codelaw-rules-deps 0.4.2__py3-none-any.whl

codelaw_rules_deps/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Arpit Arya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+SPDX-License-Identifier: MIT

codelaw_rules_deps/NOTICE

@@ -0,0 +1,9 @@
+@codelaw/rules-deps / codelaw-rules-deps
+
+The rules and their documentation were written for codelaw. The pack holds no
+advisory data: `codelaw deps refresh` writes the consumer's own
+`.codelaw/deps-snapshot.json`, which keeps, of each advisory, only its ids and
+aliases, its affected ranges and fixed versions, its severity, its URL and the
+sources that reported it — never an advisory's text. Advisory data from OSV and
+the GitHub Advisory Database is licensed CC-BY 4.0 by its publishers; the
+snapshot's `sources` names where each record came from.

codelaw_rules_deps/README.md

@@ -0,0 +1,64 @@
+# @codelaw/rules-deps
+
+codelaw's dependency rules — one of the first-party rule packs
+([SR-RULE-PACKS](../../records/0101_rule-packs.md) decision 15), on npm and
+PyPI (`codelaw-rules-deps`). It tells you, and your coding agent, which npm
+and Python dependencies are vulnerable and the exact version to move to, and
+which are behind their latest release.
+
+`codelaw init` adds it when the repo has a `package.json` or `pyproject.toml`.
+
+```toml
+# codelaw.toml
+extends = ["codelaw:deps/recommended"]
+preview = true   # every rule is `preview` until a corpus run promotes it
+```
+
+```sh
+npm i -D @codelaw/rules-deps      # or
+pip install codelaw-rules-deps
+codelaw deps refresh              # the one command that reads the network
+```
+
+## Presets
+
+<!-- docs-sync:presets -->
+
+| preset | rules | what it holds |
+|---|---|---|
+| `deps/recommended` | 4 | Vulnerable and outdated dependencies of package.json and pyproject.toml, from the committed snapshot `codelaw deps refresh` writes |
+
+<!-- /docs-sync:presets -->
+
+## Rules
+
+
+
+| rule | fix | what it reports |
+|---|---|---|
+| `deps/vulnerable` | suggest (manual with no clean version) | a version in use, direct or transitive, that an advisory affects, with the lowest known-clean version to move to |
+| `deps/incomplete-scan` | manual | an enabled advisory source the last refresh could not read |
+| `deps/outdated` | suggest | a dependency behind its latest version, or a deprecated or yanked one (was `data/outdated-dependency`) |
+| `deps/stale-snapshot` | manual | a snapshot older than `[deps] max_snapshot_age`, or one that cannot be read (was `data/stale-deps-snapshot`) |
+
+
+
+## How it works
+
+The rules read `.codelaw/deps-snapshot.json`, which `codelaw deps refresh`
+writes and the project commits, and the lockfiles — never the network, so
+`codelaw check` gives the same answer offline and in CI.
+
+- **Advisory sources** are `[deps] advisory_sources`, each on or off:
+  `registry` (the npm registry and Python index you already install from)
+  first, then `osv` (`https://api.osv.dev`), or a mirror of either. Every
+  enabled source is read and merged — the safer answer wins. A source that
+  cannot be read is recorded, and `deps/incomplete-scan` says so.
+- **The version to move to** is the lowest version every advisory leaves
+  clean and some source actually covered, inside the major in use first.
+- **Agents** ask `check_dependency` (MCP) or `codelaw deps check` before
+  adding a package; `[deps] agent` sets, per severity, whether the hooks
+  only inform or also block.
+
+The pack holds no advisory data: the snapshot keeps ids, ranges, versions, a
+severity, a URL and the sources' names — never an advisory's text.

codelaw_rules_deps/codelaw-pack.toml

@@ -0,0 +1,6 @@
+name = "@codelaw/rules-deps"
+version = "0.4.2"
+min_codelaw = "0.4.0"
+languages = ["json", "yaml", "toml"]
+presets = ["deps/recommended"]
+description = "codelaw's dependency rules: vulnerable packages and the version to move to, latest versions, the snapshot they read (SR-RULE-PACKS)"

codelaw_rules_deps/corpus.toml

@@ -0,0 +1,8 @@
+# `codelaw test --corpus` finding counts (SR-RULE-AUTHORING decision 4).
+# Rewrite with --update-snapshot, and review the change.
+
+[findings]
+"deps/incomplete-scan" = 0
+"deps/outdated" = 0
+"deps/stale-snapshot" = 0
+"deps/vulnerable" = 0

codelaw_rules_deps/presets/deps/recommended.toml

@@ -0,0 +1,7 @@
+description = "Vulnerable and outdated dependencies of package.json and pyproject.toml, from the committed snapshot `codelaw deps refresh` writes"
+
+[rules]
+"deps/incomplete-scan" = "warn"
+"deps/outdated" = "warn"
+"deps/stale-snapshot" = "info"
+"deps/vulnerable" = "error"

codelaw_rules_deps/rules/deps/incomplete-scan.md

@@ -0,0 +1,94 @@
+---
+id: deps/incomplete-scan
+title: "Every advisory source was read"
+languages: [json, toml]
+files: ["package.json", "pyproject.toml"]
+severity: warn
+fix: manual
+fix_reason: "reading an advisory source again needs the network, which the engine never uses (L5); turning a source off is the team's decision"
+stability: preview
+since: 0.5.0
+---
+
+`.codelaw/deps-snapshot.json` records how each advisory source of `[deps] advisory_sources` answered the last `codelaw deps refresh`. While a source that is still enabled was `unavailable` — refused by a proxy, down, or a mirror that does not pass the audit endpoint through — the vulnerabilities only it knows are not reported, and this rule says so: one finding per project, naming each such source, its day and its error, on the root `package.json` (else the root `pyproject.toml`). A snapshot that holds packages but no source at all — written before the advisory sources, or with every source turned off — is reported too.
+
+**Why:** A clean `deps/vulnerable` result means "no source we read knows of one"; when a source was not read, a clean result says less than it seems to.
+
+```codelaw
+native: deps/incomplete-scan
+```
+
+## How to fix
+
+1. Run `codelaw deps refresh` once the source is reachable, and commit the snapshot.
+2. If the organisation will never allow that source, set `enabled = false` on it in `[deps] advisory_sources`, so the scan is complete as configured.
+
+## Examples
+
+### JSON
+
+#### Don't
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {},
+  "sources": {
+    "osv": { "kind": "osv", "state": "unavailable", "on": "2026-10-29", "error": "https://api.osv.dev/v1/query answered HTTP 403" },
+    "registry": { "kind": "registry", "state": "ok", "on": "2026-10-29" }
+  }
+}
+// package.json
+{
+  "name": "app"
+}
+```
+
+#### Do
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {},
+  "sources": {
+    "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" },
+    "registry": { "kind": "registry", "state": "ok", "on": "2026-10-29" }
+  }
+}
+// package.json
+{
+  "name": "app"
+}
+```
+
+### TOML
+
+#### Don't
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {},
+  "sources": { "osv": { "kind": "osv", "state": "unavailable", "on": "2026-10-29", "error": "HTTP 403" } }
+}
+# pyproject.toml
+[project]
+name = "app"
+```
+
+#### Do
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {},
+  "sources": { "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" } }
+}
+# pyproject.toml
+[project]
+name = "app"
+```

codelaw_rules_deps/rules/deps/outdated.md

@@ -0,0 +1,112 @@
+---
+id: deps/outdated
+title: "Dependencies are on their latest version"
+languages: [json, toml]
+files: ["**/package.json", "**/pyproject.toml"]
+fix: suggest
+fix_reason: "a new major or minor version can change behaviour; the fix moves the range to the latest version, and the code that uses the package may need changes"
+stability: preview
+since: 0.3.0
+---
+
+Each dependency of a `package.json` (`dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`) and of a `pyproject.toml` (`[project] dependencies`, `[project.optional-dependencies]`, `[dependency-groups]`) is compared with `.codelaw/deps-snapshot.json`, the registry facts `codelaw deps refresh` wrote. The rule reads only that file and the lockfiles; it never reads a registry, so `check` gives the same answer offline. With no snapshot, nothing is reported.
+
+The version in use is the lockfile's (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `uv.lock` or `poetry.lock`, beside the manifest or above it), else the one the range starts from. The latest is the highest stable version in the snapshot — by semver for npm, PEP 440 for Python — that is not deprecated or yanked and is at least `[deps] min_release_age` old on the snapshot's `fetched` date.
+
+Each finding is graded, and `[deps] severity` sets each grade's severity (or `off`):
+
+| finding | default |
+|---|---|
+| a major version behind | `warn` |
+| a minor or patch version behind | `info` |
+| the version in use is deprecated (npm) or yanked (PyPI) | `error` |
+| the range already allows the latest, but the lockfile is behind | `info` |
+
+The fix moves the range's version to the latest and keeps its operator: `^`, `~`, `>=`, `=` or none for npm; `==`, `>=` or `~=` for Python, at the precision written (`~=4.2` becomes `~=5.1`). A range the fix can't move without changing its meaning — `||`, a hyphen, `x`, an upper bound the latest is outside — is reported without a fix. `[deps] ignore` names packages never reported.
+
+**Why:** A dependency left behind stops getting fixes and security patches, and the jump grows with every release; a deprecated or yanked version was withdrawn by its own maintainers.
+
+```codelaw
+native: deps/outdated
+```
+
+## How to fix
+
+1. Run `codelaw fix --unsafe` to move the range to the latest version, or edit the version by hand.
+2. Run your package manager's install (`npm install`, `uv lock`, …) so the lockfile follows.
+3. For a major version, read the package's changelog and update the code that uses it.
+4. If the project must stay on this version, add the package to `[deps] ignore`, with an `expires` date when the stay is temporary.
+
+## Examples
+
+### JSON
+
+#### Don't
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-25",
+  "packages": {
+    "npm:react": { "latest": "19.2.0", "versions": { "18.3.1": "2024-04-26", "19.2.0": "2025-10-01" } }
+  }
+}
+// package.json
+{
+  "dependencies": {
+    "react": "^18.3.1"
+  }
+}
+```
+
+#### Do
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-25",
+  "packages": {
+    "npm:react": { "latest": "19.2.0", "versions": { "18.3.1": "2024-04-26", "19.2.0": "2025-10-01" } }
+  }
+}
+// package.json
+{
+  "dependencies": {
+    "react": "^19.2.0"
+  }
+}
+```
+
+### TOML
+
+#### Don't
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-25",
+  "packages": {
+    "pypi:django": { "latest": "5.1.2", "versions": { "4.2.0": "2023-04-03", "5.1.2": "2024-10-08" } }
+  }
+}
+# pyproject.toml
+[project]
+name = "app"
+dependencies = ["django~=4.2"]
+```
+
+#### Do
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-25",
+  "packages": {
+    "pypi:django": { "latest": "5.1.2", "versions": { "4.2.0": "2023-04-03", "5.1.2": "2024-10-08" } }
+  }
+}
+# pyproject.toml
+[project]
+name = "app"
+dependencies = ["django~=5.1"]
+```

codelaw_rules_deps/rules/deps/stale-snapshot.md

@@ -0,0 +1,72 @@
+---
+id: deps/stale-snapshot
+title: "The dependency snapshot is recent"
+languages: [json, toml]
+files: ["package.json", "pyproject.toml"]
+severity: info
+fix: manual
+fix_reason: "refreshing the snapshot reads the registries, which needs the network; the engine never uses it (L5)"
+stability: preview
+since: 0.3.0
+---
+
+`.codelaw/deps-snapshot.json` — the registry facts `deps/outdated` reads — was fetched no more than `[deps] max_snapshot_age` (14 days by default) before the as-of date, and can be read. The finding is on the root `package.json`, or the root `pyproject.toml` when there is no root `package.json`, so a project gets one. The age is judged on the as-of date (`--as-of`, `CODELAW_AS_OF`, else `HEAD`'s commit date), never the clock; with no as-of date, only an unreadable snapshot is reported.
+
+**Why:** An old snapshot hides every release since it was written, so `deps/outdated` says a dependency is current when it isn't.
+
+```codelaw
+native: deps/stale-snapshot
+```
+
+## How to fix
+
+1. Run `codelaw deps refresh`: it reads npm and the Python index and writes the snapshot again.
+2. Commit `.codelaw/deps-snapshot.json`, so CI and every teammate judge by the same facts.
+
+## Examples
+
+### JSON
+
+#### Don't
+
+```json
+// .codelaw/deps-snapshot.json
+{ "fetched": "2026-10-25", "packages": [ }
+// package.json
+{
+  "name": "app"
+}
+```
+
+#### Do
+
+```json
+// .codelaw/deps-snapshot.json
+{ "fetched": "2026-10-25", "packages": {} }
+// package.json
+{
+  "name": "app"
+}
+```
+
+### TOML
+
+#### Don't
+
+```toml
+# .codelaw/deps-snapshot.json
+{ "fetched": "2026-10-25", "packages": [ }
+# pyproject.toml
+[project]
+name = "app"
+```
+
+#### Do
+
+```toml
+# .codelaw/deps-snapshot.json
+{ "fetched": "2026-10-25", "packages": {} }
+# pyproject.toml
+[project]
+name = "app"
+```

codelaw_rules_deps/rules/deps/vulnerable.md

@@ -0,0 +1,140 @@
+---
+id: deps/vulnerable
+title: "No dependency in use has a known vulnerability"
+languages: [json, toml]
+files: ["**/package.json", "**/pyproject.toml"]
+fix: suggest
+fix_reason: "the fix moves a range or adds an override to the lowest known-clean version, which changes what installs; a new major can change behaviour, and an override changes the install of the whole tree"
+stability: preview
+since: 0.5.0
+---
+
+Every version a project installs — each dependency of a `package.json` or `pyproject.toml`, and every package its lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `uv.lock`, `poetry.lock`) installs through them — is compared with the advisories in `.codelaw/deps-snapshot.json`, which `codelaw deps refresh` wrote from the enabled `[deps] advisory_sources`. The rule reads only that file and the lockfiles; it never reads the network, so `check` gives the same answer offline. With no snapshot, or one that holds no advisories, nothing is reported (`deps/incomplete-scan` says why).
+
+The finding names the worst advisory, its severity and CVE, how many more there are, and the version to move to: the **lowest known-clean** version above the one in use — a version no merged advisory affects and an advisory source covered — that is not deprecated or yanked and is at least `[deps] min_release_age` old, **inside the major in use first**. When the major has none, the lowest clean version above it is offered and the message says it is a new major. A fixed version no source covered is named but never offered ("not verified clean"); with no fixed version at all, the fix is manual.
+
+Each finding is graded by its worst advisory, and `[deps] severity` sets each grade's severity (or `off`):
+
+| advisory severity | default |
+|---|---|
+| `critical`, `high` | `error` |
+| `moderate` | `warn` |
+| `low` | `info` |
+
+An advisory no source grades counts as `high`.
+
+Where it is reported, and the fix:
+
+- **A direct dependency:** on its line in the manifest; the fix moves the range's version to the target and keeps its operator (`^`, `~`, `>=`, `=` or none; `==`, `>=` or `~=`).
+- **A transitive one:** on the first line of the manifest beside the lockfile — where the override that fixes it is written — and the fix adds that override at the exact target: npm `overrides`, `pnpm.overrides`, yarn `resolutions`, uv's `[tool.uv] override-dependencies`. A lockfile is never edited. An override already in the manifest is the version the next install takes: a clean one settles the finding, a vulnerable one is reported with the version to change it to. A yarn classic finding has a copy on its `yarn.lock` entry.
+- **In `poetry.lock`:** Poetry has no override, so the message says to add a direct constraint.
+
+Every message ends with the install to run (`npm install`, `uv lock`, …) and the snapshot's day, and says `incomplete` while an enabled source was unavailable. `[deps] ignore` takes a package, or `{ package, advisory, expires, added_by, reason }` for one advisory until a date.
+
+**Why:** A vulnerable version stays exploitable until someone moves it, and the version that fixes one advisory can carry another; the lowest version every source leaves clean is the smallest safe change.
+
+```codelaw
+native: deps/vulnerable
+```
+
+## How to fix
+
+1. Run `codelaw fix --unsafe` to move the range (or add the override) to the version named, or make the same edit by hand.
+2. Run the install the message names (`npm install`, `pnpm install`, `yarn install`, `uv lock`, `poetry lock`) so the lockfile follows; codelaw never runs installers.
+3. For a new major, read the package's changelog and update the code that uses it.
+4. With no clean version: replace the package, remove it, or add a dated `[deps] ignore` entry naming the advisory, with a reason.
+
+## Examples
+
+### JSON
+
+#### Don't
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {
+    "npm:lodash": {
+      "versions": { "4.17.15": "2019-07-19", "4.17.21": "2021-02-20" },
+      "advisories": [ { "id": "GHSA-35jh-r3h4-6jhm", "aliases": ["CVE-2021-23337"], "severity": "high", "affected": ["<4.17.21"], "fixed": ["4.17.21"], "sources": ["osv"] } ],
+      "scanned": { "osv": ["*"] }
+    }
+  },
+  "sources": { "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" } }
+}
+// package.json
+{
+  "dependencies": {
+    "lodash": "^4.17.15"
+  }
+}
+```
+
+#### Do
+
+```json
+// .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {
+    "npm:lodash": {
+      "versions": { "4.17.15": "2019-07-19", "4.17.21": "2021-02-20" },
+      "advisories": [ { "id": "GHSA-35jh-r3h4-6jhm", "aliases": ["CVE-2021-23337"], "severity": "high", "affected": ["<4.17.21"], "fixed": ["4.17.21"], "sources": ["osv"] } ],
+      "scanned": { "osv": ["*"] }
+    }
+  },
+  "sources": { "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" } }
+}
+// package.json
+{
+  "dependencies": {
+    "lodash": "^4.17.21"
+  }
+}
+```
+
+### TOML
+
+#### Don't
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {
+    "pypi:jinja2": {
+      "versions": { "3.1.2": "2022-04-28", "3.1.3": "2024-01-10" },
+      "advisories": [ { "id": "GHSA-h5c8-rqwp-cp95", "severity": "moderate", "affected": ["<3.1.3"], "fixed": ["3.1.3"], "sources": ["osv"] } ],
+      "scanned": { "osv": ["*"] }
+    }
+  },
+  "sources": { "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" } }
+}
+# pyproject.toml
+[project]
+name = "app"
+dependencies = ["jinja2>=3.1.2"]
+```
+
+#### Do
+
+```toml
+# .codelaw/deps-snapshot.json
+{
+  "fetched": "2026-10-29",
+  "packages": {
+    "pypi:jinja2": {
+      "versions": { "3.1.2": "2022-04-28", "3.1.3": "2024-01-10" },
+      "advisories": [ { "id": "GHSA-h5c8-rqwp-cp95", "severity": "moderate", "affected": ["<3.1.3"], "fixed": ["3.1.3"], "sources": ["osv"] } ],
+      "scanned": { "osv": ["*"] }
+    }
+  },
+  "sources": { "osv": { "kind": "osv", "state": "ok", "on": "2026-10-29" } }
+}
+# pyproject.toml
+[project]
+name = "app"
+dependencies = ["jinja2>=3.1.3"]
+```
+

codelaw_rules_deps-0.4.2.dist-info/METADATA

@@ -0,0 +1,74 @@
+Metadata-Version: 2.4
+Name: codelaw-rules-deps
+Version: 0.4.2
+Summary: codelaw's dependency rules: vulnerable packages and the version to move to, latest versions, the snapshot they read (SR-RULE-PACKS)
+License-Expression: MIT
+License-File: LICENSE
+Project-URL: Repository, https://github.com/arpitarya/codelaw
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# @codelaw/rules-deps
+
+codelaw's dependency rules — one of the first-party rule packs
+([SR-RULE-PACKS](../../records/0101_rule-packs.md) decision 15), on npm and
+PyPI (`codelaw-rules-deps`). It tells you, and your coding agent, which npm
+and Python dependencies are vulnerable and the exact version to move to, and
+which are behind their latest release.
+
+`codelaw init` adds it when the repo has a `package.json` or `pyproject.toml`.
+
+```toml
+# codelaw.toml
+extends = ["codelaw:deps/recommended"]
+preview = true   # every rule is `preview` until a corpus run promotes it
+```
+
+```sh
+npm i -D @codelaw/rules-deps      # or
+pip install codelaw-rules-deps
+codelaw deps refresh              # the one command that reads the network
+```
+
+## Presets
+
+<!-- docs-sync:presets -->
+
+| preset | rules | what it holds |
+|---|---|---|
+| `deps/recommended` | 4 | Vulnerable and outdated dependencies of package.json and pyproject.toml, from the committed snapshot `codelaw deps refresh` writes |
+
+<!-- /docs-sync:presets -->
+
+## Rules
+
+
+
+| rule | fix | what it reports |
+|---|---|---|
+| `deps/vulnerable` | suggest (manual with no clean version) | a version in use, direct or transitive, that an advisory affects, with the lowest known-clean version to move to |
+| `deps/incomplete-scan` | manual | an enabled advisory source the last refresh could not read |
+| `deps/outdated` | suggest | a dependency behind its latest version, or a deprecated or yanked one (was `data/outdated-dependency`) |
+| `deps/stale-snapshot` | manual | a snapshot older than `[deps] max_snapshot_age`, or one that cannot be read (was `data/stale-deps-snapshot`) |
+
+
+
+## How it works
+
+The rules read `.codelaw/deps-snapshot.json`, which `codelaw deps refresh`
+writes and the project commits, and the lockfiles — never the network, so
+`codelaw check` gives the same answer offline and in CI.
+
+- **Advisory sources** are `[deps] advisory_sources`, each on or off:
+  `registry` (the npm registry and Python index you already install from)
+  first, then `osv` (`https://api.osv.dev`), or a mirror of either. Every
+  enabled source is read and merged — the safer answer wins. A source that
+  cannot be read is recorded, and `deps/incomplete-scan` says so.
+- **The version to move to** is the lowest version every advisory leaves
+  clean and some source actually covered, inside the major in use first.
+- **Agents** ask `check_dependency` (MCP) or `codelaw deps check` before
+  adding a package; `[deps] agent` sets, per severity, whether the hooks
+  only inform or also block.
+
+The pack holds no advisory data: the snapshot keeps ids, ranges, versions, a
+severity, a URL and the sources' names — never an advisory's text.

codelaw_rules_deps-0.4.2.dist-info/RECORD

@@ -0,0 +1,14 @@
+codelaw_rules_deps/LICENSE,sha256=_R8NFLyGiKUo7mPzbUGbqg3hdEKYhaTsIgBGXqtFfa8,1097
+codelaw_rules_deps/NOTICE,sha256=up80-gF4yoOW-dq9YbF8ZKWRl4dwRe7cOpGqnA5YsTk,554
+codelaw_rules_deps/README.md,sha256=5o_x0O6JshrBNwOmSaD3idG92-3a8UzyhmsfOEHl5IM,2686
+codelaw_rules_deps/codelaw-pack.toml,sha256=12rT1gBEC8cHdCZc04QTNbKMKM7tavCRm1fxpBQpzsk,285
+codelaw_rules_deps/corpus.toml,sha256=kmwZ7alsRvvMx7wPamEupJKsnD1nVooO1XzwYanOGR8,237
+codelaw_rules_deps/presets/deps/recommended.toml,sha256=ZaBUabTWQpRUeZnaInI7F9vxsTkNrTFpsBptoYVM5EA,272
+codelaw_rules_deps/rules/deps/incomplete-scan.md,sha256=_RXsYzN4YlmzuQlnus58ds80iDrAa0X0naA5cstHrQ4,2594
+codelaw_rules_deps/rules/deps/outdated.md,sha256=foCpPwk0tFdX57mOCADONkVr1hoFmN8-PRSRrOMTBqk,3775
+codelaw_rules_deps/rules/deps/stale-snapshot.md,sha256=zHho8ro3Hj7CkLVosa2-XR9AezxAjt2LLKlhA0mqtR4,1764
+codelaw_rules_deps/rules/deps/vulnerable.md,sha256=rkbKpvD_z_Envz87oNC3P2I713aj9_-3B8o7YkWMA4M,5997
+codelaw_rules_deps-0.4.2.dist-info/METADATA,sha256=cl0cCxsFrlHOwriry3fxrJ7IXBvvr9lLQtLsMpfbytA,3062
+codelaw_rules_deps-0.4.2.dist-info/WHEEL,sha256=iL940CG79gUG1gJG0fuOXtdNe75u1bVsFzkAeObStpM,97
+codelaw_rules_deps-0.4.2.dist-info/licenses/LICENSE,sha256=_R8NFLyGiKUo7mPzbUGbqg3hdEKYhaTsIgBGXqtFfa8,1097
+codelaw_rules_deps-0.4.2.dist-info/RECORD,,

codelaw_rules_deps-0.4.2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: codelaw scripts/package.py
+Root-Is-Purelib: true
+Tag: py3-none-any

codelaw_rules_deps-0.4.2.dist-info/licenses/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Arpit Arya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+SPDX-License-Identifier: MIT