Skip to content

lockvet v0.3.19

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 22:10
v0.3.19
4d804ff

Conan support — lockfile format #30

conan.lock (C/C++) now gets the full lockvet treatment:

  • Both lockfile generations parse: Conan 2 flat lockfiles
    (requires / build_requires / python_requires / config_requires)
    and Conan 1 graph locks — whose node graph gives direct/via … origin
    labels. References pinned with a user/channel are marked non-registry
    and never checked against ConanCenter.
  • Release ages and the ⏱ cooldown flag straight from ConanCenter
    (the live center2.conan.io remote — the frozen legacy remote stopped
    receiving versions in 2024 and would misdate everything recent). A
    version is dated by its oldest recipe revision, so recipe re-exports
    don't make five-year-old releases look fresh. -fail-on fresh gives
    C/C++ diffs a one-flag cooldown gate.
  • Deliberately no unlisted claims: a Conan reference doesn't record
    which remote it came from, and real projects layer private remotes over
    ConanCenter for the same package names (XRPLF/rippled pins
    benchmark/1.9.5 alongside its own remote). Absence from ConanCenter
    proves nothing, so lockvet says nothing.
  • OSV's ConanCenter ecosystem is queried too — near-empty today, so
    advisories surface automatically as it fills in. Markdown output links
    package names to conan.io/center recipe pages.
  • The browser playground parses and classifies conan.lock diffs but
    skips the registry layer (ConanCenter sends no CORS headers).

Validated on the real lockfile histories of XRPLF/rippled and
memgraph/memgraph (45 commit replays, zero failures, zero noise).

New demo

The Sept 2025 chalk+debug npm takeover, replayed during its two-hour live
window — before any advisory existed:
docs/supplychain-demo.gif

Assets 9
Loading