit code alone cannot tell a clean repo from a broken run.
+            const result = await (0, execa_1.execa)(process.execPath, [
+                dpdmBin,
+                '--no-warning',
+                '--no-tree',
+                '--no-circular',
+                '--exit-code',
+                'circular:1',
+                '-o',
+                reportPath,
+                ...toFileArgs(files, (0, config_1.getSourcePaths)()),
+            ], { cwd: ctx.cwd, reject: false, timeout });
+            if (result.timedOut) {
+                utils_1.logger.warn(`[Circular Deps]: ⚠️ dpdm timed out after ${timeout}ms — skipping`);
+                return (0, types_1.skip)('dpdm timed out');
+            }
+            const report = readReport(reportPath);
+            // No report means dpdm never got far enough to write one (a tsconfig it
+            // cannot read, a file it cannot parse, a killed process). Skip: reporting
+            // that as "no cycles" hides a check that did not run, and failing on it
+            // blocks a PR that may have no cycle at all.
+            if (!report) {
+                const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+                utils_1.logger.warn(`[Circular Deps]: ⚠️ dpdm wrote no report (exit ${result.exitCode ?? 'killed'})${output ? `:\n${output}` : ''}`);
+                return (0, types_1.skip)(`dpdm failed to run (exit ${result.exitCode ?? 'killed'})`);
+            }
+            const cycles = (report.circulars ?? []).filter(cycle => ignore.length === 0 || !cycle.some(file => (0, utils_1.matchesAnyGlob)(file, ignore)));
+            if (cycles.length === 0)
+                return (0, types_1.pass)();
+            // Advisory by default. This check reported nothing for its whole existence
+            // (see the note above), so switching it on turns every long-standing cycle
+            // in every client repo into a finding at once — barrel files alone account
+            // for most of them. Warning first lets a repo see its cycles before they
+            // gate anything; promote with `circularDeps.severity: "error"`.
+            const sev = (0, findings_1.severityEmitter)(ctx.config.circularDeps?.severity, 'warn');
+            sev.log(`[Circular Deps]: ${sev.icon} ${cycles.length} circular dependency(ies):`);
+            cycles.slice(0, 10).forEach((cycle, i) => sev.log(`  ${i + 1}) ${cycle.join(' -> ')}`));
+            if (cycles.length > 10)
+                sev.log(`  ... and ${cycles.length - 10} more`);
+            return sev.emit(`${cycles.length} circular dependency(ies) found`);
+        }
+        finally {
+            (0, utils_1.cleanupTempFile)(reportPath);
         }
-        return (0, types_1.pass)();
     },
 };

package/dist/core/checks/dependencies/dependency-check.d.ts

@@ -1,2 +1,43 @@
 import { Check } from '../../types';
+/** One entry of knip's JSON reporter — a file plus the issues found for it. */
+interface KnipIssue {
+    file: string;
+    dependencies?: {
+        name: string;
+    }[];
+    unlisted?: {
+        name: string;
+    }[];
+}
+interface KnipReport {
+    issues?: KnipIssue[];
+}
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+export declare function toKnipIgnorePattern(entry: string): string;
+/**
+ * Pull knip's report out of a stdout stream that may carry unrelated output.
+ *
+ * knip imports the project's own config files while analyzing (a `wdio.conf.ts`
+ * for its WebdriverIO plugin, say), so any top-level side effect in them —
+ * a dotenv banner, a `console.log` in a config module — is printed before the
+ * report. Slicing from the first `{` to the last `}` therefore captured that
+ * noise instead: a dotenvx tip ending in `{ path: '…/.env' }` made the whole
+ * check fail on a repo whose report was perfectly valid.
+ *
+ * The json reporter writes the report as a single line (`JSON.stringify` with no
+ * indentation), so the last line that parses AND carries `issues` is the report.
+ * Anything else on stdout is noise, whatever braces it happens to contain.
+ */
+export declare function parseKnipReport(stdout: string): KnipReport | null;
 export declare const dependencyCheck: Check;
+export {};

package/dist/core/checks/dependencies/dependency-check.js

@@ -4,11 +4,101 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dependencyCheck = void 0;
+exports.toKnipIgnorePattern = toKnipIgnorePattern;
+exports.parseKnipReport = parseKnipReport;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
+/**
+ * Config files knip discovers on its own. When a client ships one, it is the source
+ * of truth and pr-checkmate passes no config of its own — the same rule spellcheck
+ * follows for cspell.json.
+ *
+ * Mirrors knip's own `KNIP_CONFIG_LOCATIONS` exactly. Listing a name knip does not
+ * read (`knip.config.mjs`, say) would be worse than useless: the repo would count as
+ * "configures knip itself", so `dependency.ignore` would be dropped, while knip
+ * ignored that file too — leaving the client with warnings they had silenced.
+ */
+const KNIP_CONFIG_FILES = [
+    'knip.json',
+    'knip.jsonc',
+    '.knip.json',
+    '.knip.jsonc',
+    'knip.ts',
+    'knip.js',
+    'knip.config.ts',
+    'knip.config.js',
+];
+/** Regex metacharacters to neutralise before a glob is compiled. */
+const REGEX_SPECIALS = /[.*+?^${}()|[\]\\]/g;
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+function toKnipIgnorePattern(entry) {
+    const escaped = entry.replace(REGEX_SPECIALS, '\\$&');
+    return `^${escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.')}$`;
+}
+/** knip also reads a `knip` key from package.json. */
+function hasPackageJsonConfig(cwd) {
+    try {
+        return 'knip' in JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Pull knip's report out of a stdout stream that may carry unrelated output.
+ *
+ * knip imports the project's own config files while analyzing (a `wdio.conf.ts`
+ * for its WebdriverIO plugin, say), so any top-level side effect in them —
+ * a dotenv banner, a `console.log` in a config module — is printed before the
+ * report. Slicing from the first `{` to the last `}` therefore captured that
+ * noise instead: a dotenvx tip ending in `{ path: '…/.env' }` made the whole
+ * check fail on a repo whose report was perfectly valid.
+ *
+ * The json reporter writes the report as a single line (`JSON.stringify` with no
+ * indentation), so the last line that parses AND carries `issues` is the report.
+ * Anything else on stdout is noise, whatever braces it happens to contain.
+ */
+function parseKnipReport(stdout) {
+    const lines = stdout.split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        if (!line.startsWith('{'))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (Array.isArray(parsed.issues))
+                return parsed;
+        }
+        catch {
+            // A noise line that merely looks like JSON — keep scanning upwards.
+        }
+    }
+    return null;
+}
+/** Collect the names reported for one issue type across every file in the report. */
+function collectNames(issues, key) {
+    return [...new Set(issues.flatMap(issue => (issue[key] ?? []).map(entry => entry.name)))];
+}
+/** Files a given unlisted dependency is imported from, for the failure message. */
+function filesUsing(issues, name) {
+    return issues
+        .filter(issue => (issue.unlisted ?? []).some(entry => entry.name === name))
+        .map(issue => issue.file);
+}
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',
@@ -18,51 +108,74 @@ exports.dependencyCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
-        // Resolve the bundled depcheck binary and run it via the current node — never
-        // shell out to `npx`, which fails (exit 127) when depcheck isn't on the path.
-        let depcheckBin;
+        // Resolve the bundled knip binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when knip isn't on the path.
+        let knipBin;
         try {
-            depcheckBin = (0, utils_1.resolvePackageBin)('depcheck', 'bin/depcheck.js');
+            knipBin = (0, utils_1.resolvePackageBin)('knip', 'bin/knip.js');
         }
         catch {
-            return (0, types_1.skip)('depcheck unavailable');
+            return (0, types_1.skip)('knip unavailable');
         }
-        // Dependency names/globs to skip, configured in pr-checkmate.json. Passed via
-        // --ignores so a single pr-checkmate.json is the source of truth; depcheck's
-        // CLI --ignores overrides any .depcheckrc, so we only pass it when non-empty
-        // (letting a client's own .depcheckrc still apply when nothing is configured).
+        // Dependency names to skip, configured in pr-checkmate.json. knip takes these
+        // from a config file only, so they go into a temp one — but a client's own knip
+        // config wins outright, exactly as it does for cspell.
         const ignore = ctx.config.dependency?.ignore ?? [];
-        const args = [depcheckBin, '--json'];
-        if (ignore.length > 0)
-            args.push(`--ignores=${ignore.join(',')}`);
-        // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-        const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
-            cwd: ctx.cwd,
-            reject: false,
-        });
-        const start = stdout.indexOf('{');
-        const end = stdout.lastIndexOf('}');
-        // No JSON at all → the tool couldn't produce a result; skip rather than fail the client's PR.
-        if (start === -1 || end === -1)
-            return (0, types_1.skip)('depcheck produced no output');
-        const json = stdout.slice(start, end + 1);
-        let result;
-        try {
-            result = JSON.parse(json);
+        const clientOwnsConfig = (0, config_1.hasLocalConfig)(KNIP_CONFIG_FILES) || hasPackageJsonConfig(ctx.cwd);
+        let tempConfigPath = null;
+        if (ignore.length > 0 && clientOwnsConfig) {
+            // Say so out loud: a silently ignored `ignore` list looks like a broken check.
+            utils_1.logger.info(`[Dependencies]: ℹ️ this repo has its own knip config, so dependency.ignore (${ignore.join(', ')}) is not applied — add those names to knip's ignoreDependencies instead.`);
         }
-        catch {
-            return (0, types_1.fail)('depcheck produced invalid JSON');
+        if (ignore.length > 0 && !clientOwnsConfig) {
+            tempConfigPath = node_path_1.default.join(ctx.cwd, '.knip.temp.json');
+            node_fs_1.default.writeFileSync(tempConfigPath, JSON.stringify({ ignoreDependencies: ignore.map(toKnipIgnorePattern) }, null, 2));
         }
-        const unused = result.dependencies ?? [];
-        const missing = Object.keys(result.missing ?? {});
-        if (missing.length > 0) {
-            missing.forEach(dep => utils_1.logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${result.missing[dep]?.join(', ')})`));
-            return (0, types_1.fail)(`missing: ${missing.join(', ')}`);
+        // Only unused prod dependencies and imports missing from package.json are
+        // reported. knip's other issue types (unused devDependencies, binaries,
+        // unresolved paths) are noise here: CLI tools and shell commands legitimately
+        // have no import to find.
+        const args = [
+            knipBin,
+            '--reporter',
+            'json',
+            '--include',
+            'dependencies,unlisted',
+            '--no-config-hints',
+            '--no-exit-code',
+            '--no-progress',
+        ];
+        if (tempConfigPath)
+            args.push('--config', tempConfigPath);
+        try {
+            // reject:false — knip can still exit non-zero (e.g. config hints) while
+            // writing a perfectly good report to stdout.
+            const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
+                cwd: ctx.cwd,
+                reject: false,
+            });
+            const result = parseKnipReport(stdout);
+            // No report on stdout → the tool couldn't produce a result; skip rather than
+            // fail the client's PR. Never fail here: a check that blocks a PR because a
+            // tool misbehaved reports our problem as the client's.
+            if (!result)
+                return (0, types_1.skip)('knip produced no report');
+            const issues = result.issues ?? [];
+            const unused = collectNames(issues, 'dependencies');
+            const missing = collectNames(issues, 'unlisted');
+            if (missing.length > 0) {
+                missing.forEach(dep => utils_1.logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${filesUsing(issues, dep).join(', ')})`));
+                return (0, types_1.fail)(`missing: ${missing.join(', ')}`);
+            }
+            if (unused.length > 0) {
+                unused.forEach(dep => utils_1.logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
+                return (0, types_1.warn)(`${unused.length} unused dependency(ies)`);
+            }
+            return (0, types_1.pass)();
         }
-        if (unused.length > 0) {
-            unused.forEach(dep => utils_1.logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
-            return (0, types_1.warn)(`${unused.length} unused dependency(ies)`);
+        finally {
+            if (tempConfigPath)
+                (0, utils_1.cleanupTempFile)(tempConfigPath);
         }
-        return (0, types_1.pass)();
     },
 };

package/dist/core/checks/dependencies/grype-scan.d.ts

@@ -13,5 +13,10 @@ import { Check } from '../../types';
  * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
  * ecosystem has no manifest we can parse are suppressed too, and the count of
  * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
  */
 export declare const grypeScanCheck: Check;

package/dist/core/checks/dependencies/grype-scan.js

@@ -14,6 +14,11 @@ const TYPE_TO_ECOSYSTEM = {
     gem: 'ruby',
     'php-composer': 'php',
 };
+/**
+ * Cap for the scan. grype has no internal limit, so without this a slow scan just
+ * looks like a hung commit — an advisory check must never be able to do that.
+ */
+const DEFAULT_TIMEOUT_MS = 120000;
 function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
@@ -31,6 +36,11 @@ function severityRank(severity) {
  * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
  * ecosystem has no manifest we can parse are suppressed too, and the count of
  * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
  */
 exports.grypeScanCheck = {
     name: 'Grype Scan',
@@ -42,14 +52,27 @@ exports.grypeScanCheck = {
         const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
         const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
-        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q'], {
+        // Never walk `ignoreDirs` — the same contract every other check honours, and
+        // here it is the difference between a usable check and an unusable one. A bare
+        // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
+        // 355s versus 0.8s with the directory excluded, for byte-for-byte the same
+        // findings: grype resolves package versions from the lockfile, and installed
+        // third-party code is not something the client could fix anyway (see below).
+        const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
+        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
+            timeout,
         });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
             return (0, types_1.skip)('grype not installed');
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Grype Scan]: ⚠️ grype timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('grype timed out');
+        }
         let report;
         try {
             report = JSON.parse(result.stdout);

package/dist/core/checks/dependencies/npm-audit.js

@@ -41,7 +41,28 @@ exports.npmAuditCheck = {
         const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
         const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
-        const report = JSON.parse(stdout);
+        // `npm audit` reports registry/lockfile problems as JSON on stdout, but not
+        // always: an absent npm (execa resolves with `code: 'ENOENT'`), a killed
+        // process or a proxy that answers with HTML all leave stdout unparseable.
+        // Parsing it bare made those cases throw, and a throw in a blocking check is
+        // a failed PR — the client saw "NPM Audit threw: Unexpected end of JSON
+        // input" and a red gate for an environment problem they did not cause.
+        let report;
+        try {
+            report = JSON.parse(stdout);
+        }
+        catch {
+            utils_1.logger.warn('[NPM Audit]: ⚠️ npm audit produced no parseable report — skipping');
+            return (0, types_1.skip)('npm audit produced no parseable report');
+        }
+        // A repo with no lockfile, or a registry npm cannot reach, yields
+        // `{"error":{"code":"ENOLOCK",…}}` — no `vulnerabilities` key at all. Passing
+        // on that reads as "no vulnerabilities" when nothing was actually audited.
+        if (report.error) {
+            const detail = report.error.summary ?? report.error.code ?? 'unknown error';
+            utils_1.logger.warn(`[NPM Audit]: ⚠️ npm could not audit this project — ${detail}`);
+            return (0, types_1.skip)(`npm audit unavailable: ${report.error.code ?? 'error'}`);
+        }
         const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
         const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
             (ignore.has(v.name.toLowerCase()) ? skip : block).push(v);

package/dist/core/checks/dependencies/vuln-scan.d.ts

@@ -1,9 +1,2 @@
 import { Check } from '../../types';
-/**
- * Cross-language dependency vulnerability scan via osv-scanner, which reads
- * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
- * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
- * must be on the runner, and the check skips gracefully when it is absent.
- * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
- */
 export declare const vulnScanCheck: Check;

package/dist/core/checks/dependencies/vuln-scan.js

@@ -10,7 +10,12 @@ const types_1 = require("../../types");
  * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
  * must be on the runner, and the check skips gracefully when it is absent.
  * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ *
+ * `-r .` walks the tree, so the run is capped: an advisory check must never be able
+ * to look like a hung commit, which is exactly what an uncapped directory scan does
+ * on a repo with dependencies installed.
  */
+const DEFAULT_TIMEOUT_MS = 120000;
 exports.vulnScanCheck = {
     name: 'Vuln Scan',
     phase: 'informational',
@@ -18,11 +23,20 @@ exports.vulnScanCheck = {
         return ctx.config.vulnScan?.enabled === true;
     },
     async run(ctx) {
-        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], { cwd: ctx.cwd, reject: false });
+        const timeout = ctx.config.vulnScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], {
+            cwd: ctx.cwd,
+            reject: false,
+            timeout,
+        });
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
             return (0, types_1.skip)('osv-scanner not installed');
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Vuln Scan]: ⚠️ osv-scanner timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('osv-scanner timed out');
+        }
         if (result.exitCode === 0) {
             utils_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
             return (0, types_1.pass)();

package/dist/core/checks/languages/lint.js

@@ -74,6 +74,15 @@ exports.lintCheck = {
             stdio: 'inherit',
             reject: false,
         });
-        return result.exitCode === 0 ? (0, types_1.pass)() : (0, types_1.fail)('lint errors found');
+        if (result.exitCode === 0)
+            return (0, types_1.pass)();
+        // ESLint exits 1 for lint errors and 2 for a fatal error — a config it cannot
+        // load, an unresolvable plugin, a parser it cannot construct. Only the
+        // former is the client's code. Treating exit 2 as "lint errors found" turned
+        // a config incompatibility (often between our bundled config and the client's
+        // toolchain) into a red gate on their PR, and named the wrong cause.
+        if (result.exitCode === 1)
+            return (0, types_1.fail)('lint errors found');
+        return (0, types_1.warn)(`eslint failed to run (exit ${result.exitCode ?? 'killed'})${hasLocal ? '' : ' — using the pr-checkmate config'}`);
     },
 };

package/dist/core/checks/languages/typecheck.js

@@ -52,6 +52,13 @@ exports.typecheckCheck = {
         const errorCount = (output.match(/error TS\d+/g) ?? []).length;
         if (output)
             utils_1.logger.warn(output);
+        // A non-zero exit with no diagnostic in it is not a type error — tsc was
+        // killed (OOM on a large project), crashed, or never started. Reporting that
+        // as `0 type error(s)` blocked PRs with a message naming nothing to fix.
+        if (errorCount === 0) {
+            utils_1.logger.warn(`[TypeScript]: ⚠️ tsc exited ${result.exitCode ?? 'abnormally'} without reporting a type error — treating as a tooling failure, not a type error`);
+            return (0, types_1.warn)(`tsc failed to run (exit ${result.exitCode ?? 'killed'})`);
+        }
         return (0, types_1.fail)(`${errorCount} type error(s)`);
     },
 };

package/dist/core/checks/quality/markdown-lint.js

@@ -91,7 +91,16 @@ exports.markdownLintCheck = {
                 reject: false,
                 stdio: 'inherit',
             });
-            return result.exitCode === 0 ? (0, types_1.pass)() : (0, types_1.warn)('markdown lint issues found');
+            if (result.exitCode === 0)
+                return (0, types_1.pass)();
+            // markdownlint-cli2 exits 1 for lint findings and 2 when it could not run
+            // (an unreadable config, a bad glob). Reporting the latter as "markdown lint
+            // issues found" names the wrong cause — and under `severity: error` it
+            // becomes a gate on a tooling problem.
+            if (result.exitCode === 2) {
+                return (0, types_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
+            }
+            return (0, types_1.warn)('markdown lint issues found');
         }
         finally {
             if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile))

package/dist/core/checks/security/security.js

@@ -17,7 +17,18 @@ exports.securityCheck = {
         return ctx.config.security?.gitleaks?.enabled !== false;
     },
     async run(ctx) {
-        const gitleaksBin = (0, utils_1.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'bin/cli.js');
+        // A binary that cannot be resolved throws, and a throw in a blocking check is
+        // a failed PR — the client would see "Security Scan threw: Cannot resolve
+        // binary" as a red gate on a repo with no secrets in it. Every other bundled
+        // tool (knip, license-checker) already skips here; this one did not.
+        let gitleaksBin;
+        try {
+            gitleaksBin = (0, utils_1.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'bin/cli.js');
+        }
+        catch {
+            utils_1.logger.warn('[Security Scan]: ⚠️ bundled gitleaks scanner could not be resolved — skipping');
+            return (0, types_1.skip)('gitleaks unavailable');
+        }
         const hasClientConfig = (0, config_1.hasLocalConfig)([
             '.gitleaks.toml',
             'gitleaks.toml',

package/dist/init.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Merge current defaults into an existing config, recursively.
+ *
+ * The user's value always wins, so hand-tuned settings survive an `init` re-run,
+ * while every new default field — at any nesting depth — gets added. Arrays are
+ * replaced wholesale rather than concatenated: lists like `ignoreDirs` or
+ * `cspell.words` are meant to be edited, and merging them would resurrect entries
+ * the user deliberately removed. {@link REPLACED_OBJECT_PATHS} extends that rule to
+ * the object-shaped lists.
+ *
+ * Informational `//`-prefixed keys are the one exception — they are documentation,
+ * not settings, so the refreshed default text wins whenever a default exists.
+ *
+ * @param defaults Current defaults for this level of the config tree.
+ * @param user The existing pr-checkmate.json content for the same level.
+ * @param path Dot-joined position of `defaults` in the config tree, used to match
+ * {@link REPLACED_OBJECT_PATHS}. Internal to the recursion; callers pass nothing.
+ */
+export declare function mergeWithDefaults(defaults: Record<string, unknown>, user: Record<string, unknown>, path?: string): Record<string, unknown>;
 /**
  * Initialize (or refresh) pr-checkmate configuration in the current project.
  */

package/dist/init.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeWithDefaults = mergeWithDefaults;
 exports.init = init;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -101,13 +102,26 @@ const DEFAULT_CONFIG = {
         // are intentionally absent — add them here to detect duplication in them too.
         formats: config_1.DUPLICATE_CODE_FORMATS,
     },
-    // Dependency usage check (depcheck)
+    // Dependency usage check (knip)
     dependency: {
         enabled: true,
-        // Dependency names/globs to skip (e.g. CLI-only tools invoked as binaries,
-        // which depcheck can't see as imports and would report as unused).
+        // Dependency names to skip (e.g. CLI-only tools invoked as binaries,
+        // which knip can't see as imports and would report as unused).
         ignore: [],
     },
+    // Circular-import check (dpdm, bundled — nothing needed on the runner). Uses
+    // the project's own dpdm when it has one. Advisory by default (severity
+    // "warn"): most repos have long-standing cycles through barrel files, so see
+    // yours first, then set severity "error" to gate merges on them. enabled false
+    // disables the check; `ignore` takes glob patterns kept out of the analysis
+    // (generated or vendored code, or barrels whose cycles you tolerate). When the
+    // analyzer cannot run, the check skips rather than passing or failing.
+    circularDeps: {
+        enabled: true,
+        severity: 'warn',
+        ignore: [],
+        timeoutMs: 120000,
+    },
     // Unused-exports check (ts-unused-exports)
     deadCode: {
         enabled: true,
@@ -144,7 +158,9 @@ const DEFAULT_CONFIG = {
     dockerfileSecurity: { enabled: true }, // Dockerfile: :latest, USER root, curl|bash, …
     caseCollision: { enabled: true }, // files differing only by case
     vulnScan: { enabled: false }, // cross-language dep vulns (osv-scanner, runner-dependency)
-    grypeScan: { enabled: true, minSeverity: 'medium' }, // dep vulns (grype, non-blocking, runner-dependency; skips if grype absent)
+    // dep vulns (grype, non-blocking, runner-dependency; skips if grype absent).
+    // Never walks `ignoreDirs`; `timeoutMs` caps the scan so it cannot stall a commit.
+    grypeScan: { enabled: true, minSeverity: 'medium', timeoutMs: 120000 },
     // Test-coverage presence. Opt-in: enable once your CI produces a coverage
     // report (lcov/cobertura/jacoco/…); warns if none is found.
     coverage: { enabled: false },
@@ -270,6 +286,52 @@ async function createConfig(root) {
     setupWorkflow(root);
     setupTsConfig(root, sourcePath);
 }
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Config paths whose object value is a curated list, not a set of settings — the
+ * user is meant to add and remove entries, exactly like an array.
+ *
+ * These are merged the way arrays are: the user's object replaces the default one
+ * wholesale. Deep-merging them would hand back every rule the user deleted, and for
+ * `eslint.rules` that is not cosmetic — Lint is a blocking check, so a re-run of
+ * `init` would silently reinstate rules and start failing the next PR on them. The
+ * documented way to switch a rule off is `"off"`, which survives either way.
+ */
+const REPLACED_OBJECT_PATHS = new Set(['eslint.rules', 'prettier.rules', 'markdownlint.rules']);
+/**
+ * Merge current defaults into an existing config, recursively.
+ *
+ * The user's value always wins, so hand-tuned settings survive an `init` re-run,
+ * while every new default field — at any nesting depth — gets added. Arrays are
+ * replaced wholesale rather than concatenated: lists like `ignoreDirs` or
+ * `cspell.words` are meant to be edited, and merging them would resurrect entries
+ * the user deliberately removed. {@link REPLACED_OBJECT_PATHS} extends that rule to
+ * the object-shaped lists.
+ *
+ * Informational `//`-prefixed keys are the one exception — they are documentation,
+ * not settings, so the refreshed default text wins whenever a default exists.
+ *
+ * @param defaults Current defaults for this level of the config tree.
+ * @param user The existing pr-checkmate.json content for the same level.
+ * @param path Dot-joined position of `defaults` in the config tree, used to match
+ * {@link REPLACED_OBJECT_PATHS}. Internal to the recursion; callers pass nothing.
+ */
+function mergeWithDefaults(defaults, user, path = '') {
+    const merged = { ...defaults };
+    for (const [key, userValue] of Object.entries(user)) {
+        const defaultValue = defaults[key];
+        const keyPath = path ? `${path}.${key}` : key;
+        if (key.startsWith('//') && defaultValue !== undefined)
+            continue;
+        merged[key] =
+            isPlainObject(defaultValue) && isPlainObject(userValue) && !REPLACED_OBJECT_PATHS.has(keyPath)
+                ? mergeWithDefaults(defaultValue, userValue, keyPath)
+                : userValue;
+    }
+    return merged;
+}
 /** Re-run setup: merge the existing config with current defaults. */
 async function updateConfig(root) {
     utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
@@ -278,19 +340,13 @@ async function updateConfig(root) {
         const json = JSON.parse(raw);
         const languages = await (0, utils_1.detectLanguages)(root);
         utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
-        // Merge with defaults to add new fields
+        // Merge with defaults to add new fields at every depth — a hand-maintained
+        // list of sections to merge would silently stop delivering new defaults to
+        // existing configs the moment a section is forgotten.
         const updated = {
-            ...DEFAULT_CONFIG,
-            ...json,
+            ...mergeWithDefaults(DEFAULT_CONFIG, json),
             // Refresh detected languages on every init so new source dirs are picked up
             languages,
-            eslint: { ...DEFAULT_CONFIG.eslint, ...(json.eslint || {}) },
-            prettier: { ...DEFAULT_CONFIG.prettier, ...(json.prettier || {}) },
-            cspell: { ...DEFAULT_CONFIG.cspell, ...(json.cspell || {}) },
-            typecheck: { ...DEFAULT_CONFIG.typecheck, ...(json.typecheck || {}) },
-            diffSmell: { ...DEFAULT_CONFIG.diffSmell, ...(json.diffSmell || {}) },
-            prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
-            duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
         };
         fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2));
         utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');

package/dist/interfaces/index.d.ts

@@ -145,11 +145,13 @@ export interface PRCheckMateConfig {
     dependency?: {
         enabled?: boolean;
         /**
-         * Dependency names to exclude from the unused/missing check (depcheck).
-         * Supports globs, e.g. "@types/*". Use for packages that are invoked only as
-         * CLI binaries or referenced from config — depcheck sees no `import` for them
-         * and would otherwise report them as unused. Passed to depcheck's `--ignores`,
-         * which takes precedence over any `.depcheckrc` file.
+         * Dependency names to exclude from the unused/missing check (knip).
+         * Supports globs matched against the whole name, e.g. "@types/*" — so
+         * "eslint-*" covers "eslint-plugin-x" but never "eslint" itself. Use for
+         * packages that are invoked only as CLI binaries or referenced from config —
+         * knip sees no `import` for them and would otherwise report them as unused.
+         * Compiled into a temporary knip config, so a repo that ships its own knip
+         * config keeps full control instead.
          */
         ignore?: string[];
     };
@@ -202,13 +204,27 @@ export interface PRCheckMateConfig {
         severity?: 'error' | 'warn';
         ignore?: string[];
     };
+    circularDeps?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        ignore?: string[];
+        timeoutMs?: number;
+    };
     vulnScan?: {
         enabled?: boolean;
+        timeoutMs?: number;
     };
     grypeScan?: {
         enabled?: boolean;
         minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
         ignore?: string[];
+        /**
+         * Max time (ms) for the grype scan before the check skips. Default 120000.
+         * `ignoreDirs` already keeps `node_modules`, `dist` and friends out of the walk,
+         * which is what makes the scan fast; this is the backstop so an advisory check
+         * can never stall a commit.
+         */
+        timeoutMs?: number;
     };
     bannedImports?: Array<{
         name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.17",
+    "version": "1.23.19",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -83,7 +83,7 @@
         "@typescript-eslint/parser": "^8.62.1",
         "@wasm-fmt/clang-format": "^22.1.8",
         "cspell": "^10.0.1",
-        "depcheck": "^1.4.7",
+        "dpdm": "^4.2.0",
         "eslint": "^10.6.0",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-import-x": "^4.17.1",
@@ -94,6 +94,7 @@
         "gitleaks-secret-scanner-fixed": "^2.1.3",
         "inquirer": "^14.0.2",
         "jscpd": "^5.0.11",
+        "knip": "^6.29.0",
         "license-checker-rseidelsohn": "^5.0.1",
         "markdownlint-cli2": "^0.23.1",
         "prettier": ">=3.0.0",
@@ -123,9 +124,6 @@
         "follow-redirects": "1.16.0",
         "lodash": "4.18.1",
         "minimatch": "10.2.5",
-        "depcheck": {
-            "minimatch": "^7.4.9"
-        },
         "postcss": "8.5.23",
         "handlebars": "4.7.9"
     }

package/pr-checkmate.schema.json

@@ -87,7 +87,7 @@
     },
     "vulnScan": {
       "type": "object",
-      "properties": { "enabled": { "type": "boolean" } }
+      "properties": { "enabled": { "type": "boolean" }, "timeoutMs": { "type": "number" } }
     },
     "grypeScan": {
       "type": "object",
@@ -97,7 +97,8 @@
           "type": "string",
           "enum": ["negligible", "low", "medium", "high", "critical"]
         },
-        "ignore": { "type": "array", "items": { "type": "string" } }
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
       }
     },
     "security": {
@@ -156,6 +157,15 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "circularDeps": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",

package/src/config/cspell.json

@@ -309,6 +309,7 @@
     "dont",
     "Dorg",
     "dotenv",
+    "dotenvx",
     "dotnet",
     "DPARALLEL",
     "dpdm",
@@ -343,6 +344,7 @@
     "endtable",
     "engineio",
     "ENOENT",
+    "ENOLOCK",
     "eoilist",
     "Escaneá",
     "Escaneás",

package/src/config/pr-checkmate.schema.json

@@ -87,7 +87,7 @@
     },
     "vulnScan": {
       "type": "object",
-      "properties": { "enabled": { "type": "boolean" } }
+      "properties": { "enabled": { "type": "boolean" }, "timeoutMs": { "type": "number" } }
     },
     "grypeScan": {
       "type": "object",
@@ -97,7 +97,8 @@
           "type": "string",
           "enum": ["negligible", "low", "medium", "high", "critical"]
         },
-        "ignore": { "type": "array", "items": { "type": "string" } }
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
       }
     },
     "security": {
@@ -156,6 +157,15 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "circularDeps": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",