Skip to content

lockvet v0.3.11

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 12:53
v0.3.11
0b7dbe1

NuGet joins the registry lineup

npm · PyPI · crates.io · RubyGems · Packagist · NuGet. One anonymous
GET per changed package against the registration index — the same
metadata endpoint dotnet restore reads, CORS-open, so the
browser playground gets every
signal too.

Unlisted, the way NuGet itself means it

NuGet is the one registry where "unlisted" is a native concept, and
lockvet now splits the flag the way NuGet does:

  • a stable version absent from the registration index entirely — what
    an admin-deleted (malicious) package looks like — keeps the ▲
    unlisted flag, registry-verified;
  • a version its author merely
    unlisted
    (listed:false: hidden from search, still restorable) lands in the
    deprecation lane instead;
  • absent prereleases are cleared rather than flagged — on NuGet those
    are overwhelmingly CI-feed daily builds (Roslyn nightlies and friends)
    that packages.lock.json cannot attribute to their real feed. The
    deps.dev-only layer used to false-flag them; this release removes a
    false-positive class instead of adding one.

Deprecations with the replacement deps.dev drops

↑ WindowsAzure.Storage 9.3.2 → 9.3.3  patch  (7y old)
    ● deprecated upstream: legacy; use Azure.Storage.Common instead

deps.dev relays only the bare reason ("Legacy"); the registration index
carries the suggested replacement package, so lockvet now shows it.

Also

  • Release-age backfill from registration published times when
    deps.dev lags, so the ⏱ cooldown flag works on brand-new NuGet
    releases (the 1900-01-01 sentinel NuGet stores for unlisted versions
    is ignored).
  • License-change fallback from per-version licenseExpression when
    deps.dev lacks either side.
  • Packages with long version histories page their registration index;
    lockvet fetches only the pages whose version range covers a version
    the diff actually mentions.

Validated against real Dependabot PRs and 81 historical
packages.lock.json commits across five repos: zero failures, zero
false unlisted flags.

Install: brew install matteo-sung/tap/lockvet · scoop bucket add matteo-sung https://github.com/matteo-sung/scoop-bucket && scoop install lockvet · go install github.com/matteo-sung/lockvet@v0.3.11 · docker run ghcr.io/matteo-sung/lockvet:0.3.11 · install.sh / binaries below

Assets 9
Loading