Lockray v0.2.0

Lockray v0.2.0

Review real dependency upgrades, with evidence you can reproduce offline.

Real examples and checks · Comparison model · Source

These notes describe the v0.2.0 source changes. Source and static-site packages are produced from the committed tag by the release workflow; each archive has a SHA-256 digest.

Real historical examples

The browser adds a Real upgrade cases picker with four unchanged upstream before/after lockfile pairs:

• Axios development refresh: 29 changed installed locations.
• Axios dependency-tree refresh: 187 changes, including 29 additions and 37 removals.
• Marked npm update: 24 changed locations and a useful bundled-integrity edge case.
• PDF.js eslint-plugin-jsdoc major upgrade: 8 changed locations.

The picker displays source commits and attribution. It validates raw lockfile bytes against pinned SHA-256 values before analysis. Files are served with the app, so exploring them needs no GitHub token, registry service, or upstream installation. Full source references, hashes, expected counts, and license notices ship with the examples.

Three model corrections

1. Reduce bundled-integrity noise. The Marked example previously generated nine missing-integrity signals for bundled packages whose individual hashes were already absent. Those now become an aggregate coverage note. Ordinary missing-integrity signals and real checksum loss remain visible. This does not verify package bytes or certify safety.
2. Preserve duplicate root declarations. The effective root order now agrees with the checked npm Arborist implementation: development > optional > production > peer. Every declaration remains in JSON and Markdown, and edits to overridden declarations are reported even if installed versions do not change.
3. Accept opaque sibling-link targets. npm-generated ../sibling and other external target descriptors no longer fail internal installed-slot validation. They remain outside graph expansion and filesystem access; project installation slots remain strictly validated.

Validation

The local source passed 48 tests covering the core, CLI, unmodified real snapshots, independent diff/lookup checks, and focused regressions. npm run test:real repeats the real-case checks offline. A separate cross-check against already installed npm Arborist 9.7.0 found no differences in supported targets, shortest paths, or root ownership across all four pairs.

The native Node oracle uses a non-builtin lookup probe so declared npm shims such as string_decoder remain represented in the installed tree. This corrects an oracle limitation rather than a product bug. See REAL-CASES.md for commands, scope, and provenance; remote build/release evidence is recorded separately in VALIDATION.md as it becomes available.

Boundaries

Lockray still compares npm v2/v3 by exact installed location. Paths describe recorded reachability, not resolver decisions or runtime imports. Other lockfile ecosystems, workspace/link expansion, tarball inspection, and vulnerability scanning remain outside the model. No runtime dependencies, analytics, accounts, or remote analysis service are added. Exports retain package names, paths, and metadata, so review them before sharing.

Workbench improvements

Root sidebars now scroll within the workbench when real projects contain dozens of direct dependencies. The selected project name clears immediately when switching inputs. User-file imports discard both public-example snapshots before accepting the new pair, and exports remain unavailable until a complete comparison is ready.

Lockray v0.1.0

Lockray v0.1.0

See the chain reaction in your npm lockfile.

Try the browser app · Read the model

The first release turns two npm package-lock.json snapshots into an interactive dependency review. Select a direct dependency to inspect its reachable changes, then compare a changed package's shortest before/after paths.

• npm lockfile v2/v3 comparison by exact installation location, including scoped and nested copies.
• Separate additions, removals, version changes, metadata changes, and root dependency declaration changes.
• Shared-dependency attribution, root impact bars, package/path search, change filters, and a before/after evidence inspector.
• Contextual review prompts for recorded install-script, source, and integrity changes. These are metadata heuristics, not vulnerability findings.
• English and Simplified Chinese browser UI; local file selection, drag-and-drop and JSON paste; cancellable Worker analysis.
• Complete Markdown and JSON review exports, independent of the current UI filters.
• A matching dependency-free Node.js CLI, including output overwrite protection and optional --fail-on-signals.

Downloads

Asset	Purpose
lockray-0.1.0-source.zip	Source, CLI, tests, documentation and samples. Extract, then run npm start with Node.js 22+. No install step is needed.
lockray-0.1.0-site.zip	Prebuilt static browser app. Extract into an HTTP/HTTPS static host. Opening it through file:// is unsupported.
SHA256SUMS.txt	SHA-256 checksums for the two ZIP files.

Keep the files together and verify them with shasum -a 256 -c SHA256SUMS.txt on macOS, or sha256sum -c SHA256SUMS.txt on Linux. Archives are generated from this release's committed tag with fixed ZIP timestamps.

Validation and boundaries

The 22-test core/CLI suite and static build passed before publication. Desktop Chromium flows covered sample loading, local file imports, JSON paste, root/type/signal filters, search, metadata escaping, error recovery, report download, and a 390-pixel mobile viewport. See the validation record.

Inputs stay in local browser/CLI memory; Lockray does not install packages, fetch registry data or send input to an analysis server. Exports retain package names, paths and metadata: review them before sharing.

Paths describe recorded dependency reachability, not npm resolver decisions or runtime usage. Workspace/link expansion and other lockfile formats are outside v0.1. Large reports have documented attribution and path-output budgets with explicit coverage notes.