Release Notes
Fixed
- Scanning could write to disk (#13): with corepack's
pnpm shim on PATH,
asking pnpm store path downloaded pnpm into ~/.cache/node/corepack.
pnpm is now asked only when it is a real pnpm install; behind corepack,
Volta or a version-manager shim (asdf, mise...) the store is found from
store-dir (npm_config_store_dir, ~/.npmrc, pnpm's rc) or the default
locations ($PNPM_HOME/store, $XDG_DATA_HOME/pnpm/store,
~/Library/pnpm/store, ~/.local/share/pnpm/store). Yarn is no longer
asked at all, since yarn cache dir creates a missing cache folder: its
cache comes from $YARN_CACHE_FOLDER, cache-folder in ~/.yarnrc, or the
defaults (~/Library/Caches/Yarn, ~/.cache/yarn, Yarn 2+'s
$XDG_DATA_HOME/yarn/berry/cache or ~/.yarn/berry/cache).
- Go is no longer asked either: since Go 1.23 every go command updates
telemetry counters on disk. GOMODCACHE / GOCACHE / GOPATH come from
the environment, then Go's go env -w file, then the defaults.
- Every tool a scan still asks (
pnpm, pip, uv, brew, docker,
xcrun) now runs from / with only the scan's environment plus switches
that turn off downloads, self-updates, auto-installs and bytecode writes
(COREPACK_ENABLE_NETWORK=0, GOTOOLCHAIN=local,
HOMEBREW_NO_AUTO_UPDATE=1, PIP_DISABLE_PIP_VERSION_CHECK=1,
PYTHONDONTWRITEBYTECODE=1, MISE_EXEC_AUTO_INSTALL=false...), so a
project's packageManager field or go.mod toolchain line can't make a
tool fetch itself.
lysosome clean runs cache cleanup commands with corepack's auto-pin and
strict mode off, so it never edits the package.json of the folder you run
it from.
Install lysosome 0.2.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/lysosome-dev/cli/releases/download/v0.2.1/lysosome-installer.sh | sh
Install prebuilt binaries via Homebrew
Download lysosome 0.2.1
