lockvet v0.4.0

lockvet audit — vet what you pin right now, not a change

Everything lockvet did so far explained a diff. lockvet audit answers the
other question — "is anything we currently depend on known-bad?" — the one
you ask after supply-chain-attack news, on a codebase you just inherited, or
as a nightly hygiene check.

$ lockvet audit    # in sharkdp/fd

Cargo.lock (crates.io · 126 packages)
  • anyhow            1.0.102  (direct)  (5mo old)
      ▲ affected by RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()`
  • crossbeam-epoch   0.9.18  via ignore › crossbeam-deque  (2y old)
      ▲ affected by RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl…
  • proc-macro-error2 2.0.1  via jiff › … › defmt-macros  (23mo old)
      ▲ affected by RUSTSEC-2026-0173 proc-macro-error2 is unmaintained

audited 126 packages across 1 lockfile · 24 direct, 102 transitive · 3 advisories affecting 3 packages

• Walks the tree (skipping node_modules, vendor, .git, …), reads every
  lockfile in all 30 formats (SBOMs included), and shows only findings.
• Flags, per pinned version: known advisories (OSV.dev, MAL-*
  malicious-package advisories included), versions missing from their
  registry's index while siblings are listed — the shape of an
  unpublished/pulled malicious release (a lockfile still pinning Sept 2025's
  chalk@5.6.1 trips both flags), deprecated / retracted / yanked /
  abandoned pins with upstream reasons, and pins published only days
  ago (⏱ -fresh-days).
• Composes like diff mode: -md, -json, -only "@babel/*",
  -fail-on vuln,unlisted,…, and -sarif — audit alerts say "is pinned
  at" and anchor to the exact lockfile line, so a scheduled workflow keeps
  Code Scanning honest between dependency PRs (recipe in the README).
• Also available as the MCP audit tool, so your coding agent can answer
  "are we affected by yesterday's npm attack?" with data.
• Transition-based signals (⚙ install scripts added, ⛨ provenance
  dropped) stay diff-only: an audit reports state, not history.

False-positive fixes (found by audit's full-tree coverage, affected diff mode too)

• go.mod replace directives are now honoured. Replaced modules —
  the monorepo require sibling v0.0.0 + replace => ../path pattern — no
  longer get unlisted flags or advisories matched against the v0.0.0
  sentinel, which sits below every advisory's fixed range and previously
  attracted the module's complete historical advisory list. Auditing
  grafana/grafana: 282 → 57 advisories, 85 → 0 unlisted flags.
• yarn npm: alias descriptors (wrap-ansi-cjs@npm:wrap-ansi@^7.0.0)
  no longer produce unlisted flags for the alias name, which doesn't exist
  on the registry.

Install: brew install matteo-sung/tap/lockvet · go install github.com/matteo-sung/lockvet@v0.4.0 · docker run ghcr.io/matteo-sung/lockvet:0.4.0 · more options