pr-checkmate 1.23.3 → 1.23.5

package/README.md

@@ -117,7 +117,7 @@ skipped, not failed.
   presence, DB migration safety, and sensitive-file guard.
 - Dependencies (7) — unused/missing, circular, outdated, license compliance, npm audit,
   a cross-language vuln scan (osv-scanner, opt-in), and a direct-dependency vuln scan
-  (grype, opt-in).
+  (grype, on by default).
 - Quality (4) — duplicate code, dead code, multi-language spellcheck, markdown lint.
 - PR hygiene (4) — size, title, body, and commit-message convention.
 - Per-language (16) — lint, format, and type-check for the languages listed above.

package/cspell.json

@@ -19,10 +19,13 @@
     "ACMRD",
     "acodec",
     "acompressor",
+    "Activá",
     "adminsdk",
     "adrs",
     "aesctr",
     "aesgcm",
+    "afip",
+    "Afip",
     "AFIP",
     "afplay",
     "Agregar",
@@ -35,13 +38,13 @@
     "alimiter",
     "allclose",
     "Amuta",
+    "análisis",
     "Anchore",
     "androidpublisher",
     "androidx",
     "annualised",
     "Anthropic",
     "anypassword",
-    "análisis",
     "apikey",
     "apinick",
     "apkg",
@@ -87,6 +90,7 @@
     "autoupdating",
     "avdmanager",
     "avds",
+    "Avital",
     "awscli",
     "awscliv",
     "awsconfiguration",
@@ -104,6 +108,9 @@
     "baseweb",
     "bbox",
     "bboxes",
+    "bcra",
+    "Bcra",
+    "BCRA",
     "Bdikat",
     "BEAGENT",
     "beforeinstallprompt",
@@ -155,6 +162,8 @@
     "buildx",
     "bybit",
     "bytebuffer",
+    "CABA",
+    "caea",
     "caesarea",
     "Caesarea",
     "calib",
@@ -205,6 +214,7 @@
     "colwise",
     "commitlintrc",
     "como",
+    "compartilos",
     "completesession",
     "completetest",
     "comprobante",
@@ -215,8 +225,11 @@
     "Configurar",
     "confirmemail",
     "confirmpassword",
+    "Considerá",
     "constraintlayout",
+    "Consultá",
     "Contable",
+    "Contactá",
     "containerregistry",
     "contenteditable",
     "Cooldown",
@@ -231,6 +244,7 @@
     "createsession",
     "createtest",
     "creationflags",
+    "Credito",
     "creds",
     "criterios",
     "crossfade",
@@ -256,8 +270,11 @@
     "DCMAKE",
     "ddepth",
     "ddim",
+    "Ddjj",
+    "DDJJ",
     "ddlkidomet",
     "ddpm",
+    "Debito",
     "decomp",
     "dedup",
     "dedups",
@@ -272,6 +289,7 @@
     "Denona",
     "depcheckrc",
     "depthwise",
+    "DESCS",
     "detalladas",
     "devuser",
     "DFETCHCONTENT",
@@ -323,6 +341,8 @@
     "endtable",
     "engineio",
     "eoilist",
+    "Escaneá",
+    "Escaneás",
     "Esek",
     "esencial",
     "eslint",
@@ -336,6 +356,7 @@
     "executemany",
     "Exento",
     "EXIF",
+    "exportá",
     "extralean",
     "eyecon",
     "eyetracking",
@@ -347,6 +368,8 @@
     "FARMHASH",
     "faststart",
     "fcpxml",
+    "FECAE",
+    "FECAEA",
     "Fecha",
     "Fechas",
     "FETCHCONTENT",
@@ -363,6 +386,7 @@
     "firebaseapp",
     "firestore",
     "Firestore",
+    "fiscalization",
     "fitz",
     "fixedname",
     "flatbuffer",
@@ -387,9 +411,9 @@
     "fromarray",
     "frombuffer",
     "Fsub",
+    "función",
     "funciona",
     "funcionalidad",
-    "función",
     "FUTX",
     "gapi",
     "gastos",
@@ -402,6 +426,7 @@
     "gemmlowp",
     "GEMMLOWP",
     "genai",
+    "Generá",
     "genkey",
     "germany",
     "gershayim",
@@ -480,8 +505,12 @@
     "Hyperedges",
     "hyperliquid",
     "idct",
+    "idempotently",
     "idft",
     "ietf",
+    "iibb",
+    "Iibb",
+    "IIBB",
     "imageset",
     "imencode",
     "imgcodecs",
@@ -496,6 +525,7 @@
     "initialised",
     "inputmethod",
     "Inscripto",
+    "inscriptos",
     "installroot",
     "instrucciones",
     "integrat",
@@ -524,6 +554,7 @@
     "Jsons",
     "jsqr",
     "Jsqr",
+    "july",
     "junitxml",
     "jvmargs",
     "kama",
@@ -564,11 +595,12 @@
     "kupat",
     "langgraph",
     "laplace",
+    "latam",
     "layernorm",
     "lbank",
+    "leído",
     "lelvni",
     "letterboxed",
-    "leído",
     "libavcodec",
     "libavformat",
     "libavutil",
@@ -612,9 +644,13 @@
     "Mazav",
     "mdpi",
     "Meaghan",
+    "Medor",
     "Megurim",
     "mekabel",
     "memswap",
+    "mercaderia",
+    "mercadolibre",
+    "mercadopago",
     "metadatalist",
     "Metaspace",
     "mexc",
@@ -630,6 +666,9 @@
     "mockito",
     "modelcontextprotocol",
     "monkeypatched",
+    "monotributista",
+    "monotributistas",
+    "monotributo",
     "Monotributo",
     "Monto",
     "moov",
@@ -652,6 +691,7 @@
     "myregistry",
     "myrepo",
     "mytoken",
+    "Nahman",
     "Naing",
     "Namayeshi",
     "nanargmax",
@@ -712,6 +752,8 @@
     "opencvcommit",
     "OPENNI",
     "openslr",
+    "orientative",
+    "ORIENTATIVE",
     "osascript",
     "Osek",
     "Osis",
@@ -745,13 +787,14 @@
     "Pipfile",
     "pipx",
     "playwright",
+    "podés",
     "podfile",
     "poland",
     "Polishchuk",
+    "Política",
     "poloniex",
     "polyfit",
     "polyorder",
-    "Política",
     "popleft",
     "positiving",
     "posix",
@@ -773,8 +816,8 @@
     "processlist",
     "progressbar",
     "protobuf",
-    "proyecto",
     "Próximos",
+    "proyecto",
     "psola",
     "pthreadpool",
     "pubspec",
@@ -785,6 +828,8 @@
     "pycodestyle",
     "pyflakes",
     "pyiceberg",
+    "pyme",
+    "Pyme",
     "pymediainfo",
     "pyngrok",
     "pynput",
@@ -805,6 +850,7 @@
     "qwen",
     "Ra'anana",
     "raanana",
+    "raíz",
     "ramat",
     "Ramat",
     "Ramesh",
@@ -812,14 +858,19 @@
     "randu",
     "Rango",
     "Rashum",
+    "Rasterizes",
     "Rastree",
     "rawvideo",
-    "raíz",
     "realtag",
     "rebal",
     "rebalance",
     "rebalancing",
     "recaptcha",
+    "recat",
+    "recategorización",
+    "recategorizarte",
+    "recategorization",
+    "Recategorization",
     "Recibo",
     "recibos",
     "Recibos",
@@ -830,7 +881,9 @@
     "reentrancy",
     "referer",
     "Regen",
+    "Registrá",
     "remoteconfig",
+    "Renovala",
     "reporthook",
     "Requerida",
     "resendcode",
@@ -935,6 +988,7 @@
     "suptitle",
     "supxlabel",
     "supylabel",
+    "Suscribite",
     "swiftformat",
     "swiftlint",
     "swiftpm",
@@ -951,7 +1005,9 @@
     "tcwf",
     "telaviv",
     "temurin",
+    "Tenés",
     "tensorflow",
+    "Términos",
     "testid",
     "testsuite",
     "testsuites",
@@ -977,18 +1033,21 @@
     "tocken",
     "todas",
     "tofes",
+    "toggleable",
+    "Toggleable",
     "torchcodec",
     "totp",
     "tpsl",
     "tradingview",
     "transacciones",
     "trapz",
-    "travis",
     "través",
+    "travis",
     "trunc",
     "tsconfig",
     "tsmc",
     "ttest",
+    "Tucumán",
     "Tukey",
     "tulipy",
     "Turakhia",
@@ -997,7 +1056,6 @@
     "typescript",
     "Tzionit",
     "tzviat",
-    "Términos",
     "ubgjg",
     "udid",
     "ufunc",
@@ -1005,6 +1063,7 @@
     "UiAutomator2",
     "UITM",
     "ukrainian",
+    "Último",
     "undistort",
     "unhedged",
     "unindexed",
@@ -1017,6 +1076,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "upsell",
     "usecase",
     "usefixtures",
     "userfound",
@@ -1028,9 +1088,11 @@
     "uuid",
     "uuids",
     "Validatable",
+    "válido",
     "VAQH",
     "vconcat",
     "vectorbt",
+    "vendés",
     "venv",
     "verticalalignment",
     "vfrzk",
@@ -1054,7 +1116,6 @@
     "vulns",
     "vwap",
     "vwma",
-    "válido",
     "watchlist",
     "wavesexchange",
     "waze",
@@ -1065,6 +1126,7 @@
     "WHQVLV",
     "workdir",
     "wrongpassword",
+    "WSAA",
     "xapp",
     "xcassets",
     "xcframework",
@@ -1094,8 +1156,9 @@
     "Zehut",
     "zorder",
     "zrufot",
-    "Último",
     "Δangle",
+    "Σcredit",
+    "Σdebit",
     "Авів",
     "Беер",
     "Беэр",
@@ -1109,6 +1172,7 @@
     "Гіватаїм",
     "Ельберт",
     "зв'язатися",
+    "Іріною",
     "Кфар",
     "люксовой",
     "мастхэв",
@@ -1124,8 +1188,8 @@
     "раннера",
     "раннере",
     "Ришон",
-    "Русский",
     "Рішон",
+    "Русский",
     "стике",
     "Тіква",
     "Українська",
@@ -1135,7 +1199,6 @@
     "Холон",
     "Цион",
     "Ціон",
-    "Іріною",
     "אידיאלי",
     "אירינה",
     "אקונה",

package/dist/config/loader.js

@@ -59,7 +59,12 @@ function mergeWithDefaults(userConfig) {
                 ...(userConfig.spellcheck?.ignorePaths || []),
             ],
         },
-        security: userConfig.security || defaults.security,
+        security: {
+            ...defaults.security,
+            ...userConfig.security,
+            gitleaks: { ...defaults.security?.gitleaks, ...userConfig.security?.gitleaks },
+            'npm-audit': { ...defaults.security?.['npm-audit'], ...userConfig.security?.['npm-audit'] },
+        },
         typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
         cpp: {
             ...defaults.cpp,

package/dist/core/checks/dependencies/grype-scan.d.ts

@@ -1,8 +1,9 @@
 import { Check } from '../../types';
 /**
- * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and opt-in
- * (`grypeScan.enabled: true`): grype must be on the runner, and the check skips
- * gracefully when it is absent.
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
+ * default — runs unless `grypeScan.enabled` is explicitly `false`. grype is a
+ * runner-dependency: it must be on the runner, and the check skips gracefully
+ * (not fails) when it is absent.
  *
  * grype resolves versions from lockfiles, so its raw output includes the entire
  * transitive tree — and, because pr-checkmate installs into the consumer's

package/dist/core/checks/dependencies/grype-scan.js

@@ -18,9 +18,10 @@ function severityRank(severity) {
     return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
 }
 /**
- * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and opt-in
- * (`grypeScan.enabled: true`): grype must be on the runner, and the check skips
- * gracefully when it is absent.
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
+ * default — runs unless `grypeScan.enabled` is explicitly `false`. grype is a
+ * runner-dependency: it must be on the runner, and the check skips gracefully
+ * (not fails) when it is absent.
  *
  * grype resolves versions from lockfiles, so its raw output includes the entire
  * transitive tree — and, because pr-checkmate installs into the consumer's
@@ -35,7 +36,7 @@ exports.grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
     applies(ctx) {
-        return ctx.config.grypeScan?.enabled === true;
+        return ctx.config.grypeScan?.enabled !== false;
     },
     async run(ctx) {
         const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();

package/dist/core/checks/dependencies/npm-audit.js

@@ -38,10 +38,17 @@ exports.npmAuditCheck = {
     },
     async run(ctx) {
         const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'moderate';
+        const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
         const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
         const report = JSON.parse(stdout);
-        const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
+            (ignore.has(v.name.toLowerCase()) ? skip : block).push(v);
+            return [skip, block];
+        }, [[], []]);
+        // Ignored advisories stay visible as warnings — an exception is not a silent drop.
+        ignored.forEach(v => utils_1.logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
         if (directVulns.length === 0)
             return (0, types_1.pass)();
         directVulns.forEach(v => utils_1.logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));

package/dist/index.d.ts

@@ -8,3 +8,5 @@ export { pass, warn, fail, skip, defineCheck } from './core';
 export type { Check, CheckContext, CheckOutcome, CheckReport, CheckResult, CheckStatus, Language, Phase, ReporterFn, ReporterKind, RunOptions, } from './core';
 export { getSourcePath, getSourcePaths, getIgnoredDirs, getPackageConfigPath, hasLocalConfig, } from './config';
 export type { PRCheckMateConfig } from './interfaces';
+export { Logger } from './utils/logger';
+export type { LogLevel } from './utils/logger';

package/dist/index.js

@@ -5,7 +5,7 @@
  * @module pr-checkmate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
+exports.Logger = exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
 // Primary programmatic API: run checks and receive a structured report.
 // Never throws for violations, never calls process.exit — the caller decides.
 var core_1 = require("./core");
@@ -26,3 +26,7 @@ Object.defineProperty(exports, "getSourcePaths", { enumerable: true, get: functi
 Object.defineProperty(exports, "getIgnoredDirs", { enumerable: true, get: function () { return config_1.getIgnoredDirs; } });
 Object.defineProperty(exports, "getPackageConfigPath", { enumerable: true, get: function () { return config_1.getPackageConfigPath; } });
 Object.defineProperty(exports, "hasLocalConfig", { enumerable: true, get: function () { return config_1.hasLocalConfig; } });
+// Standalone logging utility. Consumers instantiate their own Logger so their
+// log level and buffer stay independent from pr-checkmate's internal logger.
+var logger_1 = require("./utils/logger");
+Object.defineProperty(exports, "Logger", { enumerable: true, get: function () { return logger_1.Logger; } });

package/dist/init.js

@@ -31,6 +31,9 @@ const DEFAULT_CONFIG = {
     // Points editors (VS Code, etc.) at the bundled JSON schema for autocomplete
     // and inline validation of this file.
     $schema: './node_modules/pr-checkmate/pr-checkmate.schema.json',
+    // Available CLI commands — kept at the very top as a quick reference.
+    // Informational only; PR CheckMate ignores this at runtime.
+    commands: config_1.DEFAULT_COMMANDS,
     // Human-readable hints. JSON has no comments, so these `//`-prefixed keys are
     // just informational strings — PR CheckMate ignores them at runtime.
     '// reporting': [
@@ -44,7 +47,6 @@ const DEFAULT_CONFIG = {
     // Directories excluded from every check (matched on any path segment). Edit
     // freely — add your own generated/vendored dirs or remove ones you want scanned.
     ignoreDirs: config_1.IGNORED_DIRS,
-    commands: config_1.DEFAULT_COMMANDS,
     // ESLint — the full default rule set is written out so every rule is visible
     // and editable. Change any value, or set a rule to "off" to disable it.
     eslint: {
@@ -134,7 +136,7 @@ const DEFAULT_CONFIG = {
     dockerfileSecurity: { enabled: true }, // Dockerfile: :latest, USER root, curl|bash, …
     caseCollision: { enabled: true }, // files differing only by case
     vulnScan: { enabled: false }, // cross-language dep vulns (osv-scanner, runner-dependency)
-    grypeScan: { enabled: false, minSeverity: 'medium' }, // dep vulns (grype, non-blocking, runner-dependency)
+    grypeScan: { enabled: true, minSeverity: 'medium' }, // dep vulns (grype, non-blocking, runner-dependency; skips if grype absent)
     // Test-coverage presence. Opt-in: enable once your CI produces a coverage
     // report (lcov/cobertura/jacoco/…); warns if none is found.
     coverage: { enabled: false },

package/dist/interfaces/index.d.ts

@@ -48,12 +48,13 @@ export interface PRCheckMateConfig {
     };
     security?: {
         gitleaks?: {
-            enabled: boolean;
+            enabled?: boolean;
             version?: string;
         };
         'npm-audit'?: {
-            enabled: boolean;
-            auditLevel: string;
+            enabled?: boolean;
+            auditLevel?: string;
+            ignore?: string[];
         };
     };
     typecheck?: {

package/dist/utils/logger.d.ts

@@ -1,5 +1,5 @@
-type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
-declare class Logger {
+export type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
+export declare class Logger {
     private logs;
     private levelOrder;
     private currentLevel;
@@ -17,4 +17,3 @@ declare class Logger {
     clear(): void;
 }
 export declare const logger: Logger;
-export {};

package/dist/utils/logger.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logger = void 0;
+exports.logger = exports.Logger = void 0;
 class Logger {
     constructor() {
         this.logs = [];
@@ -65,4 +65,5 @@ class Logger {
         this.logs = [];
     }
 }
+exports.Logger = Logger;
 exports.logger = new Logger();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.3",
+    "version": "1.23.5",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -95,7 +95,7 @@
         "inquirer": "^14.0.2",
         "jscpd": "^5.0.11",
         "license-checker": "^25.0.1",
-        "markdownlint-cli2": "^0.23.0",
+        "markdownlint-cli2": "^0.23.1",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",
         "ts-unused-exports": "^11.0.1",

package/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },

package/src/config/cspell.json

@@ -19,10 +19,13 @@
     "ACMRD",
     "acodec",
     "acompressor",
+    "Activá",
     "adminsdk",
     "adrs",
     "aesctr",
     "aesgcm",
+    "afip",
+    "Afip",
     "AFIP",
     "afplay",
     "Agregar",
@@ -35,13 +38,13 @@
     "alimiter",
     "allclose",
     "Amuta",
+    "análisis",
     "Anchore",
     "androidpublisher",
     "androidx",
     "annualised",
     "Anthropic",
     "anypassword",
-    "análisis",
     "apikey",
     "apinick",
     "apkg",
@@ -87,6 +90,7 @@
     "autoupdating",
     "avdmanager",
     "avds",
+    "Avital",
     "awscli",
     "awscliv",
     "awsconfiguration",
@@ -104,6 +108,9 @@
     "baseweb",
     "bbox",
     "bboxes",
+    "bcra",
+    "Bcra",
+    "BCRA",
     "Bdikat",
     "BEAGENT",
     "beforeinstallprompt",
@@ -155,6 +162,8 @@
     "buildx",
     "bybit",
     "bytebuffer",
+    "CABA",
+    "caea",
     "caesarea",
     "Caesarea",
     "calib",
@@ -205,6 +214,7 @@
     "colwise",
     "commitlintrc",
     "como",
+    "compartilos",
     "completesession",
     "completetest",
     "comprobante",
@@ -215,8 +225,11 @@
     "Configurar",
     "confirmemail",
     "confirmpassword",
+    "Considerá",
     "constraintlayout",
+    "Consultá",
     "Contable",
+    "Contactá",
     "containerregistry",
     "contenteditable",
     "Cooldown",
@@ -231,6 +244,7 @@
     "createsession",
     "createtest",
     "creationflags",
+    "Credito",
     "creds",
     "criterios",
     "crossfade",
@@ -256,8 +270,11 @@
     "DCMAKE",
     "ddepth",
     "ddim",
+    "Ddjj",
+    "DDJJ",
     "ddlkidomet",
     "ddpm",
+    "Debito",
     "decomp",
     "dedup",
     "dedups",
@@ -272,6 +289,7 @@
     "Denona",
     "depcheckrc",
     "depthwise",
+    "DESCS",
     "detalladas",
     "devuser",
     "DFETCHCONTENT",
@@ -323,6 +341,8 @@
     "endtable",
     "engineio",
     "eoilist",
+    "Escaneá",
+    "Escaneás",
     "Esek",
     "esencial",
     "eslint",
@@ -336,6 +356,7 @@
     "executemany",
     "Exento",
     "EXIF",
+    "exportá",
     "extralean",
     "eyecon",
     "eyetracking",
@@ -347,6 +368,8 @@
     "FARMHASH",
     "faststart",
     "fcpxml",
+    "FECAE",
+    "FECAEA",
     "Fecha",
     "Fechas",
     "FETCHCONTENT",
@@ -363,6 +386,7 @@
     "firebaseapp",
     "firestore",
     "Firestore",
+    "fiscalization",
     "fitz",
     "fixedname",
     "flatbuffer",
@@ -387,9 +411,9 @@
     "fromarray",
     "frombuffer",
     "Fsub",
+    "función",
     "funciona",
     "funcionalidad",
-    "función",
     "FUTX",
     "gapi",
     "gastos",
@@ -402,6 +426,7 @@
     "gemmlowp",
     "GEMMLOWP",
     "genai",
+    "Generá",
     "genkey",
     "germany",
     "gershayim",
@@ -480,8 +505,12 @@
     "Hyperedges",
     "hyperliquid",
     "idct",
+    "idempotently",
     "idft",
     "ietf",
+    "iibb",
+    "Iibb",
+    "IIBB",
     "imageset",
     "imencode",
     "imgcodecs",
@@ -496,6 +525,7 @@
     "initialised",
     "inputmethod",
     "Inscripto",
+    "inscriptos",
     "installroot",
     "instrucciones",
     "integrat",
@@ -524,6 +554,7 @@
     "Jsons",
     "jsqr",
     "Jsqr",
+    "july",
     "junitxml",
     "jvmargs",
     "kama",
@@ -564,11 +595,12 @@
     "kupat",
     "langgraph",
     "laplace",
+    "latam",
     "layernorm",
     "lbank",
+    "leído",
     "lelvni",
     "letterboxed",
-    "leído",
     "libavcodec",
     "libavformat",
     "libavutil",
@@ -612,9 +644,13 @@
     "Mazav",
     "mdpi",
     "Meaghan",
+    "Medor",
     "Megurim",
     "mekabel",
     "memswap",
+    "mercaderia",
+    "mercadolibre",
+    "mercadopago",
     "metadatalist",
     "Metaspace",
     "mexc",
@@ -630,6 +666,9 @@
     "mockito",
     "modelcontextprotocol",
     "monkeypatched",
+    "monotributista",
+    "monotributistas",
+    "monotributo",
     "Monotributo",
     "Monto",
     "moov",
@@ -652,6 +691,7 @@
     "myregistry",
     "myrepo",
     "mytoken",
+    "Nahman",
     "Naing",
     "Namayeshi",
     "nanargmax",
@@ -712,6 +752,8 @@
     "opencvcommit",
     "OPENNI",
     "openslr",
+    "orientative",
+    "ORIENTATIVE",
     "osascript",
     "Osek",
     "Osis",
@@ -745,13 +787,14 @@
     "Pipfile",
     "pipx",
     "playwright",
+    "podés",
     "podfile",
     "poland",
     "Polishchuk",
+    "Política",
     "poloniex",
     "polyfit",
     "polyorder",
-    "Política",
     "popleft",
     "positiving",
     "posix",
@@ -773,8 +816,8 @@
     "processlist",
     "progressbar",
     "protobuf",
-    "proyecto",
     "Próximos",
+    "proyecto",
     "psola",
     "pthreadpool",
     "pubspec",
@@ -785,6 +828,8 @@
     "pycodestyle",
     "pyflakes",
     "pyiceberg",
+    "pyme",
+    "Pyme",
     "pymediainfo",
     "pyngrok",
     "pynput",
@@ -805,6 +850,7 @@
     "qwen",
     "Ra'anana",
     "raanana",
+    "raíz",
     "ramat",
     "Ramat",
     "Ramesh",
@@ -812,14 +858,19 @@
     "randu",
     "Rango",
     "Rashum",
+    "Rasterizes",
     "Rastree",
     "rawvideo",
-    "raíz",
     "realtag",
     "rebal",
     "rebalance",
     "rebalancing",
     "recaptcha",
+    "recat",
+    "recategorización",
+    "recategorizarte",
+    "recategorization",
+    "Recategorization",
     "Recibo",
     "recibos",
     "Recibos",
@@ -830,7 +881,9 @@
     "reentrancy",
     "referer",
     "Regen",
+    "Registrá",
     "remoteconfig",
+    "Renovala",
     "reporthook",
     "Requerida",
     "resendcode",
@@ -935,6 +988,7 @@
     "suptitle",
     "supxlabel",
     "supylabel",
+    "Suscribite",
     "swiftformat",
     "swiftlint",
     "swiftpm",
@@ -951,7 +1005,9 @@
     "tcwf",
     "telaviv",
     "temurin",
+    "Tenés",
     "tensorflow",
+    "Términos",
     "testid",
     "testsuite",
     "testsuites",
@@ -977,18 +1033,21 @@
     "tocken",
     "todas",
     "tofes",
+    "toggleable",
+    "Toggleable",
     "torchcodec",
     "totp",
     "tpsl",
     "tradingview",
     "transacciones",
     "trapz",
-    "travis",
     "través",
+    "travis",
     "trunc",
     "tsconfig",
     "tsmc",
     "ttest",
+    "Tucumán",
     "Tukey",
     "tulipy",
     "Turakhia",
@@ -997,7 +1056,6 @@
     "typescript",
     "Tzionit",
     "tzviat",
-    "Términos",
     "ubgjg",
     "udid",
     "ufunc",
@@ -1005,6 +1063,7 @@
     "UiAutomator2",
     "UITM",
     "ukrainian",
+    "Último",
     "undistort",
     "unhedged",
     "unindexed",
@@ -1017,6 +1076,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "upsell",
     "usecase",
     "usefixtures",
     "userfound",
@@ -1028,9 +1088,11 @@
     "uuid",
     "uuids",
     "Validatable",
+    "válido",
     "VAQH",
     "vconcat",
     "vectorbt",
+    "vendés",
     "venv",
     "verticalalignment",
     "vfrzk",
@@ -1054,7 +1116,6 @@
     "vulns",
     "vwap",
     "vwma",
-    "válido",
     "watchlist",
     "wavesexchange",
     "waze",
@@ -1065,6 +1126,7 @@
     "WHQVLV",
     "workdir",
     "wrongpassword",
+    "WSAA",
     "xapp",
     "xcassets",
     "xcframework",
@@ -1094,8 +1156,9 @@
     "Zehut",
     "zorder",
     "zrufot",
-    "Último",
     "Δangle",
+    "Σcredit",
+    "Σdebit",
     "Авів",
     "Беер",
     "Беэр",
@@ -1109,6 +1172,7 @@
     "Гіватаїм",
     "Ельберт",
     "зв'язатися",
+    "Іріною",
     "Кфар",
     "люксовой",
     "мастхэв",
@@ -1124,8 +1188,8 @@
     "раннера",
     "раннере",
     "Ришон",
-    "Русский",
     "Рішон",
+    "Русский",
     "стике",
     "Тіква",
     "Українська",
@@ -1135,7 +1199,6 @@
     "Холон",
     "Цион",
     "Ціон",
-    "Іріною",
     "אידיאלי",
     "אירינה",
     "אקונה",

package/src/config/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },