feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#115

Merged

Mikola Lysenko (mikolalysenko) merged 19 commits into

mainfrom

feat/vendor-overhaul

Jun 12, 2026

Commits on Jun 11, 2026

fix(purl): percent-decode purl components from the API

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): auto-force staging on content mismatch + correct already-applied events

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): take over exact-version override pins (pnpm + yarn berry)

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(scan): prune lifecycle for vendored packages

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
test: e2e coverage for encoded scoped purls, mismatch annotation, prune lifecycle

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): lockfile inventory module for npm-family locks

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): registry_fetch — verified pristine-artifact fetching

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor,scan): auto-fetch missing packages + lockfile/ledger discovery

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): yarn berry checksum-verified fetch + ledger artifact staging tests

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): cargo + golang lockfile inventory and verified fetch

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): composer + gem + pypi lockfile inventory and verified fetch

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(scan): all-ecosystem lockfile supplement + docs

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(apply): beforeHash mismatch warns and applies the full blob by default; --strict restores the hard error

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
polish(apply): decode percent-encoded purls in human output

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#115

feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#115
Mikola Lysenko (mikolalysenko) merged 19 commits into
mainfrom
feat/vendor-overhaul

Commits on Jun 11, 2026

fix(purl): percent-decode purl components from the API

feat(vendor): auto-force staging on content mismatch + correct already-applied events

feat(vendor): take over exact-version override pins (pnpm + yarn berry)

feat(scan): prune lifecycle for vendored packages

test: e2e coverage for encoded scoped purls, mismatch annotation, prune lifecycle

feat(vendor): lockfile inventory module for npm-family locks

feat(vendor): registry_fetch — verified pristine-artifact fetching

feat(vendor,scan): auto-fetch missing packages + lockfile/ledger discovery

feat(vendor): yarn berry checksum-verified fetch + ledger artifact staging tests

feat(vendor): cargo + golang lockfile inventory and verified fetch

feat(vendor): composer + gem + pypi lockfile inventory and verified fetch

feat(scan): all-ecosystem lockfile supplement + docs

feat(apply): beforeHash mismatch warns and applies the full blob by default; --strict restores the hard error

polish(apply): decode percent-encoded purls in human output

Commits on Jun 12, 2026

feat(vendor): hold patch blobs in memory — vendoring writes no .socket/blobs or temp files

feat(repair): rebuild missing/corrupt vendored artifacts + no-ledger reconstruction

fix(pnpm): bind vendor edits to name@VERSION — multi-version vendoring corrupted the lock

test(docker): pin scan --sync to --strict where apply --force must stay the writer

test(docker): pin the content_mismatch_overwritten warning in the force-apply gates