react-doctor 0.7.1 → 0.7.2-dev.aa519e5

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7cb857ba-6f0a-57d9-91f3-3c286472121d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="10e3e1b0-f291-5306-b5fd-79b158b00159")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -9,7 +9,7 @@ import path from "node:path";
 import * as NodeChildProcess from "node:child_process";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os from "node:os";
 import { parseJSON5 } from "confbox";
@@ -32800,8 +32800,10 @@ const isFile = (filePath) => {
 };
 const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?|mts|mjs)$/;
 const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
+const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
 	".astro",
@@ -32943,7 +32945,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.1";
+const CORE_PACKAGE_VERSION = "0.7.2";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -32953,8 +32955,9 @@ const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
 const SUPPLY_CHAIN_CACHE_TTL_MS = 864e5;
 const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
 const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
-const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
-const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
+const isIgnoredDirectoryName = (directoryName) => IGNORED_DIRECTORIES.has(directoryName) || directoryName.startsWith(".") && !SCANNED_DOT_DIRECTORIES.has(directoryName);
+const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => isIgnoredDirectoryName(segment));
+const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath) && !GENERATED_SOURCE_DIRECTORY_PATTERN.test(filePath);
 const isMinifiedSource = (absolutePath) => {
 	let fileDescriptor;
 	try {
@@ -33018,7 +33021,7 @@ function* walkSourceTreeFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(currentDirectory)) {
 			const absolutePath = Path.join(currentDirectory, entry.name);
 			if (entry.isDirectory()) {
-				if (!IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				if (!isIgnoredDirectoryName(entry.name)) stack.push(absolutePath);
 				continue;
 			}
 			if (entry.isFile()) yield {
@@ -33064,6 +33067,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33097,11 +33117,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -33747,6 +33763,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -33903,6 +33987,10 @@ const normalizeCompilerOptions = (compilerOptions) => {
 		hasExplicitLib
 	};
 };
+const normalizeReferencePaths = (references) => {
+	if (!Array.isArray(references)) return [];
+	return references.map((reference) => isPlainObject(reference) && typeof reference.path === "string" ? reference.path : null).filter((referencePath) => referencePath !== null);
+};
 const readTsConfig = (filePath) => {
 	let content;
 	try {
@@ -33914,6 +34002,7 @@ const readTsConfig = (filePath) => {
 	if (!isPlainObject(parsed.config)) return null;
 	return {
 		extends: typeof parsed.config.extends === "string" ? parsed.config.extends : void 0,
+		referencePaths: normalizeReferencePaths(parsed.config.references),
 		compilerOptions: normalizeCompilerOptions(parsed.config.compilerOptions)
 	};
 };
@@ -33954,20 +34043,37 @@ const libEntryIncludesES2023Array = (entry) => {
 };
 const libIncludesES2023 = (lib) => lib.some(libEntryIncludesES2023Array);
 const compilerOptionsArePreES2023 = (compilerOptions) => {
+	if (compilerOptions.target && targetYearIsPreES2023(compilerOptions.target)) return true;
 	if (compilerOptions.hasExplicitLib) return !libIncludesES2023(compilerOptions.lib ?? []);
-	if (compilerOptions.target) return targetYearIsPreES2023(compilerOptions.target);
 	return false;
 };
 const compilerOptionsDeclareTargetOrLib = (compilerOptions) => compilerOptions.hasExplicitLib || compilerOptions.target !== void 0;
-const detectPreES2023FromConfig = (tsConfigPath) => {
+const detectPreES2023FromConfig = (tsConfigPath, visitedConfigPaths = /* @__PURE__ */ new Set()) => {
+	if (visitedConfigPaths.has(tsConfigPath)) return false;
 	const compilerOptions = readResolvedCompilerOptions(tsConfigPath, 0, /* @__PURE__ */ new Set());
 	if (!compilerOptions) return false;
-	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) return false;
+	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) {
+		const tsConfig = readTsConfig(tsConfigPath);
+		if (!tsConfig) return false;
+		const nextVisitedConfigPaths = new Set(visitedConfigPaths);
+		nextVisitedConfigPaths.add(tsConfigPath);
+		const configDirectory = Path.dirname(tsConfigPath);
+		return tsConfig.referencePaths.some((referencePath) => {
+			const resolvedReferencePath = Path.resolve(configDirectory, referencePath);
+			const referencedConfigPath = isFile(resolvedReferencePath) ? resolvedReferencePath : Path.join(resolvedReferencePath, TSCONFIG_FILENAME);
+			return isFile(referencedConfigPath) && detectPreES2023FromConfig(referencedConfigPath, nextVisitedConfigPaths);
+		});
+	}
 	return compilerOptionsArePreES2023(compilerOptions);
 };
+const FALLBACK_TSCONFIG_FILENAMES = ["tsconfig.app.json", "tsconfig.build.json"];
 const detectPreES2023Target = (directory) => {
 	const tsConfigPath = Path.join(directory, TSCONFIG_FILENAME);
 	if (isFile(tsConfigPath)) return detectPreES2023FromConfig(tsConfigPath);
+	for (const fallbackFilename of FALLBACK_TSCONFIG_FILENAMES) {
+		const fallbackPath = Path.join(directory, fallbackFilename);
+		if (isFile(fallbackPath)) return detectPreES2023FromConfig(fallbackPath);
+	}
 	return false;
 };
 const REACT_DEPENDENCY_NAMES = new Set([
@@ -34086,19 +34192,20 @@ const clearProjectCache = () => {
 };
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -34128,6 +34235,7 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		shopifyFlashListVersion: null,
 		shopifyFlashListMajorVersion: null,
 		hasReanimated: false,
+		reanimatedVersion: null,
 		isPreES2023Target: hasOwnTsConfig && detectPreES2023Target(directory),
 		sourceFileCount
 	};
@@ -34202,6 +34310,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -34219,6 +34328,7 @@ const discoverProject = (directory) => {
 		version: findShopifyFlashListVersion(directory, packageJson)
 	}) : null;
 	const hasReanimated = hasReactNativeWorkspace && someWorkspacePackageJson(directory, packageJson, isPackageJsonReanimatedAware);
+	const reanimatedVersion = hasReanimated ? findInWorkspacePackageJsons(directory, packageJson, (workspacePackageJson) => getDependencySpec(workspacePackageJson, REANIMATED_DEPENDENCY_NAME)) : null;
 	const nextjsVersion = framework === "nextjs" ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
 		rootPackageJson: packageJson,
@@ -34248,6 +34358,7 @@ const discoverProject = (directory) => {
 		shopifyFlashListVersion,
 		shopifyFlashListMajorVersion: shopifyFlashListVersion === null ? null : getLowestDependencyMajor(shopifyFlashListVersion),
 		hasReanimated,
+		reanimatedVersion,
 		isPreES2023Target,
 		sourceFileCount
 	};
@@ -34440,6 +34551,9 @@ const buildRuleSeverityControls = (config) => {
 		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
 	};
 };
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -34517,6 +34631,7 @@ const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
 	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
 	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
+	"react/jsx-no-target-blank": "react-doctor/jsx-no-target-blank",
 	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
 	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
 	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
@@ -34590,9 +34705,6 @@ const tokenizeRuleList = (ruleList) => {
 	if (!ruleSection) return [];
 	return ruleSection.split(/[,\s]+/).map((token) => token.trim()).filter(Boolean);
 };
-const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
-const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
-const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — add \`${ruleId}\` to the comment (e.g. \`${token}, ${ruleId}\`).`;
 const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
 const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
@@ -34646,6 +34758,53 @@ const detectForeignDisableNearMiss = (lines, diagnosticLineIndex, ruleId) => {
 	if (!ruleId.startsWith("react-doctor/")) return null;
 	return detectInlineNearMiss(lines, diagnosticLineIndex, ruleId) ?? detectBlockNearMiss(lines, diagnosticLineIndex, ruleId);
 };
+const ESLINT_REACT_HOOKS_PLUGIN_PREFIX = "react-hooks/";
+const buildAcceptedTokens = (ruleId) => {
+	const shortRuleId = ruleId.slice(15);
+	return new Set([ruleId, `${ESLINT_REACT_HOOKS_PLUGIN_PREFIX}${shortRuleId}`]);
+};
+const listNamesRule = (ruleList, acceptedTokens) => tokenizeRuleList(ruleList).some((token) => acceptedTokens.has(token));
+const isInlineDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	const candidates = [{
+		line: lines[diagnosticLineIndex],
+		requiredScope: "line"
+	}, {
+		line: lines[diagnosticLineIndex - 1],
+		requiredScope: "next-line"
+	}];
+	for (const { line, requiredScope } of candidates) {
+		const match = line?.match(FOREIGN_INLINE_DISABLE_PATTERN);
+		if (!match) continue;
+		const [, , scope, ruleList] = match;
+		if (scope !== requiredScope) continue;
+		if (listNamesRule(ruleList, acceptedTokens)) return true;
+	}
+	return false;
+};
+const isBlockDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	let isRangeOpen = false;
+	const lastLineIndex = Math.min(diagnosticLineIndex, lines.length - 1);
+	for (let lineIndex = 0; lineIndex <= lastLineIndex; lineIndex++) {
+		const line = lines[lineIndex];
+		if (line === void 0 || !line.includes("-disable") && !line.includes("-enable")) continue;
+		const disableMatch = line.match(FOREIGN_BLOCK_DISABLE_PATTERN);
+		if (disableMatch && listNamesRule(disableMatch[2], acceptedTokens)) {
+			isRangeOpen = true;
+			continue;
+		}
+		const enableMatch = line.match(FOREIGN_BLOCK_ENABLE_PATTERN);
+		if (enableMatch) {
+			const enabledRules = tokenizeRuleList(enableMatch[1]);
+			if (enabledRules.length === 0 || enabledRules.some((rule) => acceptedTokens.has(rule))) isRangeOpen = false;
+		}
+	}
+	return isRangeOpen;
+};
+const isCompilerRuleForeignDisabled = (lines, diagnosticLineIndex, ruleId) => {
+	if (!ruleId.startsWith("react-hooks-js/")) return false;
+	const acceptedTokens = buildAcceptedTokens(ruleId);
+	return isInlineDisabled(lines, diagnosticLineIndex, acceptedTokens) || isBlockDisabled(lines, diagnosticLineIndex, acceptedTokens);
+};
 const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
 const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
 const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
@@ -34789,6 +34948,11 @@ const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
 		isSuppressed: true,
 		nearMissHint: null
 	};
+	if (isCompilerRuleForeignDisabled(lines, diagnosticLineIndex, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null,
+		isForeignDirective: true
+	};
 	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
 	if (hasChainSuppressor(directComments, ruleId)) return {
 		isSuppressed: true,
@@ -35074,12 +35238,18 @@ const collectStringSet = (values) => {
 	return new Set(values.filter((value) => typeof value === "string"));
 };
 const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
+const NODE_CLI_PATH_SEGMENTS = new Set([
+	"scripts",
+	"bin",
+	"tools"
+]);
+const hasNodeCliPathSegment = (filePath) => filePath.split(/[\\/]/).slice(0, -1).some((segment) => NODE_CLI_PATH_SEGMENTS.has(segment));
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
 *
 * 1. auto-suppress (test-noise rules in test files; `migration-hint`
-*    wins over `test-noise`)
+*    wins over `test-noise`; `no-console` on Node CLI scripts)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
 * 3. warning suppression (only when `showWarnings` is false: drops every
@@ -35177,6 +35347,12 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
+	const isNoConsoleOnNodeCliScript = (diagnostic) => {
+		if (diagnostic.rule !== "no-console") return false;
+		if (hasNodeCliPathSegment(diagnostic.filePath)) return true;
+		const lines = getFileLines(diagnostic.filePath);
+		return lines !== null && Boolean(lines[0]?.startsWith("#!"));
+	};
 	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
 		if (!hasRuntimeGlobals) return false;
 		if (diagnostic.rule !== "jsx-no-undef") return false;
@@ -35186,6 +35362,7 @@ const buildDiagnosticPipeline = (input) => {
 	return {
 		apply: (diagnostic) => {
 			if (shouldAutoSuppress(diagnostic)) return null;
+			if (isNoConsoleOnNodeCliScript(diagnostic)) return null;
 			let current = diagnostic;
 			let explicitSeverityOverride;
 			let explicitRuleOverride;
@@ -35215,7 +35392,7 @@ const buildDiagnosticPipeline = (input) => {
 				if (lines) {
 					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
 						...current,
 						suppressionHint: evaluation.nearMissHint
@@ -38564,7 +38741,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
 				command: "git",
-				args: ["show", `:${relativePath}`],
+				args: ["show", `:./${relativePath}`],
 				directory,
 				maxStdoutBytes: options?.maxBufferBytes
 			}).pipe(map$3((result) => result.status === 0 ? result.stdout : null)),
@@ -39347,9 +39524,17 @@ const buildNoSecretsRecommendation = (project, fallbackRecommendation) => {
 	return `Move secrets to server-only code. In ${formatFrameworkName(project.framework)}, only \`${publicEnvPrefix}\` env vars are exposed to the browser, and they must not contain secrets`;
 };
 const REANIMATED_SHARED_VALUE_HINT = "If this is a Reanimated shared value, prefer its React Compiler-compatible `.get()` / `.set()` accessors over `.value` — https://docs.swmansion.com/react-native-reanimated/docs/core/useSharedValue/#react-compiler-support";
+const ACCESSORS_MIN_VERSION = "3.15.0";
+const supportsAccessors = (reanimatedVersion) => {
+	if (reanimatedVersion === null) return true;
+	const lowerBound = import_semver.validRange(reanimatedVersion) !== null ? import_semver.minVersion(reanimatedVersion) : import_semver.coerce(reanimatedVersion);
+	if (lowerBound === null) return true;
+	return import_semver.gte(lowerBound, ACCESSORS_MIN_VERSION);
+};
 const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (rule !== "immutability") return help;
 	if (!project.hasReanimated) return help;
+	if (!supportsAccessors(project.reanimatedVersion)) return help;
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
@@ -39511,13 +39696,13 @@ const REACT_USE_BINDING_RESOLUTION = {
 	isReactUseBinding: true,
 	isReactNamespaceBinding: false
 };
-const getScriptKind = (filename) => {
+const getScriptKind$2 = (filename) => {
 	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
 	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
 	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
 	return ts.ScriptKind.JS;
 };
-const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const getUtf16Offset$1 = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
 const unwrapExpression = (expression) => {
 	let currentExpression = expression;
 	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression)) currentExpression = currentExpression.expression;
@@ -39766,8 +39951,8 @@ const findUseCallIdentifier = (sourceFile, useOffset) => {
 	return matchedIdentifier;
 };
 const resolveUseCallBinding = (sourceText, filename, utf8Offset) => {
-	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(filename));
-	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset(sourceText, utf8Offset));
+	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$2(filename));
+	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset$1(sourceText, utf8Offset));
 	if (!useIdentifier) return null;
 	return resolveIdentifierBinding(useIdentifier, collectReactImportBindings(sourceFile), sourceFile);
 };
@@ -39788,6 +39973,201 @@ const shouldSuppressLocalUseHookDiagnostic = (diagnostic, rootDirectory) => {
 	const bindingResolution = resolveUseCallBinding(sourceText, absolutePath, primaryLabel.span.offset);
 	return bindingResolution !== null && !bindingResolution.isReactUseBinding;
 };
+const SUPPRESSED_COMPILER_CODES = new Set(["react-hooks-js(immutability)", "react-hooks-js(refs)"]);
+const WORKLET_DIRECTIVE = "worklet";
+const WORKLET_ACCEPTING_CALLEES = new Set([
+	"useAnimatedStyle",
+	"useAnimatedProps",
+	"useDerivedValue",
+	"useAnimatedReaction",
+	"useAnimatedScrollHandler",
+	"useAnimatedGestureHandler",
+	"useFrameCallback",
+	"runOnUI",
+	"executeOnUIRuntimeSync"
+]);
+const GESTURE_ROOT_IDENTIFIER = "Gesture";
+const getScriptKind$1 = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const hasWorkletDirective = (node) => {
+	if (!ts.isFunctionDeclaration(node) && !ts.isFunctionExpression(node) && !ts.isArrowFunction(node) && !ts.isMethodDeclaration(node)) return false;
+	const body = node.body;
+	if (!body || !ts.isBlock(body)) return false;
+	for (const statement of body.statements) {
+		if (!ts.isExpressionStatement(statement)) return false;
+		if (!ts.isStringLiteral(statement.expression)) return false;
+		if (statement.expression.text === WORKLET_DIRECTIVE) return true;
+	}
+	return false;
+};
+const rootIdentifierOfCallChain = (expression) => {
+	let currentExpression = expression;
+	while (true) {
+		if (ts.isIdentifier(currentExpression)) return currentExpression.text;
+		if (ts.isPropertyAccessExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		if (ts.isCallExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		return null;
+	}
+};
+const isWorkletAcceptingCall = (callExpression) => {
+	const callee = callExpression.expression;
+	if (ts.isIdentifier(callee)) return WORKLET_ACCEPTING_CALLEES.has(callee.text);
+	if (ts.isPropertyAccessExpression(callee)) {
+		if (WORKLET_ACCEPTING_CALLEES.has(callee.name.text)) return true;
+		return rootIdentifierOfCallChain(callee) === GESTURE_ROOT_IDENTIFIER;
+	}
+	return false;
+};
+const isFunctionWorklet = (functionNode) => {
+	if (hasWorkletDirective(functionNode)) return true;
+	const parent = functionNode.parent;
+	return ts.isCallExpression(parent) && parent.arguments.some((argument) => argument === functionNode) && isWorkletAcceptingCall(parent);
+};
+const findNodeAtOffset = (sourceFile, targetOffset) => {
+	let matchedNode = null;
+	const visit = (node) => {
+		if (node.getStart(sourceFile) > targetOffset || node.getEnd() <= targetOffset) return;
+		matchedNode = node;
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return matchedNode;
+};
+const isOffsetInsideWorklet = (sourceFile, targetOffset) => {
+	let currentNode = findNodeAtOffset(sourceFile, targetOffset);
+	while (currentNode) {
+		if (ts.isFunctionLike(currentNode) && isFunctionWorklet(currentNode)) return true;
+		currentNode = currentNode.parent;
+	}
+	return false;
+};
+const shouldSuppressCompilerFindingInWorklet = (diagnostic, project, rootDirectory) => {
+	if (!SUPPRESSED_COMPILER_CODES.has(diagnostic.code)) return false;
+	if (!project.hasReanimated) return false;
+	const primaryLabel = diagnostic.labels[0];
+	if (!primaryLabel) return false;
+	const absolutePath = Path.isAbsolute(diagnostic.filename) ? diagnostic.filename : Path.join(rootDirectory, diagnostic.filename);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(absolutePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return isOffsetInsideWorklet(ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$1(absolutePath)), getUtf16Offset(sourceText, primaryLabel.span.offset));
+};
+const MANUAL_MEMOIZATION_PLUGIN = "react-doctor";
+const MANUAL_MEMOIZATION_RULE = "react-compiler-no-manual-memoization";
+const REACT_COMPILER_PLUGIN = "react-hooks-js";
+const getScriptKind = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const isManualMemoizationDiagnostic = (diagnostic) => diagnostic.plugin === MANUAL_MEMOIZATION_PLUGIN && diagnostic.rule === MANUAL_MEMOIZATION_RULE;
+const nodeLineRange = (sourceFile, node) => ({
+	startLine: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
+	endLine: sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1
+});
+const findOutermostEnclosingFunctionRange = (sourceFile, targetLine) => {
+	let foundRange = null;
+	const visit = (node) => {
+		if (foundRange) return;
+		if (ts.isFunctionLike(node)) {
+			const range = nodeLineRange(sourceFile, node);
+			if (range.startLine <= targetLine && targetLine <= range.endLine) foundRange = range;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return foundRange;
+};
+const NEWLINE_BYTE = 10;
+const lineOfUtf8Offset = (sourceBuffer, utf8Offset) => {
+	let lineNumber = 1;
+	const scanEnd = Math.min(utf8Offset, sourceBuffer.length);
+	for (let byteIndex = 0; byteIndex < scanEnd; byteIndex++) if (sourceBuffer[byteIndex] === NEWLINE_BYTE) lineNumber++;
+	return lineNumber;
+};
+/**
+* Drops `react-doctor/react-compiler-no-manual-memoization` diagnostics
+* whose enclosing function also carries a `react-hooks-js` (React
+* Compiler) diagnostic. Every react-hooks-js finding marks a function the
+* compiler could NOT compile (a bail-out / skip / preserve-manual-
+* memoization failure), so "React Compiler already caches every value
+* here" is false for that function and the manual memoization is
+* load-bearing, not dead weight.
+*
+* Matching is per enclosing function, not per file: a bailed-out
+* component must not silence redundant-memo findings in a sibling
+* component the compiler did optimize.
+*
+* Module-scope `memo(() => …)` wrappers have no enclosing function; for
+* those the memo call's own span is the containment range, so a bail-out
+* inside the inline-wrapped component still suppresses. Every failure
+* path (unreadable file, missing span) fails open and keeps the
+* diagnostic.
+*/
+const suppressMemoizationInBailedOutFunctions = (diagnostics, rootDirectory) => {
+	const compilerDiagnosticLinesByFile = /* @__PURE__ */ new Map();
+	let hasManualMemoizationDiagnostic = false;
+	for (const diagnostic of diagnostics) {
+		if (isManualMemoizationDiagnostic(diagnostic)) {
+			hasManualMemoizationDiagnostic = true;
+			continue;
+		}
+		if (diagnostic.plugin !== REACT_COMPILER_PLUGIN || diagnostic.line <= 0) continue;
+		const lines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (lines) lines.push(diagnostic.line);
+		else compilerDiagnosticLinesByFile.set(diagnostic.filePath, [diagnostic.line]);
+	}
+	if (!hasManualMemoizationDiagnostic || compilerDiagnosticLinesByFile.size === 0) return diagnostics;
+	const parsedFileCache = /* @__PURE__ */ new Map();
+	const readAndParse = (filePath) => {
+		const cached = parsedFileCache.get(filePath);
+		if (cached !== void 0) return cached;
+		const absolutePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory || ".", filePath);
+		let parsed;
+		try {
+			const buffer = NFS.readFileSync(absolutePath);
+			parsed = {
+				sourceFile: ts.createSourceFile(absolutePath, buffer.toString("utf8"), ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+				buffer
+			};
+		} catch {
+			parsed = null;
+		}
+		parsedFileCache.set(filePath, parsed);
+		return parsed;
+	};
+	const isInsideBailedOutFunction = (diagnostic) => {
+		const compilerLines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (!compilerLines || diagnostic.line <= 0) return false;
+		const parsed = readAndParse(diagnostic.filePath);
+		if (!parsed) return false;
+		let containmentRange = findOutermostEnclosingFunctionRange(parsed.sourceFile, diagnostic.line);
+		if (!containmentRange && diagnostic.offset !== void 0 && diagnostic.length !== void 0) containmentRange = {
+			startLine: diagnostic.line,
+			endLine: lineOfUtf8Offset(parsed.buffer, diagnostic.offset + diagnostic.length)
+		};
+		if (!containmentRange) return false;
+		const { startLine, endLine } = containmentRange;
+		return compilerLines.some((compilerLine) => startLine <= compilerLine && compilerLine <= endLine);
+	};
+	return diagnostics.filter((diagnostic) => !isManualMemoizationDiagnostic(diagnostic) || !isInsideBailedOutFunction(diagnostic));
+};
 const FILEPATH_WITH_LOCATION_PATTERN = /\S+\.\w+:\d+:\d+[\s\S]*$/;
 const LEADING_SEVERITY_LABEL_PATTERN = /^(?:Error|Warning):\s*/;
 const TRAILING_PERIOD_PATTERN = /\.$/;
@@ -39927,7 +40307,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		minifiedFileCache.set(absolutePath, minified);
 		return minified;
 	};
-	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
+	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -39954,7 +40334,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
-	});
+	}), rootDirectory);
 };
 const buildOxlintChildEnv = (sourceEnv) => {
 	const childEnv = {};
@@ -40465,6 +40845,7 @@ const runOxlint = async (options) => {
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
+	resetManifestCaches();
 	if (includePaths !== void 0 && includePaths.length === 0) return [];
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
@@ -41127,9 +41508,10 @@ const CONTEXT_AXES = [
 	}
 ];
 const SCORE_AXES = [...GATED_AXES, ...CONTEXT_AXES];
-const worstGatedAxis = (score) => {
-	let worst = GATED_AXES[0];
-	for (const axis of GATED_AXES) if (score[axis.key] < score[worst.key]) worst = axis;
+const gatedAxesForSection = (section) => section === "devDependencies" ? GATED_AXES.filter((axis) => axis.key !== "vulnerability") : GATED_AXES;
+const worstGatedAxis = (score, gatedAxes) => {
+	let worst = gatedAxes[0];
+	for (const axis of gatedAxes) if (score[axis.key] < score[worst.key]) worst = axis;
 	return worst;
 };
 const clampScore = (value) => {
@@ -41153,6 +41535,69 @@ const resolveConcreteVersion = (spec) => {
 	if (range === null || range === "*") return null;
 	return import_semver.minVersion(trimmed)?.version ?? null;
 };
+const readTextFileOrNull = (filePath) => {
+	try {
+		return NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return null;
+	}
+};
+const buildNpmLockLookup = (lockText) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(lockText);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null) return null;
+	const lock = parsed;
+	return (name) => {
+		const entry = lock.packages?.[`node_modules/${name}`] ?? lock.dependencies?.[name];
+		return typeof entry?.version === "string" ? entry.version : null;
+	};
+};
+const buildYarnLockLookup = (lockText) => {
+	const lines = lockText.split(/\r?\n/);
+	return (name, spec) => {
+		const descriptor = `${name}@${spec}`;
+		const berryDescriptor = `${name}@npm:${spec}`;
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			const line = lines[lineIndex];
+			if (line.startsWith(" ") || line.startsWith("#") || !line.includes(":")) continue;
+			const descriptors = line.replace(/:\s*$/, "").split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
+			if (!descriptors.includes(descriptor) && !descriptors.includes(berryDescriptor)) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && (lines[bodyIndex].startsWith(" ") || lines[bodyIndex] === ""); bodyIndex += 1) {
+				const versionMatch = /^\s+version:?\s+"?([^"\s]+)"?/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+			return null;
+		}
+		return null;
+	};
+};
+const buildPnpmLockLookup = (lockText) => {
+	return (name) => {
+		const entryPattern = new RegExp(`^ {4,8}['"]?${name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}['"]?:\\s*$`);
+		const lines = lockText.split(/\r?\n/);
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			if (!entryPattern.test(lines[lineIndex])) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && /^ {5,}\S/.test(lines[bodyIndex]); bodyIndex += 1) {
+				const versionMatch = /^\s+version:\s+['"]?([^'"\s(]+)/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+		}
+		return null;
+	};
+};
+const buildLockedVersionLookup = (rootDirectory) => {
+	const npmLockText = readTextFileOrNull(Path.join(rootDirectory, "package-lock.json"));
+	if (npmLockText !== null) return buildNpmLockLookup(npmLockText);
+	const yarnLockText = readTextFileOrNull(Path.join(rootDirectory, "yarn.lock"));
+	if (yarnLockText !== null) return buildYarnLockLookup(yarnLockText);
+	const pnpmLockText = readTextFileOrNull(Path.join(rootDirectory, "pnpm-lock.yaml"));
+	if (pnpmLockText !== null) return buildPnpmLockLookup(pnpmLockText);
+	return null;
+};
 const locateDependencyKey = (packageJsonText, section, name) => {
 	const needle = `"${name}"`;
 	const sectionHeader = new RegExp(`"${section}"\\s*:\\s*\\{`);
@@ -41179,7 +41624,7 @@ const locateDependencyKey = (packageJsonText, section, name) => {
 	}
 	return null;
 };
-const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies) => {
+const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies, lockedVersionLookup) => {
 	const sectionByName = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(packageJson.dependencies ?? {})) sectionByName.set(name, "dependencies");
 	if (includeDevDependencies) {
@@ -41189,13 +41634,18 @@ const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDepe
 	for (const [name, section] of sectionByName) {
 		if (SUPPLY_CHAIN_IGNORED_PACKAGES.has(name)) continue;
 		const spec = (packageJson[section] ?? {})[name] ?? "";
-		const version = resolveConcreteVersion(spec);
-		if (version === null) continue;
+		const floorVersion = resolveConcreteVersion(spec);
+		if (floorVersion === null) continue;
+		const lockedVersion = lockedVersionLookup?.(name, spec) ?? null;
+		const lockSatisfiesSpec = lockedVersion !== null && import_semver.valid(lockedVersion) !== null && import_semver.satisfies(lockedVersion, spec);
+		const isExactPin = import_semver.valid(spec.trim()) !== null;
 		const location = locateDependencyKey(packageJsonText, section, name);
 		dependencies.push({
 			name,
-			version,
+			version: lockSatisfiesSpec ? lockedVersion : floorVersion,
 			spec,
+			section,
+			resolution: isExactPin ? "pin" : lockSatisfiesSpec ? "locked" : "floor",
 			line: location?.line ?? 0,
 			column: location?.column ?? 0
 		});
@@ -41346,7 +41796,11 @@ const formatAlertReason = (topAlerts, totalCount) => {
 	}
 	return `Socket flagged ${totalCount} alerts (${topAlerts.map((alert) => friendlyAlertType(alert.type)).join(", ")}${totalCount > topAlerts.length ? ` (+${totalCount - topAlerts.length} more)` : ""}); most severe: ${displaySeverity(topAlerts[0].severity)}.`;
 };
-const formatDependencyIdentity = (dependency) => import_semver.valid(dependency.spec) !== null ? `${dependency.name}@${dependency.version}` : `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+const formatDependencyIdentity = (dependency) => {
+	if (dependency.resolution === "pin") return `${dependency.name}@${dependency.version}`;
+	if (dependency.resolution === "locked") return `${dependency.name}@${dependency.version} (lockfile resolution of "${dependency.spec}")`;
+	return `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+};
 const buildSupplyChainHelp = (dependency, failingAxis, topAlerts, packagePageUrl, options) => {
 	const hasCriticalAlert = topAlerts.some((alert) => alert.severity.toLowerCase() === "critical");
 	const entry = `\`"${dependency.name}": "${dependency.spec}"\``;
@@ -41389,7 +41843,7 @@ const buildLowScoreDiagnostic = (dependency, artifact, failingAxis, options) =>
 const checkSupplyChain = (input) => gen(function* () {
 	const options = resolveOptions(input.userConfig);
 	const packageJsonPath = Path.join(input.rootDirectory, "package.json");
-	const dependencies = collectDependenciesToScore(readPackageJson(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies);
+	const dependencies = collectDependenciesToScore(readPackageJson(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies, buildLockedVersionLookup(input.rootDirectory));
 	if (dependencies.length === 0) return [];
 	const cacheDirectory = isSupplyChainCacheDisabled() ? null : resolveReactDoctorCacheDir(input.rootDirectory);
 	if (cacheDirectory !== null) pruneExpiredSocketCache(cacheDirectory);
@@ -41398,7 +41852,7 @@ const checkSupplyChain = (input) => gen(function* () {
 	for (let index = 0; index < dependencies.length; index += 1) {
 		const artifact = artifacts[index];
 		if (!artifact) continue;
-		const worstAxis = worstGatedAxis(artifact.score);
+		const worstAxis = worstGatedAxis(artifact.score, gatedAxesForSection(dependencies[index].section));
 		if (toHundred(artifact.score[worstAxis.key]) >= options.minScore) continue;
 		diagnostics.push(buildLowScoreDiagnostic(dependencies[index], artifact, worstAxis, options));
 	}
@@ -42441,4 +42895,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, hasReactRuntime, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=7cb857ba-6f0a-57d9-91f3-3c286472121d
+//# debugId=10e3e1b0-f291-5306-b5fd-79b158b00159