lockvet v0.6.4

pdm.lock support — format #61

PDM's lockfile completes lockvet's Python lineup: uv, poetry, pipenv,
requirements.txt, PEP 751 pylock.toml — and now PDM.

Every locked package gets the full PyPI treatment: OSV advisories with
the exact fixed in release, publish ages, registry-verified unlisted
checks, typosquat screening, and via-chains read from the lockfile's own
PEP 508 dependencies arrays:

pdm.lock (PyPI)
  ↑ cryptography  43.0.3 → 48.0.0  MAJOR  via secretstorage
      ▼ fixes GHSA-r6ph-v2qm-q3c2 (high) cryptography Vulnerable to a Subgroup Attack …
  ↑ pytest        8.4.2 → 9.0.3    MAJOR  via pytest-cov
      ▼ fixes GHSA-6w46-j5rx-g56g (moderate) pytest has vulnerable tmpdir handling

Details that matter:

• Per-artifact files hashes are integrity pins — a same-version
  hash edit flags ‼ REPINNED (version unchanged). The lock-wide
  [metadata] content_hash is never mistaken for one.
• Multi-target locks render honestly — one package locked at several
  versions for different Python ranges shows all of them.
• Git, path and direct-URL candidates are exempt from registry
  claims, like every other format.

Validated against 90 real lockfile-history replays (pdm-project/pdm,
datafolklabs/cement, laluka/bypass-url-parser): 0 failures, 0 false
alarms, 65 non-vacuous diffs. Works in the
playground too.

Install: brew install matteo-sung/tap/lockvet · go install github.com/matteo-sung/lockvet@v0.6.4 · more options