pr-checkmate 2.1.2 → 3.0.1

package/install-manifests/js/package.json

@@ -3,17 +3,17 @@
   "version": "1.0.0",
   "dependencies": {
     "typescript": "6.0.3",
-    "eslint": "10.6.0",
+    "eslint": "10.8.1",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import-x": "4.17.1",
-    "eslint-plugin-jsdoc": "63.0.12",
-    "eslint-plugin-prettier": "5.5.5",
-    "eslint-plugin-sonarjs": "4.1.0",
-    "@typescript-eslint/eslint-plugin": "8.62.1",
-    "@typescript-eslint/parser": "8.62.1",
-    "prettier": "3.8.1",
-    "dpdm": "4.2.0",
-    "knip": "6.29.0",
+    "eslint-plugin-jsdoc": "64.2.1",
+    "eslint-plugin-prettier": "5.5.6",
+    "eslint-plugin-sonarjs": "4.2.0",
+    "@typescript-eslint/eslint-plugin": "8.67.0",
+    "@typescript-eslint/parser": "8.67.0",
+    "prettier": "3.9.6",
+    "dpdm": "4.3.0",
+    "knip": "6.32.2",
     "ts-unused-exports": "11.0.1",
     "license-checker-rseidelsohn": "5.0.1"
   },

package/install-manifests/python/package-lock.json

@@ -8,13 +8,13 @@
       "name": "pr-checkmate-profile-python",
       "version": "1.0.0",
       "dependencies": {
-        "@astral-sh/ruff-wasm-nodejs": "0.15.20"
+        "@astral-sh/ruff-wasm-nodejs": "0.16.3"
       }
     },
     "node_modules/@astral-sh/ruff-wasm-nodejs": {
-      "version": "0.15.20",
-      "resolved": "https://registry.npmjs.org/@astral-sh/ruff-wasm-nodejs/-/ruff-wasm-nodejs-0.15.20.tgz",
-      "integrity": "sha512-24pK47J8F/u16SRDsNVodGpLkvx3Ws+Chn8N+M0VVM1PP6BFVBJ9c9a3ZPM9NoDKdvuRJly5Gu7bsgQqt9o8Ww==",
+      "version": "0.16.3",
+      "resolved": "https://registry.npmjs.org/@astral-sh/ruff-wasm-nodejs/-/ruff-wasm-nodejs-0.16.3.tgz",
+      "integrity": "sha512-3mYx2a04I0/ekpwCqEKkqa/V7dBFDTrFpFh/BgG3jiqkCmUScY/1HXxifMrqP9NdRrtlTxxD200H8aiQvrfjGw==",
       "license": "MIT"
     }
   }

package/install-manifests/python/package.json

@@ -2,7 +2,7 @@
   "name": "pr-checkmate-profile-python",
   "version": "1.0.0",
   "dependencies": {
-    "@astral-sh/ruff-wasm-nodejs": "0.15.20"
+    "@astral-sh/ruff-wasm-nodejs": "0.16.3"
   },
   "private": true
 }

package/install-manifests/pytypes/package-lock.json

@@ -0,0 +1,45 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pr-checkmate-profile-pytypes",
+      "version": "1.0.0",
+      "dependencies": {
+        "pyright": "1.1.413"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/pyright": {
+      "version": "1.1.413",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.413.tgz",
+      "integrity": "sha512-1lpxKrh0DHHpfAQOfciZo2ojua2jase3wwO9at8kldc+F/p1PBscxA5CQ3G1qg5lMOMhXo6ZaiMLMXEAqADIAg==",
+      "license": "MIT",
+      "bin": {
+        "pyright": "index.js",
+        "pyright-langserver": "langserver.index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    }
+  }
+}

package/install-manifests/pytypes/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "dependencies": {
+    "pyright": "1.1.413"
+  },
+  "private": true
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "2.1.2",
+    "version": "3.0.1",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -52,7 +52,7 @@
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
-        "test": "node --require ts-node/register --test --test-timeout=60000 --test-concurrency=1 \"tests/**/*.test.ts\"",
+        "test": "node --require ts-node/register --test --test-timeout=60000 \"tests/**/*.test.ts\"",
         "test:ci": "bash scripts/test-per-file.sh",
         "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
@@ -75,37 +75,39 @@
     "author": "Artur Polishchuk",
     "license": "SEE LICENSE IN LICENSE",
     "dependencies": {
-        "@astral-sh/ruff-wasm-nodejs": "^0.15.20",
-        "@commitlint/cli": "^21.2.0",
-        "@commitlint/config-conventional": "^21.2.0",
-        "@types/node": "^26.1.0",
-        "@typescript-eslint/eslint-plugin": "^8.62.1",
-        "@typescript-eslint/parser": "^8.62.1",
+        "@astral-sh/ruff-wasm-nodejs": "^0.16.3",
+        "@commitlint/cli": "^21.2.2",
+        "@commitlint/config-conventional": "^21.2.2",
+        "@types/node": "^26.2.0",
+        "@typescript-eslint/eslint-plugin": "^8.67.0",
+        "@typescript-eslint/parser": "^8.67.0",
         "@wasm-fmt/clang-format": "^22.1.8",
+        "@wasm-fmt/gofmt": "^0.7.3",
         "cspell": "^10.0.1",
-        "dpdm": "^4.2.0",
-        "eslint": "^10.6.0",
+        "dpdm": "^4.3.0",
+        "eslint": "^10.8.1",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^63.0.12",
-        "eslint-plugin-prettier": "^5.5.4",
-        "eslint-plugin-sonarjs": "^4.1.0",
+        "eslint-plugin-jsdoc": "^64.2.1",
+        "eslint-plugin-prettier": "^5.5.6",
+        "eslint-plugin-sonarjs": "^4.2.0",
         "execa": "^9.6.0",
         "gitleaks-secret-scanner-fixed": "^2.1.3",
-        "inquirer": "^14.0.2",
-        "jscpd": "^5.0.11",
-        "knip": "^6.29.0",
+        "inquirer": "^14.1.0",
+        "jscpd": "^5.0.16",
+        "knip": "^6.32.2",
         "license-checker-rseidelsohn": "^5.0.1",
         "markdownlint-cli2": "^0.23.1",
-        "prettier": ">=3.0.0",
+        "prettier": "^3.9.6",
         "ts-node": "^10.9.1",
         "ts-unused-exports": "^11.0.1",
         "typescript": "^6.0.3",
         "yaml": "^2.9.0"
     },
     "devDependencies": {
-        "conventional-commits-filter": "^5.0.0",
-        "conventional-commits-parser": "^6.4.0",
+        "conventional-commits-filter": "^6.0.1",
+        "conventional-commits-parser": "^7.1.2",
+        "pyright": "^1.1.413",
         "standard-version": "^9.5.0",
         "typedoc": "^0.28.20"
     },

package/pr-checkmate.schema.json

@@ -24,7 +24,7 @@
       "default": "."
     },
     "excludePaths": {
-      "description": "Files and folders no check ever looks at, as globs (\"src/generated/**\", \"vendor/legacy.ts\", \"**/*.min.js\"). Unlike ignoreDirs — which matches a directory NAME on any segment — this addresses one path or one file.",
+      "description": "Files and folders no check ever looks at, as globs (\"src/generated/**\", \"vendor/legacy.ts\", \"**/*.min.js\"). Unlike ignoreDirs \u2014 which matches a directory NAME on any segment \u2014 this addresses one path or one file.",
       "type": "array",
       "items": {
         "type": "string"
@@ -270,7 +270,7 @@
       "description": "Secret scanning (gitleaks) and npm audit."
     },
     "mergeConflict": {
-      "description": "Conflict markers left in a file. Blocking by default — this is breakage, not an opinion.",
+      "description": "Conflict markers left in a file. Blocking by default \u2014 this is breakage, not an opinion.",
       "type": "object",
       "properties": {
         "enabled": {
@@ -336,7 +336,7 @@
       "type": "object",
       "properties": {
         "ignorePaths": {
-          "description": "Globs for files this check never looks at — the exclusion for a single false positive (a .pem fixture). Unlike \"ignore\", it does not silence a whole category.",
+          "description": "Globs for files this check never looks at \u2014 the exclusion for a single false positive (a .pem fixture). Unlike \"ignore\", it does not silence a whole category.",
           "type": "array",
           "items": {
             "type": "string"
@@ -502,7 +502,7 @@
           "default": true
         }
       },
-      "description": "Validates the pull request description — minimum length, ticket reference."
+      "description": "Validates the pull request description \u2014 minimum length, ticket reference."
     },
     "cpp": {
       "$ref": "#/$defs/toggle"
@@ -573,7 +573,7 @@
           "enum": ["auto", "always", "never"]
         },
         "onDegradedScope": {
-          "description": "What to do when a CI run wanted a diff range, could not build one, and fell back to a full scan — which silently drops every diff-only check. Never triggers outside CI.",
+          "description": "What to do when a CI run wanted a diff range, could not build one, and fell back to a full scan \u2014 which silently drops every diff-only check. Never triggers outside CI.",
           "enum": ["warn", "error", "off"]
         },
         "concurrency": {
@@ -622,7 +622,7 @@
           "type": "number"
         },
         "retries": {
-          "description": "Attempts per request for retryable failures — 5xx, 429, network (default 3).",
+          "description": "Attempts per request for retryable failures \u2014 5xx, 429, network (default 3).",
           "type": "number"
         },
         "maxPages": {
@@ -654,12 +654,12 @@
       }
     },
     "commands": {
-      "description": "Quick CLI reference written by init. Informational only — ignored at runtime.",
+      "description": "Quick CLI reference written by init. Informational only \u2014 ignored at runtime.",
       "type": "object",
       "additionalProperties": true
     },
     "documentation": {
-      "description": "Documentation links written by init. Informational only — ignored at runtime.",
+      "description": "Documentation links written by init. Informational only \u2014 ignored at runtime.",
       "type": "object",
       "additionalProperties": true
     },
@@ -727,7 +727,7 @@
           "default": 1
         },
         "reuseLocal": {
-          "description": "Reuse a tool already in the client's node_modules: \"compatible\" (default), \"always\", or \"off\".",
+          "description": "Reuse a tool already present in the repository's node_modules instead of our copy. \"compatible\" (default) reuses when the major matches ours, or when the tool reads the repository's own config (a legacy .eslintrc can only be read by the ESLint that wrote it, and a tsconfig by its own compiler). \"always\" reuses across a major gap at your own risk. \"off\" always uses our pinned copy, for reproducibility.",
           "type": "string",
           "enum": ["compatible", "always", "off"],
           "default": "compatible"
@@ -761,7 +761,7 @@
           "default": "~/.cache/pr-checkmate"
         },
         "prewarm": {
-          "description": "Warm the cache in postinstall. false leaves everything to the lazy path.",
+          "description": "NOT IMPLEMENTED \u2014 accepted and ignored. Warming the cache would need a postinstall hook, which would run npm inside npm on every install of this package; for a supply-chain tool that is not a trade worth making. Pre-warm with \"npx pr-checkmate install --all\" instead. Documented as inert rather than quietly doing nothing.",
           "type": "boolean",
           "default": true
         },
@@ -1011,7 +1011,7 @@
       }
     },
     "log": {
-      "description": "Diagnostic output — the running commentary around the run, as opposed to the summary it produces.",
+      "description": "Diagnostic output \u2014 the running commentary around the run, as opposed to the summary it produces.",
       "type": "object",
       "properties": {
         "level": {
@@ -1042,6 +1042,28 @@
           "type": "number"
         }
       }
+    },
+    "packageSize": {
+      "description": "Growth of the published npm package since the last release. Advisory by default.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": true
+        },
+        "maxGrowthPercent": {
+          "description": "Growth above this, in percent of the previous release's unpacked size, is reported.",
+          "type": "number",
+          "minimum": 0,
+          "default": 20
+        },
+        "compareWith": {
+          "description": "dist-tag or version to compare against. Default \"latest\".",
+          "type": "string",
+          "default": "latest"
+        }
+      }
     }
   },
   "$defs": {
@@ -1137,7 +1159,7 @@
           }
         },
         "disablePatterns": {
-          "description": "Built-in rules to switch off by label substring — the rule never runs.",
+          "description": "Built-in rules to switch off by label substring \u2014 the rule never runs.",
           "type": "array",
           "items": {
             "type": "string"
@@ -1165,7 +1187,7 @@
                 "enum": ["error", "warn"]
               },
               "view": {
-                "description": "\"code\" matches with string literals blanked out — use it to find a call, not text inside a string.",
+                "description": "\"code\" matches with string literals blanked out \u2014 use it to find a call, not text inside a string.",
                 "enum": ["raw", "code"]
               },
               "flags": {
@@ -1174,6 +1196,12 @@
               }
             }
           }
+        },
+        "dataflowWindow": {
+          "type": "integer",
+          "minimum": 0,
+          "default": 10,
+          "description": "Added lines a value stays tainted for, connecting an interpolated string assigned on one line to a query on a later line. 0 disables the cross-line heuristic. Advisory only \u2014 it has no scopes and no reassignment tracking, so it never blocks a run."
         }
       }
     },