feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#114

Closed

Mikola Lysenko (mikolalysenko) wants to merge 14 commits into

mainfrom

feat/apply-mismatch-warning

Commits on Jun 11, 2026

fix(purl): percent-decode purl components from the API

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): auto-force staging on content mismatch + correct already-applied events

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): take over exact-version override pins (pnpm + yarn berry)

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(scan): prune lifecycle for vendored packages

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
test: e2e coverage for encoded scoped purls, mismatch annotation, prune lifecycle

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): lockfile inventory module for npm-family locks

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): registry_fetch — verified pristine-artifact fetching

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor,scan): auto-fetch missing packages + lockfile/ledger discovery

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): yarn berry checksum-verified fetch + ledger artifact staging tests

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): cargo + golang lockfile inventory and verified fetch

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(vendor): composer + gem + pypi lockfile inventory and verified fetch

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(scan): all-ecosystem lockfile supplement + docs

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
feat(apply): beforeHash mismatch warns and applies the full blob by default; --strict restores the hard error

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
polish(apply): decode percent-encoded purls in human output

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#114

feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply#114
Mikola Lysenko (mikolalysenko) wants to merge 14 commits into
mainfrom
feat/apply-mismatch-warning

Commits on Jun 11, 2026

fix(purl): percent-decode purl components from the API

feat(vendor): auto-force staging on content mismatch + correct already-applied events

feat(vendor): take over exact-version override pins (pnpm + yarn berry)

feat(scan): prune lifecycle for vendored packages

test: e2e coverage for encoded scoped purls, mismatch annotation, prune lifecycle

feat(vendor): lockfile inventory module for npm-family locks

feat(vendor): registry_fetch — verified pristine-artifact fetching

feat(vendor,scan): auto-fetch missing packages + lockfile/ledger discovery

feat(vendor): yarn berry checksum-verified fetch + ledger artifact staging tests

feat(vendor): cargo + golang lockfile inventory and verified fetch

feat(vendor): composer + gem + pypi lockfile inventory and verified fetch

feat(scan): all-ecosystem lockfile supplement + docs

feat(apply): beforeHash mismatch warns and applies the full blob by default; --strict restores the hard error

polish(apply): decode percent-encoded purls in human output