Ecosystems and Hosts

Ecosystems & Hosts

Language ecosystems

postmortem parses lockfiles for 7 ecosystems. Offline parsing (the graph) works for all of them; the registry column is used by tree --online to find each package's source repo.

Ecosystem	Package managers / lockfiles	Online registry
Node	npm, pnpm, yarn (package-lock.json, pnpm-lock.yaml, yarn.lock)	npm registry
Python	pip, Poetry (requirements.txt, poetry.lock)	PyPI
Rust	Cargo (Cargo.lock)	crates.io
Ruby	Bundler (Gemfile.lock)	RubyGems
PHP	Composer (composer.lock)	Packagist
Go	modules (go.mod, go.sum)	(none — the module path is the repo)
Java	Maven, Gradle (pom.xml, build.gradle)	deps.dev
Homebrew	via system	formulae.brew.sh

Go, Java, and some others are flat-graph ecosystems offline (transitive parent edges can't always be reconstructed without the toolchain). postmortem emits a diagnostic when the graph is incomplete, so a small result is never silently read as "clean".

Code hosts (reputation)

Reputation stats (stars, creation date, last activity, archived, primary language) are pulled from three hosts:

Host	API	Auth (optional)
GitHub	api.github.com	GITHUB_TOKEN (raises the 60/h anonymous limit)
GitLab	gitlab.com/api/v4 (nested groups supported)	GITLAB_TOKEN
Codeberg	codeberg.org/api/v1 (Forgejo)	CODEBERG_TOKEN

A repo on any other host still resolves (its slug is shown) but its stats come back unavailable. See Configuration for tokens.

Mirror rewrites

Some canonical SCM hosts have no stats API but mirror to GitHub. postmortem rewrites those automatically:

• Apache gitbox (gitbox.apache.org, git-wip-us.apache.org) → github.com/apache/<repo>.
• Go vanity import paths → their GitHub mirror: golang.org/x/<r> → golang/<r>, k8s.io/<r> → kubernetes/<r>, sigs.k8s.io/<r> → kubernetes-sigs/<r>, gopkg.in/<pkg>.vN → go-<pkg>/<pkg> (and gopkg.in/<user>/<pkg>.vN → <user>/<pkg>).

Hosts and paths that don't map (Bitbucket, sr.ht, google.golang.org/*) resolve to no repository — reported honestly as unchecked, never guessed.