Lockray v0.2.0

Lockray v0.2.0

Review real dependency upgrades, with evidence you can reproduce offline.

Real examples and checks · Comparison model · Source

These notes describe the v0.2.0 source changes. Source and static-site packages are produced from the committed tag by the release workflow; each archive has a SHA-256 digest.

Real historical examples

The browser adds a Real upgrade cases picker with four unchanged upstream before/after lockfile pairs:

• Axios development refresh: 29 changed installed locations.
• Axios dependency-tree refresh: 187 changes, including 29 additions and 37 removals.
• Marked npm update: 24 changed locations and a useful bundled-integrity edge case.
• PDF.js eslint-plugin-jsdoc major upgrade: 8 changed locations.

The picker displays source commits and attribution. It validates raw lockfile bytes against pinned SHA-256 values before analysis. Files are served with the app, so exploring them needs no GitHub token, registry service, or upstream installation. Full source references, hashes, expected counts, and license notices ship with the examples.

Three model corrections

1. Reduce bundled-integrity noise. The Marked example previously generated nine missing-integrity signals for bundled packages whose individual hashes were already absent. Those now become an aggregate coverage note. Ordinary missing-integrity signals and real checksum loss remain visible. This does not verify package bytes or certify safety.
2. Preserve duplicate root declarations. The effective root order now agrees with the checked npm Arborist implementation: development > optional > production > peer. Every declaration remains in JSON and Markdown, and edits to overridden declarations are reported even if installed versions do not change.
3. Accept opaque sibling-link targets. npm-generated ../sibling and other external target descriptors no longer fail internal installed-slot validation. They remain outside graph expansion and filesystem access; project installation slots remain strictly validated.

Validation

The local source passed 48 tests covering the core, CLI, unmodified real snapshots, independent diff/lookup checks, and focused regressions. npm run test:real repeats the real-case checks offline. A separate cross-check against already installed npm Arborist 9.7.0 found no differences in supported targets, shortest paths, or root ownership across all four pairs.

The native Node oracle uses a non-builtin lookup probe so declared npm shims such as string_decoder remain represented in the installed tree. This corrects an oracle limitation rather than a product bug. See REAL-CASES.md for commands, scope, and provenance; remote build/release evidence is recorded separately in VALIDATION.md as it becomes available.

Boundaries

Lockray still compares npm v2/v3 by exact installed location. Paths describe recorded reachability, not resolver decisions or runtime imports. Other lockfile ecosystems, workspace/link expansion, tarball inspection, and vulnerability scanning remain outside the model. No runtime dependencies, analytics, accounts, or remote analysis service are added. Exports retain package names, paths, and metadata, so review them before sharing.

Workbench improvements

Root sidebars now scroll within the workbench when real projects contain dozens of direct dependencies. The selected project name clears immediately when switching inputs. User-file imports discard both public-example snapshots before accepting the new pair, and exports remain unavailable until a complete comparison is ready.