depwake 0.3.1__py3-none-any.whl

depwake/__init__.py

@@ -0,0 +1,3 @@
+"""Depwake: wake your sleeping dependencies. Stdlib only."""
+
+__version__ = "0.3.1"

depwake/__main__.py

@@ -0,0 +1,13 @@
+"""Entry point. Works as `python -m depwake` AND as `python path/to/__main__.py`."""
+
+try:
+    from .cli import main
+except ImportError:  # pragma: no cover - path-invoked fallback
+    import os
+    import sys
+
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from depwake.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

depwake/apply.py

@@ -0,0 +1,124 @@
+"""Safe auto-bumps: patch (default) and optionally minor. Never major.
+
+Rules, in order:
+1. Only items whose risk is included AND whose current version is exact
+   (lockfile or == pin). Range floors are assumptions — listed, not touched.
+2. package.json: keep the range prefix, replace the version triple
+   (^4.17.0 -> ^4.17.21). requirements/pyproject: only == pins.
+3. Numbered .bak backups, never clobbered. --dry-run changes nothing.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from .plan import Plan
+
+TRIPLE = re.compile(r"\d+\.\d+\.\d+[^,\s|]*")
+
+
+@dataclass
+class ApplyResult:
+    changed: list[str] = field(default_factory=list)   # "file: name old -> new"
+    skipped: list[str] = field(default_factory=list)   # "name: reason"
+    backups: list[str] = field(default_factory=list)
+
+
+def _backup(path: Path) -> Path:
+    dest = path.with_suffix(path.suffix + ".bak")
+    i = 1
+    while dest.exists():
+        dest = Path(f"{path}.bak.{i}")
+        i += 1
+    dest.write_bytes(path.read_bytes())
+    return dest
+
+
+def _bump_npm_range(rng: str, latest: str) -> str | None:
+    if not TRIPLE.search(rng):
+        return None
+    return TRIPLE.sub(latest, rng, count=1)
+
+
+def apply_plan(root: str | Path, plan: Plan, include: set[str] | None = None,
+               dry_run: bool = False) -> ApplyResult:
+    include = include or {"patch"}
+    root = Path(root)
+    res = ApplyResult()
+    eligible = [i for i in plan.items
+                if i.risk in include
+                and i.latest
+                and i.dep.current_source in ("lock", "pin")]
+    for item in plan.items:
+        if item not in eligible:
+            if item.risk in ("major",):
+                n = len(item.advisories)
+                extra = f" — ⚠ {n} open advisor{'y' if n == 1 else 'ies'}, plan it soon" if n else ""
+                res.skipped.append(f"{item.dep.name}: major — upgrade deliberately, never auto-bumped{extra}")
+            elif item.risk == "unknown":
+                res.skipped.append(f"{item.dep.name}: unknown version — resolve first ({item.note})")
+            elif item.risk in include:
+                res.skipped.append(f"{item.dep.name}: current is a range floor, not exact — add a lockfile")
+            continue
+    by_file: dict[Path, list] = {}
+    for item in eligible:
+        if item.dep.ecosystem == "npm":
+            by_file.setdefault(root / "package.json", []).append(item)
+        else:
+            req = root / "requirements.txt"
+            proj = root / "pyproject.toml"
+            by_file.setdefault(req if req.exists() else proj, []).append(item)
+    for path, items in by_file.items():
+        if not path.exists():
+            for item in items:
+                res.skipped.append(f"{item.dep.name}: {path.name} not found")
+            continue
+        if not dry_run:
+            res.backups.append(str(_backup(path)))
+        text = path.read_text(encoding="utf-8")
+        for item in items:
+            d = item.dep
+            assert item.latest
+            if path.name == "package.json":
+                data = json.loads(text)
+                done = False
+                for section in ("dependencies", "devDependencies",
+                                "peerDependencies", "optionalDependencies"):
+                    if d.name in (data.get(section) or {}):
+                        new = _bump_npm_range(data[section][d.name], item.latest)
+                        if new and new != data[section][d.name]:
+                            data[section][d.name] = new
+                            res.changed.append(f"{path.name}: {d.name} {d.current} -> {item.latest}")
+                            done = True
+                text = json.dumps(data, indent=2) + "\n"
+                if not done:
+                    res.skipped.append(f"{d.name}: range {d.wanted!r} has no version triple to bump")
+            else:
+                new_text, n = re.subn(
+                    rf"(?m)^(\s*{re.escape(d.name)}\s*==\s*){re.escape(d.current or '')}\s*$",
+                    rf"\g<1>{item.latest}", text, count=1)
+                if n:
+                    text = new_text
+                    res.changed.append(f"{path.name}: {d.name} {d.current} -> {item.latest}")
+                else:
+                    res.skipped.append(f"{d.name}: pin line not found or not ==")
+        if not dry_run:
+            path.write_text(text, encoding="utf-8")
+    return res
+
+
+def format_apply(res: ApplyResult, dry_run: bool = False) -> str:
+    head = "depwake apply (dry run — nothing written):" if dry_run else "depwake apply:"
+    lines = [head]
+    for c in res.changed:
+        lines.append(f"  BUMP {c}")
+    for s in res.skipped:
+        lines.append(f"  SKIP {s}")
+    for b in res.backups:
+        lines.append(f"  backup: {b}")
+    if not res.changed:
+        lines.append("  nothing to bump.")
+    return "\n".join(lines)

depwake/cache.py

@@ -0,0 +1,44 @@
+"""Tiny file cache for registry lookups. Stdlib only.
+
+Same TTL for version + advisory data: staleness here costs a delayed
+upgrade notice, never a wrong one (versions only move forward; advisories
+only accumulate — both refresh within the hour).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import time
+from pathlib import Path
+
+TTL = 3600
+
+
+def cache_dir() -> Path:
+    import os
+    base = os.environ.get("XDG_CACHE_HOME") or str(Path.home() / ".cache")
+    d = Path(base) / "depwake"
+    d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def _path(key: str) -> Path:
+    return cache_dir() / (hashlib.sha256(key.encode()).hexdigest() + ".json")
+
+
+def get(key: str, ttl: float = TTL) -> object | None:
+    try:
+        p = _path(key)
+        if not p.exists() or time.time() - p.stat().st_mtime > ttl:
+            return None
+        return json.loads(p.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+
+
+def put(key: str, value: object) -> None:
+    try:
+        _path(key).write_text(json.dumps(value), encoding="utf-8")
+    except OSError:
+        pass  # cache is best-effort; a full disk must never break a plan

depwake/cli.py

@@ -0,0 +1,228 @@
+"""`depwake` CLI. Stdlib only. Exit codes: 0 clean, 1 findings, 2 usage."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+import time
+
+from . import __version__
+from .apply import apply_plan, format_apply
+from .cache import get as cache_get
+from .cache import put as cache_put
+from .color import enabled as color_enabled
+from .config import load as load_config
+from .manifests import discover
+from .plan import build
+from .registry import Latest, fetch, fetch_advisories
+from .report import format_json, format_markdown, format_text
+
+RISK_ORDER = {"major": 0, "minor": 1, "patch": 2}
+
+
+def _version_fetcher(args: argparse.Namespace):
+    def go(eco: str, name: str) -> Latest:
+        if args.offline:
+            return Latest(None, "", "offline mode (--offline)")
+        key = f"latest:{eco}:{name}"
+        if not args.no_cache:
+            hit = cache_get(key)
+            if isinstance(hit, dict) and "version" in hit:
+                return Latest(hit.get("version"), hit.get("url", ""), hit.get("error", ""))
+        got = fetch(eco, name, args.timeout)
+        if not args.no_cache:
+            cache_put(key, {"version": got.version, "url": got.url, "error": got.error})
+        return got
+    return go
+
+
+def _advisory_fetcher(args: argparse.Namespace):
+    def go(deps: list[tuple[str, str, str]]):
+        if args.offline or args.no_advisories:
+            return {}
+        out: dict = {}
+        missing = []
+        for eco, name, ver in deps:
+            key = f"osv:{eco}:{name}:{ver}"
+            hit = None if args.no_cache else cache_get(key)
+            if isinstance(hit, list):
+                from .registry import Advisory
+                out[(eco, name)] = [Advisory(**a) for a in hit]
+            else:
+                missing.append((eco, name, ver))
+        if missing:
+            fresh = fetch_advisories(missing, args.timeout)
+            by_key = {(e, n): v for e, n, v in missing}
+            for k, advs in fresh.items():
+                out[k] = advs
+                if not args.no_cache and k in by_key:
+                    cache_put(f"osv:{k[0]}:{k[1]}:{by_key[k]}",
+                              [a.to_dict() for a in advs])
+        return out
+    return go
+
+
+def _shared_flags(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--timeout", type=float, default=10.0, help="Registry timeout (s).")
+    p.add_argument("--no-advisories", action="store_true", help="Skip OSV advisory lookup.")
+    p.add_argument("--no-cache", action="store_true", help="Bypass the registry cache.")
+    p.add_argument("--offline", action="store_true",
+                   help="No network: versions/advisories become unknown with reasons.")
+    p.add_argument("--color", choices=["auto", "always", "never"], default="auto")
+    p.add_argument("--quiet", action="store_true", help="Only the report on stdout.")
+
+
+def _resolve_config(args: argparse.Namespace) -> tuple[list, list, list, str]:
+    """Apply config file: ignore list + fail_on default.
+
+    Returns (deps, notes, ignored_names, fail_on). Ignored deps vanish from
+    counts but always leave a note — silent filtering would be lying by omission.
+    """
+    cfg = load_config(args.root)
+    deps, notes = discover(args.root)
+    ignored = sorted({d.name for d in deps if d.name.lower() in set(cfg.get("ignore", []))})
+    if ignored:
+        deps = [d for d in deps if d.name not in ignored]
+        notes.append(f"ignored {len(ignored)} dep(s) per config: {', '.join(ignored)}")
+    fail_on = args.fail_on if getattr(args, "fail_on", None) else cfg.get("fail_on", "never")
+    return (deps, notes, ignored, fail_on)
+
+
+def _say(args: argparse.Namespace, msg: str) -> None:
+    if not args.quiet:
+        print(f"depwake: {msg}", file=sys.stderr)
+
+
+def cmd_plan(args: argparse.Namespace) -> int:
+    try:
+        deps, notes, _, fail_on = _resolve_config(args)
+    except ValueError as exc:
+        print(f"depwake: error: {exc}", file=sys.stderr)
+        return 2
+    color = color_enabled(args.color)
+    _say(args, f"checking {len(deps)} dep(s)…")
+    t0 = time.time()
+    plan = build(deps, fetcher=_version_fetcher(args), timeout=args.timeout,
+                 advisory_fetcher=_advisory_fetcher(args),
+                 min_severity=args.min_severity)
+    plan.notes.extend(notes)
+    _say(args, f"done in {time.time() - t0:.1f}s")
+    if args.format == "json":
+        rendered = format_json(plan)
+    elif args.format == "markdown":
+        rendered = format_markdown(plan, args.root)
+    else:
+        rendered = format_text(plan, color=color)
+    if args.output:
+        from pathlib import Path
+        Path(args.output).write_text(rendered if rendered.endswith("\n") else rendered + "\n",
+                                     encoding="utf-8")
+        print(f"wrote {args.output}")
+        return 0 if fail_on == "never" else _gate(plan, fail_on)
+    if args.format == "markdown":
+        print(rendered, end="")
+    else:
+        print(rendered)
+    if fail_on == "never":
+        return 0
+    return _gate(plan, fail_on)
+
+
+def _gate(plan, fail_on: str) -> int:
+    threshold = RISK_ORDER[fail_on]
+    bad = [i for i in plan.items if i.risk in RISK_ORDER and RISK_ORDER[i.risk] <= threshold]
+    return 1 if bad else 0
+
+
+def cmd_apply(args: argparse.Namespace) -> int:
+    try:
+        deps, notes, _, _ = _resolve_config(args)
+    except ValueError as exc:
+        print(f"depwake: error: {exc}", file=sys.stderr)
+        return 2
+    _say(args, f"checking {len(deps)} dep(s)…")
+    plan = build(deps, fetcher=_version_fetcher(args),
+                 timeout=args.timeout, advisory_fetcher=_advisory_fetcher(args))
+    include = {"patch"} | ({"minor"} if args.include_minor else set())
+    res = apply_plan(args.root, plan, include=include, dry_run=args.dry_run)
+    print(format_apply(res, dry_run=args.dry_run))
+    if res.changed and not args.dry_run:
+        npm = any(c.startswith("package.json") for c in res.changed)
+        pypi = any(not c.startswith("package.json") for c in res.changed)
+        hints = []
+        if npm:
+            hints.append("npm install  (refresh the lockfile)")
+        if pypi:
+            hints.append("pip install -r requirements.txt  (or reinstall your project)")
+        hints.append("re-run depwake plan to confirm")
+        print("  next: " + " → ".join(hints))
+    return 0
+
+
+def cmd_verify(args: argparse.Namespace) -> int:
+    """How much of this project is exactly known? Facts (lock/pin) vs
+    assumptions (range floors) vs blind spots (unknown). No network."""
+    try:
+        deps, notes = discover(args.root)
+    except ValueError as exc:
+        print(f"depwake: error: {exc}", file=sys.stderr)
+        return 2
+    exact = [d for d in deps if d.current_source in ("lock", "pin")]
+    floors = [d for d in deps if d.current_source == "floor"]
+    unknown = [d for d in deps if d.current_source == "unknown"]
+    lines = [f"depwake verify: {len(exact)}/{len(deps)} exact, "
+             f"{len(floors)} range-floor assumptions, {len(unknown)} unknown"]
+    for d in floors:
+        lines.append(f"  FLOOR   {d.ecosystem:4} {d.name} {d.wanted} (add a lockfile)")
+    for d in unknown:
+        lines.append(f"  UNKNOWN {d.ecosystem:4} {d.name} {d.wanted}")
+    for note in notes:
+        lines.append(f"  note: {note}")
+    print("\n".join(lines))
+    if args.strict and (floors or unknown):
+        return 1
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="depwake",
+        description="Wake your sleeping dependencies — risk-grouped plans, safe auto-bumps.",
+    )
+    p.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    sub = p.add_subparsers(dest="command", required=True)
+
+    pl = sub.add_parser("plan", help="Risk-grouped upgrade plan (patch/minor/major/unknown).")
+    pl.add_argument("root", nargs="?", default=".", help="Project directory.")
+    pl.add_argument("--format", choices=["text", "markdown", "json"], default="text")
+    _shared_flags(pl)
+    pl.add_argument("--fail-on", choices=["major", "minor", "patch", "never"], default=None,
+                    help="Exit 1 if upgrades at/above this risk are pending "
+                         "(default: config fail_on, else never).")
+    pl.add_argument("-o", "--output", default=None, help="Write report to file instead of stdout.")
+    pl.add_argument("--min-severity", choices=["Critical", "High", "Medium", "Low"], default=None,
+                    help="Only attach advisories at/above this severity (Unscored always shown).")
+    pl.set_defaults(func=cmd_plan)
+
+    ap = sub.add_parser("apply", help="Auto-bump patch (and optionally minor). Never major.")
+    ap.add_argument("root", nargs="?", default=".")
+    _shared_flags(ap)
+    ap.add_argument("--include-minor", action="store_true", help="Also bump minor upgrades.")
+    ap.add_argument("--dry-run", action="store_true", help="Show what would change.")
+    ap.set_defaults(func=cmd_apply)
+
+    vf = sub.add_parser("verify", help="Facts vs assumptions: lock/pin coverage, no network.")
+    vf.add_argument("root", nargs="?", default=".")
+    vf.add_argument("--strict", action="store_true",
+                    help="Exit 1 unless every dep is exactly known.")
+    vf.set_defaults(func=cmd_verify)
+    return p
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    return int(args.func(args))
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

depwake/color.py

@@ -0,0 +1,42 @@
+"""Terminal colors without dependencies. Respects NO_COLOR and pipes.
+
+Rule: color only when the user sees it (TTY) unless forced. CI logs and
+redirects stay clean — a green test suite must never print escapes.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+CODES = {
+    "red": "\033[31m",
+    "yellow": "\033[33m",
+    "green": "\033[32m",
+    "dim": "\033[2m",
+    "bold": "\033[1m",
+    "reset": "\033[0m",
+}
+
+RISK_COLORS = {"major": "red", "minor": "yellow", "patch": "green",
+               "same": "green", "unknown": "dim"}
+
+
+def enabled(mode: str = "auto") -> bool:
+    """mode: auto | always | never."""
+    if mode == "always":
+        return True
+    if mode == "never":
+        return False
+    if os.environ.get("NO_COLOR") is not None:
+        return False
+    try:
+        return sys.stdout.isatty()
+    except (AttributeError, ValueError):
+        return False
+
+
+def paint(text: str, color: str, on: bool) -> str:
+    if not on or color not in CODES:
+        return text
+    return f"{CODES[color]}{text}{CODES['reset']}"

depwake/config.py

@@ -0,0 +1,58 @@
+"""Project config: depwake.toml > package.json \"depwake\" key > pyproject [tool.depwake].
+
+Keys:
+  ignore  = ["pkg", ...]   deps to exclude from every plan (with a note)
+  fail_on = "major"        default gate when --fail-on isn't passed
+
+Explicit CLI flags always win over config. Unknown keys are ignored, not
+errors — configs must never break a plan.
+"""
+
+from __future__ import annotations
+
+import json
+import tomllib
+from pathlib import Path
+from typing import Any
+
+
+def load(root: str | Path) -> dict[str, Any]:
+    root = Path(root)
+    cfg: dict[str, Any] = {}
+    toml = root / "depwake.toml"
+    if toml.exists():
+        try:
+            cfg.update(tomllib.loads(toml.read_bytes().decode("utf-8", errors="replace")))
+        except (ValueError, OSError):
+            pass
+        return _clean(cfg)
+    pkg = root / "package.json"
+    if pkg.exists():
+        try:
+            data = json.loads(pkg.read_text(encoding="utf-8"))
+            if isinstance(data.get("depwake"), dict):
+                cfg.update(data["depwake"])
+                return _clean(cfg)
+        except (ValueError, OSError):
+            pass
+    proj = root / "pyproject.toml"
+    if proj.exists():
+        try:
+            data = tomllib.loads(proj.read_bytes().decode("utf-8", errors="replace"))
+            tool = (data.get("tool") or {}).get("depwake")
+            if isinstance(tool, dict):
+                cfg.update(tool)
+        except (ValueError, OSError):
+            pass
+    return _clean(cfg)
+
+
+def _clean(cfg: dict[str, Any]) -> dict[str, Any]:
+    out: dict[str, Any] = {}
+    ignore = cfg.get("ignore", [])
+    if isinstance(ignore, list):
+        out["ignore"] = sorted({str(x).lower() for x in ignore if str(x).strip()})
+    fail_on = cfg.get("fail_on")
+    if fail_on in ("major", "minor", "patch", "never"):
+        out["fail_on"] = fail_on
+    return out

depwake/manifests.py

@@ -0,0 +1,226 @@
+"""Manifest parsing: package.json (+ lock), requirements.txt, pyproject.toml.
+
+Every dep becomes a Dep(name, ecosystem, wanted, current, current_source):
+- wanted: the range/pin written in the manifest.
+- current: the actually-installed version (lockfile) or the range floor
+  when no lock exists — always labeled via current_source so plans never
+  present guesses as facts.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass
+class Dep:
+    name: str
+    ecosystem: str  # "npm" | "pypi"
+    wanted: str
+    current: str | None       # None when unresolvable
+    current_source: str       # "lock" | "pin" | "floor" | "unknown"
+
+
+REQ_LINE = re.compile(r"^\s*([A-Za-z0-9_.\-]+(?:\[[A-Za-z0-9_,\-]+\])?)\s*(.*)$")
+REQ_PIN = re.compile(r"==\s*([^;\s]+)")
+REQ_FLOOR = re.compile(r"(?:>=|~=|>|===)\s*([^;\s,]+)")
+
+
+def _normalize_floor(v: str | None) -> str | None:
+    """Pad partial floors ("2" -> 2.0.0) so >=2,<4 yields a usable floor.
+
+    Still labeled `floor` downstream — padding is arithmetic, not knowledge.
+    """
+    if not v:
+        return None
+    v = v.strip().rstrip(".*")
+    parts = v.split(".")
+    if not all(p.isdigit() for p in parts) or len(parts) > 3:
+        return None
+    return ".".join(parts + ["0"] * (3 - len(parts)))
+
+
+def _floor_npm_range(rng: str) -> str | None:
+    """Best-effort floor of an npm range: ^4.17.0 -> 4.17.0, * -> None."""
+    rng = rng.strip()
+    if not rng or rng in ("*", "latest", "x"):
+        return None
+    m = re.search(r"(\d+\.\d+\.\d+[^,\s|]*)", rng)
+    return m.group(1) if m else None
+
+
+def parse_package_json(root: Path) -> list[Dep]:
+    manifest = json.loads((root / "package.json").read_text(encoding="utf-8"))
+    wanted: dict[str, str] = {}
+    for section in ("dependencies", "devDependencies",
+                    "peerDependencies", "optionalDependencies"):
+        wanted.update(manifest.get(section, {}) or {})
+    locked = _read_npm_lock(root)
+    deps = []
+    for name, rng in sorted(wanted.items()):
+        if name in locked:
+            deps.append(Dep(name, "npm", rng, locked[name], "lock"))
+            continue
+        floor = _floor_npm_range(rng)
+        deps.append(Dep(name, "npm", rng, floor,
+                        "floor" if floor else "unknown"))
+    return deps
+
+
+def _read_npm_lock(root: Path) -> dict[str, str]:
+    lock = root / "package-lock.json"
+    if not lock.exists():
+        return {}
+    try:
+        data = json.loads(lock.read_text(encoding="utf-8"))
+    except json.JSONDecodeError:
+        return {}
+    out: dict[str, str] = {}
+    packages = data.get("packages")
+    if isinstance(packages, dict):  # lockfileVersion 2/3
+        for path, meta in packages.items():
+            if not path or not path.startswith("node_modules/"):
+                continue
+            name = path[len("node_modules/"):]
+            if "/" not in name and meta.get("version"):
+                out[name] = meta["version"]
+    else:  # lockfileVersion 1
+        for name, meta in (data.get("dependencies") or {}).items():
+            if isinstance(meta, dict) and meta.get("version"):
+                out[name] = meta["version"]
+    # shrinkwrap twin
+    shrink = root / "npm-shrinkwrap.json"
+    if shrink.exists() and not out:
+        try:
+            data = json.loads(shrink.read_text(encoding="utf-8"))
+            for name, meta in (data.get("dependencies") or {}).items():
+                if isinstance(meta, dict) and meta.get("version"):
+                    out[name] = meta["version"]
+        except json.JSONDecodeError:
+            pass
+    return out
+
+
+def parse_requirements(path: Path, _seen: set[Path] | None = None) -> list[Dep]:
+    path = Path(path)
+    _seen = _seen or set()
+    if path in _seen:
+        return []  # include cycle — report once, never loop
+    _seen.add(path)
+    deps: list[Dep] = []
+    try:
+        raw = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return []
+    # join continuations before parsing
+    lines: list[str] = []
+    buf = ""
+    for line in raw.splitlines():
+        if line.rstrip().endswith("\\"):
+            buf += line.rstrip()[:-1]
+            continue
+        lines.append(buf + line)
+        buf = ""
+    if buf:
+        lines.append(buf)
+    for line in lines:
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith(("-r ", "--requirement ", "-r\t", "--requirement=")):
+            inc = line.split(None, 1)[1] if " " in line or "\t" in line \
+                else line.split("=", 1)[1]
+            deps.extend(parse_requirements(path.parent / inc.strip(), _seen))
+            continue
+        if line.startswith("-"):
+            continue  # options (-c constraints, --index-url, ...) are out of scope
+        m = REQ_LINE.match(line)
+        if not m:
+            continue
+        name, spec = m.group(1), m.group(2).strip()
+        # strip environment markers for version parsing ("pkg==1.0; python_version>'3'")
+        spec = spec.split(";")[0].strip()
+        pin = REQ_PIN.search(spec)
+        if pin:
+            deps.append(Dep(name, "pypi", spec or "any", pin.group(1), "pin"))
+            continue
+        mfloor = REQ_FLOOR.search(spec)
+        floor = _normalize_floor(mfloor.group(1)) if mfloor else None
+        deps.append(Dep(name, "pypi", spec or "any", floor,
+                        "floor" if floor else "unknown"))
+    return sorted(deps, key=lambda d: d.name.lower())
+
+
+def parse_pyproject(path: Path) -> tuple[list[Dep], list[str]]:
+    """Returns (deps, notes). Optional-dependency groups are reported in
+    notes, not deps: counting uninstalled extras as stale would be noise."""
+    try:
+        data = tomllib.loads(path.read_bytes().decode("utf-8", errors="replace"))
+    except (ValueError, OSError):
+        return [], []
+    notes: list[str] = []
+    optional = data.get("project", {}).get("optional-dependencies", {}) or {}
+    if optional:
+        n = sum(len(v) for v in optional.values())
+        notes.append(f"{n} optional deps ignored (extras: {', '.join(sorted(optional))})")
+    reqs = data.get("project", {}).get("dependencies", []) or []
+    deps = []
+    for req in reqs:
+        m = REQ_LINE.match(str(req).strip())
+        if not m:
+            continue
+        name, spec = m.group(1), m.group(2).strip()
+        spec = spec.split(";")[0].strip()
+        pin = REQ_PIN.search(spec)
+        if pin:
+            deps.append(Dep(name, "pypi", spec, pin.group(1), "pin"))
+            continue
+        mfloor = REQ_FLOOR.search(spec)
+        floor = _normalize_floor(mfloor.group(1)) if mfloor else None
+        deps.append(Dep(name, "pypi", spec or "any", floor,
+                        "floor" if floor else "unknown"))
+    return sorted(deps, key=lambda d: d.name.lower()), notes
+
+
+def discover(root: Path) -> tuple[list[Dep], list[str]]:
+    """Collect deps from every supported manifest under root.
+
+    Returns (deps, notes). Later manifests win on name collisions so the
+    most specific pin (e.g. requirements.txt over pyproject) is reported.
+    """
+    root = Path(root)
+    if not root.exists():
+        raise ValueError(f"{root}: no such file or directory")
+    found: dict[tuple[str, str], Dep] = {}
+    notes: list[str] = []
+    if (root / "package.json").exists():
+        for d in parse_package_json(root):
+            found[("npm", d.name)] = d
+    else:
+        notes.append("no package.json")
+    reqs = root / "requirements.txt"
+    if reqs.exists():
+        for d in parse_requirements(reqs):
+            found[("pypi", d.name)] = d
+    else:
+        notes.append("no requirements.txt")
+    proj = root / "pyproject.toml"
+    if proj.exists():
+        pdeps, pnotes = parse_pyproject(proj)
+        notes.extend(pnotes)
+        for d in pdeps:
+            found.setdefault(("pypi", d.name), d)
+    else:
+        notes.append("no pyproject.toml")
+    manifests_seen = ((root / "package.json").exists() or reqs.exists()
+                      or proj.exists())
+    if not manifests_seen:
+        raise ValueError(f"{root}: no supported manifest found "
+                         "(package.json, requirements.txt, pyproject.toml)")
+    if not found:
+        notes.append("manifests present but declare zero dependencies")
+    return sorted(found.values(), key=lambda d: (d.ecosystem, d.name.lower())), notes

depwake/plan.py

@@ -0,0 +1,137 @@
+"""Upgrade planning: deps + latest versions -> risk-grouped plan."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass, field
+
+from .manifests import Dep
+from .registry import Advisory, Latest, fetch, fetch_advisories
+from .semver import RISK_BLURB, classify, parse
+
+ORDER = {"major": 0, "minor": 1, "patch": 2, "same": 3, "unknown": 4}
+SEV_ORDER = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3, "Unscored": 4}
+
+
+@dataclass
+class Item:
+    dep: Dep
+    latest: str | None
+    url: str
+    risk: str            # major | minor | patch | same | unknown
+    note: str = ""       # why this row needs attention (or why we can't tell)
+    advisories: list[Advisory] = field(default_factory=list)
+
+    def worst_severity(self) -> str:
+        if not self.advisories:
+            return ""
+        return min((a.severity for a in self.advisories),
+                   key=lambda s: SEV_ORDER.get(s, 9))
+
+    def to_dict(self) -> dict:
+        return {"name": self.dep.name, "ecosystem": self.dep.ecosystem,
+                "wanted": self.dep.wanted, "current": self.dep.current,
+                "current_source": self.dep.current_source,
+                "latest": self.latest, "url": self.url,
+                "risk": self.risk, "note": self.note,
+                "advisories": [a.to_dict() for a in self.advisories]}
+
+
+@dataclass
+class Plan:
+    items: list[Item]
+    notes: list[str] = field(default_factory=list)
+
+    def to_dict(self) -> dict:
+        counts = self.counts()
+        return {"items": [i.to_dict() for i in self.items], "notes": self.notes,
+                "counts": counts, "advisory_count": self.advisory_count()}
+
+    def grouped(self) -> dict[str, list[Item]]:
+        groups: dict[str, list[Item]] = {k: [] for k in ORDER}
+        for item in sorted(self.items,
+                           key=lambda i: (ORDER[i.risk], not i.advisories,
+                                          i.dep.ecosystem, i.dep.name.lower())):
+            groups[item.risk].append(item)
+        return groups
+
+    def counts(self) -> dict[str, int]:
+        out = {k: 0 for k in ORDER}
+        for item in self.items:
+            out[item.risk] += 1
+        return out
+
+    def advisory_count(self) -> int:
+        return sum(len(i.advisories) for i in self.items)
+
+
+def _security_note(item: Item) -> str:
+    n = len(item.advisories)
+    worst = item.worst_severity()
+    top = sorted(item.advisories, key=lambda a: SEV_ORDER.get(a.severity, 9))[0]
+    fixed = f"fixed in {top.fixed_in}" if top.fixed_in else "no fix published yet"
+    return (f"🔒 {n} advisor{'y' if n == 1 else 'ies'} (worst {worst}): "
+            f"{top.id} — {fixed}")
+
+
+def build(deps: list[Dep],
+          fetcher: Callable[[str, str], Latest] = fetch,
+          timeout: float = 10.0,
+          advisory_fetcher: Callable[[list[tuple[str, str, str]]],
+                                     dict[tuple[str, str], list[Advisory]]]
+          | None = fetch_advisories,
+          with_advisories: bool = True,
+          min_severity: str | None = None) -> Plan:
+    items: list[Item] = []
+    for dep in deps:
+        if dep.current is None:
+            items.append(Item(dep, None, "", "unknown",
+                              "no lockfile pin and no parseable range floor — "
+                              "add a lockfile for exact tracking"))
+            continue
+        current = parse(dep.current)
+        if current is None:
+            items.append(Item(dep, None, "", "unknown",
+                              f"unparseable current version {dep.current!r}"))
+            continue
+        try:
+            got = fetcher(dep.ecosystem, dep.name)
+        except Exception as exc:  # a fetcher must never kill a plan
+            got = Latest(None, "", f"lookup failed: {exc}")
+        if not got.version:
+            items.append(Item(dep, None, got.url, "unknown", got.error or "lookup failed"))
+            continue
+        latest = parse(got.version)
+        if latest is None:
+            items.append(Item(dep, got.version, got.url, "unknown",
+                              f"unparseable latest version {got.version!r}"))
+            continue
+        risk = classify(current, latest)
+        note = ""
+        if risk == "same" and dep.current_source == "floor":
+            note = "range floor looks current, but without a lockfile this is an assumption"
+        elif risk != "same" and dep.current_source == "floor":
+            note = "computed from range floor (no lockfile) — verify against installed tree"
+        items.append(Item(dep, str(latest), got.url, risk, note or RISK_BLURB[risk]))
+    plan = Plan(items)
+    if with_advisories and advisory_fetcher is not None:
+        try:
+            adv = advisory_fetcher([(i.dep.ecosystem, i.dep.name, i.dep.current or "")
+                                    for i in items if i.dep.current])
+        except Exception:
+            adv = {}
+        # Unscored advisories always survive the filter: unknown != safe.
+        threshold = SEV_ORDER.get(min_severity or "Unscored", 4)
+        hidden = 0
+        for item in items:
+            found = adv.get((item.dep.ecosystem, item.dep.name), [])
+            kept = [a for a in found
+                    if a.severity == "Unscored" or SEV_ORDER.get(a.severity, 9) <= threshold]
+            hidden += len(found) - len(kept)
+            if kept:
+                item.advisories = kept
+                item.note = f"{_security_note(item)}. {item.note}".strip()
+        if hidden:
+            plan.notes.append(f"{hidden} advisor{'y' if hidden == 1 else 'ies'} "
+                              f"below --min-severity {min_severity} hidden")
+    return plan

depwake/registry.py

@@ -0,0 +1,157 @@
+"""Latest-version lookup over plain HTTPS. Stdlib only.
+
+Injectable fetch() keeps everything deterministic in tests and lets future
+versions plug caches/mirrors without touching callers.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.request
+from dataclasses import dataclass
+
+UA = "depwake/0.2.0"
+OSV_ECO = {"npm": "npm", "pypi": "PyPI"}
+
+
+@dataclass
+class Latest:
+    version: str | None
+    url: str          # registry/homepage link for the "why" column
+    error: str = ""   # non-empty when lookup failed (offline, 404, ...)
+
+
+def _get(url: str, timeout: float) -> tuple[int, bytes]:
+    req = urllib.request.Request(url, headers={"User-Agent": "depwake/0.1.0",
+                                               "Accept": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            return resp.status, resp.read()
+    except Exception as exc:  # network, TLS, 404, timeout — all just "unknown"
+        return 0, str(exc).encode()
+
+
+def fetch_npm(name: str, timeout: float = 10.0) -> Latest:
+    status, body = _get(f"https://registry.npmjs.org/{name}/latest", timeout)
+    if status != 200:
+        return Latest(None, f"https://www.npmjs.com/package/{name}",
+                      f"npm registry: HTTP {status or 'unreachable'}")
+    try:
+        version = json.loads(body).get("version")
+    except json.JSONDecodeError:
+        version = None
+    if not version:
+        return Latest(None, f"https://www.npmjs.com/package/{name}", "no version field")
+    return Latest(version, f"https://www.npmjs.com/package/{name}")
+
+
+def fetch_pypi(name: str, timeout: float = 10.0) -> Latest:
+    base = name.split("[")[0]
+    status, body = _get(f"https://pypi.org/pypi/{base}/json", timeout)
+    if status != 200:
+        return Latest(None, f"https://pypi.org/project/{base}/",
+                      f"PyPI: HTTP {status or 'unreachable'}")
+    try:
+        info = json.loads(body).get("info", {})
+    except json.JSONDecodeError:
+        return Latest(None, f"https://pypi.org/project/{base}/", "bad JSON")
+    version = info.get("version")
+    url = info.get("home_page") or info.get("project_url") or f"https://pypi.org/project/{base}/"
+    if not version:
+        return Latest(None, url, "no version field")
+    return Latest(version, url)
+
+
+def fetch(ecosystem: str, name: str, timeout: float = 10.0) -> Latest:
+    if ecosystem == "npm":
+        return fetch_npm(name, timeout)
+    return fetch_pypi(name, timeout)
+
+
+@dataclass
+class Advisory:
+    id: str
+    summary: str
+    severity: str   # Critical | High | Medium | Low | Unscored
+    score: float | None
+    fixed_in: str | None  # None when no fixed version published
+    url: str
+
+    def to_dict(self) -> dict:
+        return {"id": self.id, "summary": self.summary, "severity": self.severity,
+                "score": self.score, "fixed_in": self.fixed_in, "url": self.url}
+
+
+def _label(score: float | None) -> str:
+    if score is None:
+        return "Unscored"
+    if score >= 9.0:
+        return "Critical"
+    if score >= 7.0:
+        return "High"
+    if score >= 4.0:
+        return "Medium"
+    if score > 0:
+        return "Low"
+    return "Unscored"
+
+
+def _fixed_in(vuln: dict) -> str | None:
+    """Latest 'fixed' event across affected ranges, or None."""
+    fixed: list[str] = []
+    for aff in vuln.get("affected", []):
+        for rng in aff.get("ranges", []):
+            for ev in rng.get("events", []):
+                if "fixed" in ev:
+                    fixed.append(str(ev["fixed"]))
+    return sorted(set(fixed))[-1] if fixed else None
+
+
+def _advisory(vuln: dict) -> Advisory:
+    scores = [s.get("score") for s in (vuln.get("severity") or [])
+              if isinstance(s.get("score"), (int, float))]
+    score = max(scores) if scores else None
+    summary = (vuln.get("summary") or "")[:160]
+    vid = vuln.get("id", "unknown")
+    return Advisory(vid, summary, _label(score), score,
+                    _fixed_in(vuln), f"https://osv.dev/vulnerability/{vid}")
+
+
+def fetch_advisories(deps: list[tuple[str, str, str]],
+                     timeout: float = 10.0) -> dict[tuple[str, str], list[Advisory]]:
+    """Map (ecosystem, name) -> advisories affecting that exact version.
+
+    One batch call to find who is affected, then one full-record call per
+    affected dep. Any failure degrades to {} — advisories inform, never gate.
+    """
+    queries = [{"package": {"name": n.split("[")[0],
+                            "ecosystem": OSV_ECO.get(e, e)}, "version": v}
+               for e, n, v in deps]
+    if not queries:
+        return {}
+    payload = json.dumps({"queries": queries}).encode()
+    req = urllib.request.Request("https://api.osv.dev/v1/querybatch", data=payload,
+                                 headers={"Content-Type": "application/json",
+                                          "User-Agent": UA})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            batch = json.loads(resp.read()).get("results", [])
+    except Exception:
+        return {}
+    out: dict[tuple[str, str], list[Advisory]] = {}
+    for (eco, name, ver), res in zip([(e, n, v) for e, n, v in deps], batch):
+        if not res.get("vulns"):
+            continue
+        single = json.dumps({"package": {"name": name.split("[")[0],
+                                         "ecosystem": OSV_ECO.get(eco, eco)},
+                             "version": ver}).encode()
+        req = urllib.request.Request("https://api.osv.dev/v1/query", data=single,
+                                     headers={"Content-Type": "application/json",
+                                              "User-Agent": UA})
+        try:
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                full = json.loads(resp.read()).get("vulns", [])
+            out[(eco, name)] = [_advisory(v) for v in full]
+        except Exception:
+            out[(eco, name)] = []
+    return out

depwake/report.py

@@ -0,0 +1,88 @@
+"""Plan rendering: text (human), markdown (PRs/files), json (machines)."""
+
+from __future__ import annotations
+
+import json
+
+from .color import RISK_COLORS, paint
+from .plan import Plan
+
+TITLES = {
+    "major": "## 🔴 Major — read the changelog, upgrade deliberately",
+    "minor": "## 🟡 Minor — backwards compatible, apply this week",
+    "patch": "## 🟢 Patch — safe fixes, apply today",
+    "same": "## ✅ Up to date",
+    "unknown": "## ⚪ Unknown — needs a human look",
+}
+
+
+def format_text(plan: Plan, color: bool = False) -> str:
+    counts = plan.counts()
+    total = len(plan.items)
+    adv = plan.advisory_count()
+    head = (f"depwake plan: {total} dep(s) — "
+            f"{counts['major']} major, {counts['minor']} minor, "
+            f"{counts['patch']} patch, {counts['unknown']} unknown")
+    if adv:
+        head += f", 🔒 {adv} advisor{'y' if adv == 1 else 'ies'}"
+    lines = [head]
+    for risk in ("major", "minor", "patch", "unknown"):
+        for item in plan.grouped()[risk]:
+            d = item.dep
+            arrow = f"{d.current} -> {item.latest}" if item.latest else f"{d.current} -> ?"
+            flag = "" if d.current_source in ("lock", "pin") else f" [{d.current_source}]"
+            lock = " 🔒" if item.advisories else ""
+            label = paint(risk.upper().ljust(7), RISK_COLORS[risk], color)
+            lines.append(f"  {label} {d.ecosystem:4} {d.name} {arrow}{flag}{lock}")
+            if item.note:
+                lines.append(f"           {item.note}")
+    for note in plan.notes:
+        lines.append(f"  note: {note}")
+    return "\n".join(lines)
+
+
+def format_markdown(plan: Plan, root: str = ".") -> str:
+    counts = plan.counts()
+    adv = plan.advisory_count()
+    head = (f"{len(plan.items)} dependencies: "
+            f"**{counts['major']}** major, **{counts['minor']}** minor, "
+            f"**{counts['patch']}** patch, {counts['unknown']} unknown.")
+    if adv:
+        head += f" 🔒 **{adv}** advisor{'y' if adv == 1 else 'ies'}."
+    lines = [f"# Depwake plan — `{root}`", "", head, ""]
+    for risk in ("major", "minor", "patch", "unknown", "same"):
+        items = plan.grouped()[risk]
+        if not items:
+            continue
+        lines.append(TITLES[risk])
+        lines.append("")
+        lines.append("| Package | Current | Latest | Notes |")
+        lines.append("|---|---|---|---|")
+        for item in items:
+            d = item.dep
+            cur = f"{d.current or '?'} ({d.current_source})"
+            latest = f"[{item.latest}]({item.url})" if item.latest and item.url else (item.latest or "?")
+            note = item.note.replace("|", "\\|")
+            lines.append(f"| {d.name} ({d.ecosystem}) | {cur} | {latest} | {note} |")
+        lines.append("")
+    lines.append("_Generated by depwake — patch today, minor this week, major deliberately._")
+    sec = [i for i in plan.items if i.advisories]
+    if sec:
+        lines.append("")
+        lines.append("## 🔒 Security notes")
+        lines.append("")
+        for item in sorted(sec, key=lambda i: (i.dep.ecosystem, i.dep.name.lower())):
+            d = item.dep
+            lines.append(f"### {d.name} ({d.ecosystem} {d.current})")
+            lines.append("")
+            for a in item.advisories:
+                fixed = f"fixed in {a.fixed_in}" if a.fixed_in else "no fix published"
+                lines.append(f"- [{a.id}]({a.url}) — {a.severity} — {fixed}")
+                if a.summary:
+                    lines.append(f"  {a.summary}")
+            lines.append("")
+    return "\n".join(lines).rstrip() + "\n"
+
+
+def format_json(plan: Plan) -> str:
+    return json.dumps(plan.to_dict(), indent=2)

depwake/semver.py

@@ -0,0 +1,56 @@
+"""Semver parsing + risk classification. No network, no opinions beyond semver."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+VER = re.compile(r"^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$")
+
+
+@dataclass(frozen=True)
+class Version:
+    major: int
+    minor: int
+    patch: int
+
+    def __str__(self) -> str:
+        return f"{self.major}.{self.minor}.{self.patch}"
+
+
+def parse(v: str | None) -> Version | None:
+    """Parse X.Y.Z, tolerating leading v and partial real-world versions
+    ("3.19" -> 3.19.0, "2" -> 2.0.0). Non-numeric (latest, *) -> None."""
+    if not v:
+        return None
+    v = v.strip()
+    m = VER.match(v)
+    if m:
+        return Version(int(m.group(1)), int(m.group(2)), int(m.group(3)))
+    m = re.match(r"^v?(\d+)(?:\.(\d+))?$", v)
+    if m:
+        return Version(int(m.group(1)), int(m.group(2) or 0), 0)
+    return None
+
+
+def classify(current: Version, latest: Version) -> str:
+    """patch | minor | major | same. Pre-1.0 minors count as major:
+    in 0.x, semver says anything may break."""
+    if (current.major, current.minor, current.patch) >= \
+       (latest.major, latest.minor, latest.patch):
+        return "same"
+    if current.major != latest.major:
+        return "major"
+    if current.major == 0 and current.minor != latest.minor:
+        return "major"
+    if current.minor != latest.minor:
+        return "minor"
+    return "patch"
+
+
+RISK_BLURB = {
+    "patch": "Safe fixes only — apply today.",
+    "minor": "Features + fixes, backwards compatible — apply this week.",
+    "major": "May break — read the changelog, upgrade deliberately.",
+    "same": "Up to date.",
+}

depwake-0.3.1.dist-info/METADATA

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: depwake
+Version: 0.3.1
+Summary: Wake your sleeping dependencies — risk-grouped upgrade plans, safe auto-bumps, no noise
+License: MIT
+Project-URL: Homepage, https://github.com/YOUR-USER/depwake
+Project-URL: Issues, https://github.com/YOUR-USER/depwake/issues
+Keywords: dependencies,upgrades,npm,pypi,maintenance
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Depwake ⏰
+
+[![CI](https://github.com/YOUR-USER/depwake/actions/workflows/ci.yml/badge.svg)](https://github.com/YOUR-USER/depwake/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/YOUR-USER/depwake/badge)](https://scorecard.dev/viewer/?uri=github.com/YOUR-USER/depwake)
+
+**Wake your sleeping dependencies.**
+
+Your side project has 47 outdated packages, 3 security advisories, and a `package.json` from 2023. Dependabot spams you with 40 context-free PRs. Depwake does the opposite: one risk-grouped plan — patch today, minor this week, major deliberately — and safe auto-bumps for the boring parts.
+
+```bash
+pip install depwake
+depwake plan ./my-project              # risk-grouped plan, Markdown/JSON too
+depwake apply ./my-project --dry-run   # preview safe bumps (patch only)
+depwake apply ./my-project             # bump patches, .bak backups, majors never touched
+depwake verify ./my-project --strict   # facts vs assumptions, no network
+```
+
+> ⭐ If dependency hell has ever eaten your weekend, star this — it helps other devs find it.
+
+Advisories included: every plan queries OSV and sorts 🔒 rows first —
+urllib3 1.26 alone carries 20 advisories ([measured](benchmarks/BENCH.md)).
+
+## Before / after
+
+```bash
+$ depwake plan ./my-project
+depwake plan: 4 dep(s) — 1 major, 3 minor, 0 patch, 0 unknown
+  MAJOR   npm  express 4.17.0 -> 5.2.1 [floor]
+  MINOR   npm  lodash 4.17.20 -> 4.18.1 [floor]
+  MINOR   pypi requests 2.28.0 -> 2.34.2
+  MINOR   pypi six 1.16.0 -> 1.17.0
+```
+
+```bash
+$ depwake plan ./my-project --format markdown > UPGRADE.md   # paste into a PR
+$ depwake plan ./my-project --fail-on major                  # CI gate: exit 1 while majors pend
+```
+
+## Why not Dependabot / Renovate?
+
+| | Depwake | Bots |
+|---|---|---|
+| Unit of work | one grouped plan, you decide the order | N noisy PRs, no prioritization |
+| Risk language | patch today / minor this week / major deliberately | version numbers, you interpret |
+| Honesty | range floors labeled `[floor]`; offline → `unknown`, never guessed | — |
+| Scope | works without installs, lockfiles optional but rewarded | needs full install + config |
+| Agent-native | `SKILL.md` your coding agent can run | docs page, if you're lucky |
+
+Dependabot is a fine notifier. Depwake is the Sunday-morning plan *and* the safe pair of hands.
+
+## Supported
+
+`package.json` (+ `package-lock.json` / `npm-shrinkwrap.json`), `requirements.txt`, `pyproject.toml`. Pre-1.0 minors count as major (in 0.x, anything may break). Needs network for latest versions; offline degrades to `unknown`, never to guesses.
+
+## Contributing — built for drive-by PRs
+
+- 📦 New manifest format = one parser + fixtures (`good first issue`)
+- 🔌 New ecosystem (crates.io, RubyGems…) = one fetcher + tests
+- 🌍 Translations welcome (`README.<lang>.md`)
+- Rules: stdlib only, every feature ships with a test, never auto-bump a major
+
+## Roadmap
+
+- [x] v0.1 — plan / apply, 3 manifest formats, Markdown + JSON + CI gate
+- [x] v0.2 — OSV advisories, cache, `--offline`, `verify`, includes/markers/optionals, Action + CI + demo, real-repo validation
+- [x] v0.3 — colors, progress, config file, `-o`, severity filter, JSON counts, apply hints
+- [ ] Advisory reachability (is the vulnerable function even imported?)
+- [ ] `depwake PR` — open the grouped upgrade as draft PRs per risk tier (needs GitHub)
+- [ ] Lockfile generation for lockless projects (`--write-lock`)
+
+## License
+
+MIT — see [LICENSE](LICENSE).

depwake-0.3.1.dist-info/RECORD

@@ -0,0 +1,18 @@
+depwake/__init__.py,sha256=fsa2SI8kg2AjBRaIkD3pLSneVQJIQhuZHapqBkRI0Js,84
+depwake/__main__.py,sha256=Jqwn9-pywCldHtT_k-Ho7oCMUtH93JyWytpPzoG1qRk,385
+depwake/apply.py,sha256=600Z12rvPmaFuVmdn7C9Ppdv50CLbnphU_TL0Ay4Sfc,4949
+depwake/cache.py,sha256=KvBCQaD5yjJZKqyJpDLSUA_AMbPFp_yqsAJxVQlyk-U,1181
+depwake/cli.py,sha256=CIBBCR06MkW6caIOZl-FiSOPEQaVJDej8L3fcVivPjk,9490
+depwake/color.py,sha256=ZLfFfNjO7ZR2GTezAk3fcuf7kUCv2m1QZQb5s6Hw6WM,1057
+depwake/config.py,sha256=-WgzMYHdRoR-fYnaPUmqi7zSCAdQxSkEHXWn-FC9hBk,1865
+depwake/manifests.py,sha256=3PQlpEZ7rpaI6iWgWjKlYSJPT_kH4KuJt9w1vDlIwso,8428
+depwake/plan.py,sha256=MIBFOOjo5dkp7FskKGaqYje8kxhm2gVxSS7mXlWm0ig,5693
+depwake/registry.py,sha256=ieCO9kav6rPdYkfl2Do33Z2JohYQCZoIYExkCnLoNQ4,5961
+depwake/report.py,sha256=dgBhqZzYrDKgB2stUQ3e81cpme6HBBuRjgkQ07Am6iY,3678
+depwake/semver.py,sha256=gZlfoGXAx849uzg3U_QnF2eNtNJIAQFRzTUn5_Izx2k,1654
+depwake-0.3.1.dist-info/licenses/LICENSE,sha256=6Dxufnxzt_eCMwLa09imvNFFdK-zI7Bf6G5fbhrI5vk,1077
+depwake-0.3.1.dist-info/METADATA,sha256=OqqGVWC4erJRDMg9H8snYP4c86gqjki1EKsfBrM7g_g,4235
+depwake-0.3.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+depwake-0.3.1.dist-info/entry_points.txt,sha256=bBvlpkaf3Uz7hKb2Ui5NiUpCspO9NBdoVnjMQdTClzo,45
+depwake-0.3.1.dist-info/top_level.txt,sha256=J6sx11FCDxO6OPXxOG4XuEhR63ULd94bevBY_7FmJec,8
+depwake-0.3.1.dist-info/RECORD,,

depwake-0.3.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

depwake-0.3.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+depwake = depwake.cli:main

depwake-0.3.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Depwake Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

depwake-0.3.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+depwake