Documentation
¶
Overview ¶
Package deps reports dependencies that are behind their upstream release. It reads manifests out of a repository's default branch and asks the ecosystem's registry what the current version is; it never executes a package manager, so the check needs no runner and no per-repo configuration beyond opting in.
Index ¶
Constants ¶
const ( EcoGo = "go" EcoNPM = "npm" EcoCargo = "cargo" EcoPyPI = "pypi" )
Ecosystems, in the order they are reported.
const IssueTitle = "Dependency updates available"
IssueTitle is fixed so the issue this worker maintains is recognizable across sweeps, in listings, and to the maintainer.
const MaxDeps = 300
MaxDeps bounds the work one repository can create for a sweep.
Variables ¶
This section is empty.
Functions ¶
func Body ¶
Body renders the issue: one table per ecosystem, sorted, so a diff between sweeps reads as a diff of what is behind.
func IsPrerelease ¶
IsPrerelease reports whether v carries a prerelease marker. Registries mostly hand back stable versions already; this keeps the exceptions from being suggested.
func Newer ¶
Newer reports whether latest is a strictly greater release than current. The four ecosystems agree on the part that matters here — dot-separated numbers, optionally followed by a suffix — so one tolerant comparison covers all of them. Anything it cannot read compares equal, which reports nothing rather than reporting noise.
Types ¶
type Client ¶
type Client struct {
HTTP *http.Client
Hosts map[string]string // overridden in tests
Version string // reported in User-Agent
}
Client queries package registries. The zero value is not usable; call NewClient.
type Dep ¶
Dep is one direct dependency read from a manifest.
func Scan ¶
Scan returns the direct dependencies of every ecosystem whose manifest is present, capped at MaxDeps. Dependencies whose version cannot be pinned to an exact release — a range, a git or path source, a workspace member — are left out: there is nothing meaningful to compare them against.
type ReadFile ¶
ReadFile returns a file from the tree being scanned, or an error when it is absent. Manifests are read from the repository root only; a monorepo with manifests in subdirectories is not scanned.
Source Files
¶
- cargo.go
- gomod.go
- manifest.go
- npm.go
- python.go
- registry.go
- report.go
- version.go
- worker.go