prodlint 0.9.2 → 0.9.4

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.9.2
+  prodlint v0.9.4
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts

package/action.yml

@@ -132,7 +132,7 @@ runs:
 
     - name: Post PR comment
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: marocchino/sticky-pull-request-comment@v2
+      uses: marocchino/sticky-pull-request-comment@v3
       with:
         header: prodlint
         path: /tmp/prodlint-comment.md

package/dist/cli.js

@@ -723,10 +723,25 @@ var SECRET_PATTERNS = [
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
   { name: "OpenAI API key (legacy)", pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/ },
   { name: "OpenAI API key", pattern: /sk-proj-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)[0-9]{2}-[a-zA-Z0-9_\-]{20,}/ },
   { name: "GitHub token", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/ },
   { name: "GitHub fine-grained token", pattern: /github_pat_[A-Za-z0-9_]{22,}/ },
   { name: "Generic API key assignment", pattern: /(?:api_key|apikey|api_secret|secret_key|private_key)\s*[=:]\s*['"][a-zA-Z0-9_\-]{20,}['"]/ },
-  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ }
+  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ },
+  // Cloud / platform keys
+  { name: "Google API key", pattern: /AIza[0-9A-Za-z_\-]{35}/ },
+  { name: "Google OAuth client secret", pattern: /GOCSPX-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "GitLab personal access token", pattern: /glpat-[A-Za-z0-9_\-]{20,}/ },
+  { name: "npm access token", pattern: /npm_[A-Za-z0-9]{36}/ },
+  { name: "Slack token", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: "Slack webhook URL", pattern: /hooks\.slack\.com\/services\/[A-Za-z0-9_\-\/]{20,}/ },
+  { name: "Supabase secret key", pattern: /sb_secret_[a-zA-Z0-9_\-]{20,}/ },
+  // AI provider keys
+  { name: "Hugging Face token", pattern: /hf_[a-zA-Z0-9]{34,}/ },
+  { name: "Groq API key", pattern: /gsk_[a-zA-Z0-9]{40,}/ },
+  // Structural / high-signal
+  { name: "private key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { name: "database connection string with credentials", pattern: /(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s:@/]+:[^\s@/]{3,}@/ }
 ];
 var secretsRule = {
   id: "secrets",

package/dist/index.js

@@ -717,10 +717,25 @@ var SECRET_PATTERNS = [
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
   { name: "OpenAI API key (legacy)", pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/ },
   { name: "OpenAI API key", pattern: /sk-proj-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)[0-9]{2}-[a-zA-Z0-9_\-]{20,}/ },
   { name: "GitHub token", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/ },
   { name: "GitHub fine-grained token", pattern: /github_pat_[A-Za-z0-9_]{22,}/ },
   { name: "Generic API key assignment", pattern: /(?:api_key|apikey|api_secret|secret_key|private_key)\s*[=:]\s*['"][a-zA-Z0-9_\-]{20,}['"]/ },
-  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ }
+  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ },
+  // Cloud / platform keys
+  { name: "Google API key", pattern: /AIza[0-9A-Za-z_\-]{35}/ },
+  { name: "Google OAuth client secret", pattern: /GOCSPX-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "GitLab personal access token", pattern: /glpat-[A-Za-z0-9_\-]{20,}/ },
+  { name: "npm access token", pattern: /npm_[A-Za-z0-9]{36}/ },
+  { name: "Slack token", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: "Slack webhook URL", pattern: /hooks\.slack\.com\/services\/[A-Za-z0-9_\-\/]{20,}/ },
+  { name: "Supabase secret key", pattern: /sb_secret_[a-zA-Z0-9_\-]{20,}/ },
+  // AI provider keys
+  { name: "Hugging Face token", pattern: /hf_[a-zA-Z0-9]{34,}/ },
+  { name: "Groq API key", pattern: /gsk_[a-zA-Z0-9]{40,}/ },
+  // Structural / high-signal
+  { name: "private key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { name: "database connection string with credentials", pattern: /(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s:@/]+:[^\s@/]{3,}@/ }
 ];
 var secretsRule = {
   id: "secrets",

package/dist/mcp.js

@@ -726,10 +726,25 @@ var SECRET_PATTERNS = [
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
   { name: "OpenAI API key (legacy)", pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/ },
   { name: "OpenAI API key", pattern: /sk-proj-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)[0-9]{2}-[a-zA-Z0-9_\-]{20,}/ },
   { name: "GitHub token", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/ },
   { name: "GitHub fine-grained token", pattern: /github_pat_[A-Za-z0-9_]{22,}/ },
   { name: "Generic API key assignment", pattern: /(?:api_key|apikey|api_secret|secret_key|private_key)\s*[=:]\s*['"][a-zA-Z0-9_\-]{20,}['"]/ },
-  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ }
+  { name: "SendGrid API key", pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ },
+  // Cloud / platform keys
+  { name: "Google API key", pattern: /AIza[0-9A-Za-z_\-]{35}/ },
+  { name: "Google OAuth client secret", pattern: /GOCSPX-[a-zA-Z0-9_\-]{20,}/ },
+  { name: "GitLab personal access token", pattern: /glpat-[A-Za-z0-9_\-]{20,}/ },
+  { name: "npm access token", pattern: /npm_[A-Za-z0-9]{36}/ },
+  { name: "Slack token", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: "Slack webhook URL", pattern: /hooks\.slack\.com\/services\/[A-Za-z0-9_\-\/]{20,}/ },
+  { name: "Supabase secret key", pattern: /sb_secret_[a-zA-Z0-9_\-]{20,}/ },
+  // AI provider keys
+  { name: "Hugging Face token", pattern: /hf_[a-zA-Z0-9]{34,}/ },
+  { name: "Groq API key", pattern: /gsk_[a-zA-Z0-9]{40,}/ },
+  // Structural / high-signal
+  { name: "private key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { name: "database connection string with credentials", pattern: /(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s:@/]+:[^\s@/]{3,}@/ }
 ];
 var secretsRule = {
   id: "secrets",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prodlint",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
   "license": "MIT",
   "author": "prodlint contributors",
@@ -40,22 +40,28 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "node dist/cli.js .",
+    "audit:supply-chain": "node scripts/supply-chain-audit.cjs",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@babel/parser": "^7.29.0",
-    "@babel/types": "^7.29.0",
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "@rollup/rollup-win32-x64-msvc": "^4.59.0",
+    "@babel/parser": "^7.29.7",
+    "@babel/types": "^7.29.7",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "fast-glob": "^3.3.3",
     "picocolors": "^1.1.1",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.2.3",
+    "@types/node": "^26.0.1",
     "tsup": "^8.4.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.6"
+  },
+  "optionalDependencies": {
+    "@rollup/rollup-win32-x64-msvc": "^4.62.2"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   },
   "engines": {
     "node": ">=18"