Skip to content

Lockray v0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 16:57
· 4 commits to main since this release
v0.1.0
69ba814

Lockray v0.1.0

See the chain reaction in your npm lockfile.

Try the browser app · Read the model

The first release turns two npm package-lock.json snapshots into an interactive dependency review. Select a direct dependency to inspect its reachable changes, then compare a changed package's shortest before/after paths.

  • npm lockfile v2/v3 comparison by exact installation location, including scoped and nested copies.
  • Separate additions, removals, version changes, metadata changes, and root dependency declaration changes.
  • Shared-dependency attribution, root impact bars, package/path search, change filters, and a before/after evidence inspector.
  • Contextual review prompts for recorded install-script, source, and integrity changes. These are metadata heuristics, not vulnerability findings.
  • English and Simplified Chinese browser UI; local file selection, drag-and-drop and JSON paste; cancellable Worker analysis.
  • Complete Markdown and JSON review exports, independent of the current UI filters.
  • A matching dependency-free Node.js CLI, including output overwrite protection and optional --fail-on-signals.

Downloads

Asset Purpose
lockray-0.1.0-source.zip Source, CLI, tests, documentation and samples. Extract, then run npm start with Node.js 22+. No install step is needed.
lockray-0.1.0-site.zip Prebuilt static browser app. Extract into an HTTP/HTTPS static host. Opening it through file:// is unsupported.
SHA256SUMS.txt SHA-256 checksums for the two ZIP files.

Keep the files together and verify them with shasum -a 256 -c SHA256SUMS.txt on macOS, or sha256sum -c SHA256SUMS.txt on Linux. Archives are generated from this release's committed tag with fixed ZIP timestamps.

Validation and boundaries

The 22-test core/CLI suite and static build passed before publication. Desktop Chromium flows covered sample loading, local file imports, JSON paste, root/type/signal filters, search, metadata escaping, error recovery, report download, and a 390-pixel mobile viewport. See the validation record.

Inputs stay in local browser/CLI memory; Lockray does not install packages, fetch registry data or send input to an analysis server. Exports retain package names, paths and metadata: review them before sharing.

Paths describe recorded dependency reachability, not npm resolver decisions or runtime usage. Workspace/link expansion and other lockfile formats are outside v0.1. Large reports have documented attribution and path-output budgets with explicit coverage notes.

Assets 5
Loading