pr-checkmate 1.23.4 → 1.23.5

package/dist/config/loader.js

@@ -59,7 +59,12 @@ function mergeWithDefaults(userConfig) {
                 ...(userConfig.spellcheck?.ignorePaths || []),
             ],
         },
-        security: userConfig.security || defaults.security,
+        security: {
+            ...defaults.security,
+            ...userConfig.security,
+            gitleaks: { ...defaults.security?.gitleaks, ...userConfig.security?.gitleaks },
+            'npm-audit': { ...defaults.security?.['npm-audit'], ...userConfig.security?.['npm-audit'] },
+        },
         typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
         cpp: {
             ...defaults.cpp,

package/dist/core/checks/dependencies/npm-audit.js

@@ -38,10 +38,17 @@ exports.npmAuditCheck = {
     },
     async run(ctx) {
         const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'moderate';
+        const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
         const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
         const report = JSON.parse(stdout);
-        const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
+            (ignore.has(v.name.toLowerCase()) ? skip : block).push(v);
+            return [skip, block];
+        }, [[], []]);
+        // Ignored advisories stay visible as warnings — an exception is not a silent drop.
+        ignored.forEach(v => utils_1.logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
         if (directVulns.length === 0)
             return (0, types_1.pass)();
         directVulns.forEach(v => utils_1.logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));

package/dist/index.d.ts

@@ -8,3 +8,5 @@ export { pass, warn, fail, skip, defineCheck } from './core';
 export type { Check, CheckContext, CheckOutcome, CheckReport, CheckResult, CheckStatus, Language, Phase, ReporterFn, ReporterKind, RunOptions, } from './core';
 export { getSourcePath, getSourcePaths, getIgnoredDirs, getPackageConfigPath, hasLocalConfig, } from './config';
 export type { PRCheckMateConfig } from './interfaces';
+export { Logger } from './utils/logger';
+export type { LogLevel } from './utils/logger';

package/dist/index.js

@@ -5,7 +5,7 @@
  * @module pr-checkmate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
+exports.Logger = exports.hasLocalConfig = exports.getPackageConfigPath = exports.getIgnoredDirs = exports.getSourcePaths = exports.getSourcePath = exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
 // Primary programmatic API: run checks and receive a structured report.
 // Never throws for violations, never calls process.exit — the caller decides.
 var core_1 = require("./core");
@@ -26,3 +26,7 @@ Object.defineProperty(exports, "getSourcePaths", { enumerable: true, get: functi
 Object.defineProperty(exports, "getIgnoredDirs", { enumerable: true, get: function () { return config_1.getIgnoredDirs; } });
 Object.defineProperty(exports, "getPackageConfigPath", { enumerable: true, get: function () { return config_1.getPackageConfigPath; } });
 Object.defineProperty(exports, "hasLocalConfig", { enumerable: true, get: function () { return config_1.hasLocalConfig; } });
+// Standalone logging utility. Consumers instantiate their own Logger so their
+// log level and buffer stay independent from pr-checkmate's internal logger.
+var logger_1 = require("./utils/logger");
+Object.defineProperty(exports, "Logger", { enumerable: true, get: function () { return logger_1.Logger; } });

package/dist/interfaces/index.d.ts

@@ -48,12 +48,13 @@ export interface PRCheckMateConfig {
     };
     security?: {
         gitleaks?: {
-            enabled: boolean;
+            enabled?: boolean;
             version?: string;
         };
         'npm-audit'?: {
-            enabled: boolean;
-            auditLevel: string;
+            enabled?: boolean;
+            auditLevel?: string;
+            ignore?: string[];
         };
     };
     typecheck?: {

package/dist/utils/logger.d.ts

@@ -1,5 +1,5 @@
-type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
-declare class Logger {
+export type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
+export declare class Logger {
     private logs;
     private levelOrder;
     private currentLevel;
@@ -17,4 +17,3 @@ declare class Logger {
     clear(): void;
 }
 export declare const logger: Logger;
-export {};

package/dist/utils/logger.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logger = void 0;
+exports.logger = exports.Logger = void 0;
 class Logger {
     constructor() {
         this.logs = [];
@@ -65,4 +65,5 @@ class Logger {
         this.logs = [];
     }
 }
+exports.Logger = Logger;
 exports.logger = new Logger();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.4",
+    "version": "1.23.5",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -95,7 +95,7 @@
         "inquirer": "^14.0.2",
         "jscpd": "^5.0.11",
         "license-checker": "^25.0.1",
-        "markdownlint-cli2": "^0.23.0",
+        "markdownlint-cli2": "^0.23.1",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",
         "ts-unused-exports": "^11.0.1",

package/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },

package/src/config/pr-checkmate.schema.json

@@ -100,6 +100,33 @@
         "ignore": { "type": "array", "items": { "type": "string" } }
       }
     },
+    "security": {
+      "type": "object",
+      "properties": {
+        "gitleaks": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "version": { "type": "string" }
+          }
+        },
+        "npm-audit": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "auditLevel": {
+              "type": "string",
+              "enum": ["info", "low", "moderate", "high", "critical"]
+            },
+            "ignore": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Package names whose vulnerabilities never block, even when direct and at/above auditLevel. Still reported as warnings."
+            }
+          }
+        }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },