Skip to content

lockvet v0.3.15

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 17:53
v0.3.15
9d377af

CocoaPods joins the registry lineup

npm · PyPI · crates.io · RubyGems · Packagist · NuGet · Hex · Go · Pub · CocoaPods — and this one fills the biggest blank spot yet: neither OSV nor deps.dev has a CocoaPods system, so until now Podfile.lock diffs were explained with no registry data at all. lockvet now reads the registry the same way pod install does:

  • Registry-verified unlisted detection from the sharded CDN index (all_pods_versions_*.txt — the exact file CocoaPods resolves against): an incoming version missing while the pod's other versions are listed is what a deleted or moderated release looks like. -fail-on unlisted gates it.

  • Release ages and the ⏱ cooldown flag from the trunk API's per-version publish timestamps.

  • Deprecated pods land in the deprecation lane with the podspec's named successor — a live catch:

    ↑ Fabric  1.7.12 → 1.7.13  patch  (direct)  (7y old)
    ● deprecated upstream: deprecated on CocoaPods; in favor of FirebaseCrashlytics

  • License changes old → new from the two versions' podspecs, and the upstream repo from source.git feeds the tag-verified changelog/compare-link layer (-changelogs shows Alamofire release notes; Firebase's monorepo links resolve).

Podfile.lock parsing got the full treatment while at it:

  • Via-chains: pod bumps now say (direct) or via Firebase › FirebaseCore like npm and Cargo diffs do, from the PODS requirement graph + DEPENDENCIES roots. -only <pod> follows the chains.
  • NonRegistry exemptions: pods pinned from git/path (EXTERNAL SOURCES) or served by a private specs repo are exempt from registry checks — Signal-iOS's git-pinned LibSignalClient stays quiet, no false flags.

The browser playground reads the CDN through its CORS-open jsDelivr mirror (trunk sends no CORS headers, so in-browser pod reports carry no ages).

Validated on 70 real Podfile.lock commits across Signal-iOS and Artsy/eigen: 0 failures, 0 false unlisted flags.

Install / upgrade: brew upgrade lockvet · scoop update lockvet · go install github.com/matteo-sung/lockvet@v0.3.15 · binaries below · docker pull ghcr.io/matteo-sung/lockvet:0.3.15

Assets 9
Loading