feat: maintenance risk detection with --check-maintenance (DM001)#854
Merged
Conversation
…te scope for deprecated check
…ing overrideFindings
…ix, not the parent's upgrade target
…eck-maintenance Real npm install snapshot of @sentry/nextjs@9.47.1, whose transitive uuid and @opentelemetry/core dependencies are pinned below their real CVE fix versions, requiring a major-version upgrade of the parent. Confirms DM001 detection works end-to-end against live OSV/registry data, not just the mocked unit tests.
…r style, closing summary, no double blank line
…with one that actually fails on the bug
…ort, matching override hygiene
… styling with the Findings table Both panels used an older boxed-panel style (bordered container, severity-group header rows, left-border color stripe) that visibly clashed with the Findings table's flush, badge-based layout in the same report. Switches both to flat rows sorted by severity, a sev-badge severity pill per row, and pkg-name/pkg-version styled package cells, reusing the Findings table's existing global CSS classes rather than introducing new ones.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
--check-maintenance(DM001), a maintenance-risk detector that surfaces direct dependencies which either block a transitive CVE fix through a major-version constraint drag, or are marked deprecated on npm. Findings render as a "Maintenance Risk" section in the terminal, thread into JSON and the HTML report, work across multi-folder/workspace scans, and count toward--fail-on.The detector reuses existing finding data and the npm packument path, so there is no new scan surface and offline mode simply skips the deprecated check. A new
examples/dm001-maintenance-dragfixture (a real@sentry/nextjssnapshot whose transitiveuuidand@opentelemetry/coreare pinned below their CVE fixes) exercises the feature end to end.While wiring the HTML output, the Override Hygiene and Maintenance Risk report tables were unified with the main Findings table styling (flat rows, severity badges, no boxed panel) so all three read as one system.
Closes #732