2be1e5f009
Update go version to 1.25 & Add steps for introducing new package manager ( #78 )
...
* upgrade go version to 1.25.1
* introduce doc for steps for creating a new pkg manager
* Update docs/package-manager.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update docs/package-manager.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update docs/package-manager.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-12-08 09:36:32 +05:30
Abhisek Datta and GitHub
47fc5252ba
fix: Add pip3 shell alias ( #76 )
2025-12-04 09:49:43 +05:30
Sahil Bansal and GitHub
50d7b55445
Add Pip3 support ( #75 )
...
* add pip3 support
* add pip3 e2e
* chore: rename var
2025-12-03 20:28:45 +05:30
Sahil Bansal and GitHub
c47cb30de0
Add pmg E2E Tests ( #73 )
...
* add pmg e2e tests
* pin sha version
* pin python sha version
* add pmg to path
* fix pnpm init
* fix pnpm init
* rm poerty verification
* fix poetry verification
* comment poetry verification
* fix poetry error
* add poetry verification back
* fix poetry error
* add yarn e2e
* fix yarn installation
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
2025-12-01 12:13:24 +05:30
Sahil Bansal and GitHub
34750d71d3
update report url ( #74 )
2025-11-11 21:19:53 +05:30
Shrvan Sudhakara and GitHub
03bd697ae0
Add support for yarn package manager ( #72 )
...
* Add support for yarn package manager
- Added yarn command handler in cmd/npm/yarn.go
- Added DefaultYarnPackageManagerConfig() in packagemanager/npm.go
- Added yarn dev flag support (--dev/-D) in ParseCommand()
- Added yarn analytics tracking in internal/analytics/event.go
- Registered yarn command in main.go
- Added yarn to alias setup in internal/alias/alias.go
- Added comprehensive test suite in packagemanager/yarn_test.go
- All tests passing (12 yarn tests + existing tests)
Resolves #30
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
* docs: update README with yarn package manager support
Updated documentation to reflect yarn support addition:
- Changed yarn status from '🚧 Planned' to '✅ Active' in package managers table
- Added 'pmg yarn add <package>' command example
- Added 'yarn add <package-name>' to command list
- Added 'yarn install # Uses yarn.lock' to lockfile examples
This documentation update corresponds to the yarn implementation in the previous commit.
Related to #30
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
* fix: address review feedback for yarn support
- Add support for bare 'yarn' command as manifest install
- Validate yarn install does not accept package names
- Add YarnExtractor for yarn.lock file support
Changes:
- packagemanager/npm.go: Added bare yarn command handling and validation
- packagemanager/yarn_test.go: Added test for bare yarn command
- extractor/ecosystems.go: Added Yarn PackageManagerName and extractor
- extractor/npm.go: Added YarnExtractor implementation
- go.mod, go.sum: Updated dependencies
Addresses review feedback from @Sahilb315
- Bare yarn command now triggers manifest install per docs
- yarn install <package> is now properly rejected
- yarn.lock extraction support added
Related to #30
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
* chore: tidy go.mod and go.sum to remove unused dependencies
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
* fix: add yarn.lock extractor mapping
- Add yarn.lock case in getExtractorForFile switch
- Import yarnlock extractor from osv-scalibr
- Enables lockfile parsing for manifest-based installations
Tested both package-based and manifest-based installations successfully.
Addresses review feedback from @Sahilb315
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
* test: add validation test for yarn install with package name
- Add test case to verify 'yarn install <package>' is rejected
- Ensures invalid syntax returns no install targets
- Confirms IsManifestInstall is false for invalid commands
Addresses review feedback from @Sahilb315
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
---------
Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com >
2025-11-05 13:49:19 +05:30
Sahil Bansal and GitHub
12aaba8a05
add poetry command ( #67 )
...
* add poetry command
* add poetry.lock extractor & define cmd parser for poetry
* feat: support Poetry caret/tilde version syntax
* add wildcard constraint support & test cases
* readme update
* chore: small fixes
2025-08-29 00:21:09 +05:30
Sahil Bansal and GitHub
78bc6afa67
fix command parsing for unknown flags ( #70 )
...
* fix command parsing for unknown flags
* fix test case
* add dev flag support for npm cmds
2025-08-28 21:17:59 +05:30
Sahil Bansal and GitHub
099dc45958
update docs ( #71 )
2025-08-28 20:53:24 +05:30
Kunal Singh and GitHub
cd8fb52c47
feat: new pmg banner ( #68 )
...
* feat: new pmg banner
* commit lenght check
2025-08-21 23:01:30 +05:30
Abhisek Datta and GitHub
2493fb4dc6
chore: Better user friendly error messages ( #64 )
2025-08-21 18:26:05 +05:30
Sahil Bansal and GitHub
cd306884e3
add trufflehog secret scan CI ( #63 )
2025-08-13 15:49:12 +05:30
Sahil Bansal and GitHub
fd7d83704f
feat/#28 uv support ( #62 )
...
* follow proper consistent naming in pypi packagemanager
* follow proper consistent naming in pypi packagemanager - 2
* feat: add specialized command parsers to handle pip and uv command formats
* add uv support & modify extractor to be more robust
* add uv alias
* refactor var name & add error handling
* update readme & add support for `uv pip sync` cmd
2025-08-06 21:10:51 +05:30
Sahil Bansal and GitHub
2cbb24b3b1
docs/improve readme and alias text ( #60 )
...
* fix readme TOC links
* add note for removing aliases
* give a clear msg for removing aliases
2025-07-30 16:42:02 +05:30
Sahil Bansal and GitHub
6d39fc0dde
fix publish npm test installations ( #59 )
2025-07-29 21:54:58 +05:30
Sahil Bansal and GitHub
a1b1c3a0c2
add bun alias in setup cmd ( #58 )
2025-07-29 18:38:34 +05:30
Sahil Bansal and GitHub
e184e914a3
fix: improve error wrapping & preserving the error ( #57 )
2025-07-28 18:03:29 +05:30
Sahil Bansal and GitHub
c486834c2e
feat/#55 bun support ( #56 )
...
* add support for bun package manager
* update readme
2025-07-28 17:23:32 +05:30
Sahil Bansal and GitHub
49b2371cc3
fix: invalid cross-device link ( #54 )
...
* fix: invalid cross-device link
* version flag fix in workflow
* remove version from package.json
2025-07-04 20:56:31 +05:30
74248cd74a
Publish pmg to npm ( #50 )
...
* feat: pmg publish to npm
* feat: add github action for publishing to npm
* Update publish/npm/install.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update .github/workflows/publish-npm.yml
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* refactor: define constants
* refactor: improve npm package reliability with removing dynamic handlers and better error handling and validation
* fix: publish-npm workflow
* Update publish/npm/test.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* refactor(npm-workflow): use a more portable loop construct
* refactor: remove version field from package.json
* feat: use os.tmpdir() with mkdtempSync for cleaner temp directory handling
* fix: add redirect limit and cleanup to prevent infinite redirects and resource leaks
* remove test.js for npm publisher pack
* chore: test cmd cleanup
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
2025-07-04 12:42:37 +05:30
Sahil Bansal and GitHub
ca752edf79
feat: add suppport for bypassing the blocking behavior of malicious packages ( #53 )
...
* feat: add suppport for bypassing the blocking behavior of malicious packages
* feat: add InsecureInstallation config to bypass malware scanning with tests
* ui: introduce ShowWarning interaction method
* guard test fix
2025-07-02 19:09:27 +05:30
0e17378d3e
feat: add posthog analytics support ( #52 )
...
* feat: add posthog analytics events
* Update internal/analytics/analytics.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-06-30 09:47:14 +05:30
Sahil Bansal and GitHub
0a62473e9a
Docs/add instructions for setup cmds ( #45 )
...
* docs: add instructions for installing & removing aliases
* refactor: fix cmd name
* add diff sections for usage
* add section in index
2025-06-24 18:17:06 +05:30
Sahil Bansal and GitHub
d363167981
feat: add setup & remove cmd for better UX ( #43 )
...
* feat: add setup & remove cmd for better UX
* refactor(alias): improve separation of concerns and fix shell sourcing
* chore: remove extra/unused folder
* refactor: introduce separate files for shells
* fix: use temp files for safe shell config modification
2025-06-24 12:46:21 +05:30
Sahil Bansal and GitHub
3f85282935
fix: pip args & manifest files handling ( #41 )
...
* fix: pip args & manifest files handling
* chore: add pflag dependency
* chore: word fixes
* fix: multiple refs for suspicious packages
* refactor: introduce block config
* fix: makefile for windows build
* test: add test cases for manifest based installation
* refactor: Makefile
* refactor: remove .exe for windows build
2025-06-24 12:44:12 +05:30
Sahil Bansal and GitHub
b64f158654
fix: resolve dependencies for manifest file scans ( #40 )
...
* fix: resolve dependencies for manifest file scans
* fix: resolve dependencies for manifest file scans
* fix: resolve dependencies for manifest file scans - 2
* revert back to traditional for loop
* fix(manifest-scan): resolve deps only for requirements.txt
2025-06-16 15:18:45 +05:30
Sahil Bansal and GitHub
8f8ca7fd5c
docs: update limitation for pypi registry scanning only ( #39 )
2025-06-12 21:08:41 +05:30
5e9f2af972
Support for scanning manifest files ( #36 )
...
* feat: add extractor logic for manifest files
* feat: add manifest-based package installation detection
* feat: add osv-scanner for extracting lockfiles
* refactor: add comment for cmd parse
* refactor: add Ecosystem() method to PackageManager interface
* refactor: implement package-manager-specific extractors & replace osv-scanner with scalibr
* Update extractor/extractor.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-06-12 18:58:58 +05:30
Sahil Bansal and GitHub
302e17fe48
docs: Update supported package managers for pip ( #37 )
...
* docs: update supported package managers for pip
* Update README.md
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
2025-06-10 18:46:32 +05:30
53783c6604
feat: Add support for pip Package Manager ( #33 )
...
* feat/init-pip-cmd
* feat: Add PyPi resolver
* test: Add tests for pypi and pypi_resolver
* refactor: unify package dependency resolution and improve PyPI version handling using registry adapter
* chore: remove unused file
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* feat: add Python dependency parsing with extras support
* refactor(deps): Improve PyPI dependency resolution and add custom resolver support
* chore: remove extra file
* fix: improve dependency resolution and package deduplication
* chore: remove extra print statement
* chore: typo fix
* feat: support PyPi package extras
* test: add test for pypi dependency parse function
* fix: remove overwritten of parsedCmd
* chore: remove extra print statement
* chore: typo fix
* feat: support PyPi package extras
* test: add test for pypi dependency parse function
* fix: remove overwritten of parsedCmd
* refactor: enhance code readability & remove extra code
* chore: remove extra code
* Update cmd/npm/npm.go
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update cmd/npm/pnpm.go
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update cmd/pypi/pip.go
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com >
2025-06-09 17:37:08 +05:30
4031219375
fix: Show error messages on fatal failures #32 ( #34 )
...
* fix: Show error messages on fatal failures #32
* test: Add E2E test
* test: fix E2E scripts
* test: fix E2E scripts
* fix: Race condition in concurrent analyzer
* fix: update formatting to ensure docs URL is clickable
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* fix: E2E test
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2025-05-17 21:54:47 +05:30
Abhisek Datta and GitHub
b85f77cfbc
feat: Add support for active scanning in paranoid mode ( #31 )
...
* feat: Add support for active scanning in paranoid mode
* docs: Fix README
2025-05-16 19:38:06 +05:30
Hanshal Mehta and GitHub
81d4875b8d
feat: add version command ( #26 )
2025-05-16 09:41:48 +05:30
Kunal Singh and GitHub
d8d7bda8ca
docs: add brew installation setup in readme ( #25 )
...
* docs: add brew installation setup in readme
Signed-off-by: Kunal Singh <kunalsin9h@gmail.com >
* updated TOC
Signed-off-by: Kunal Singh <kunalsin9h@gmail.com >
* removed also for 1st install option
Signed-off-by: Kunal Singh <kunalsin9h@gmail.com >
---------
Signed-off-by: Kunal Singh <kunalsin9h@gmail.com >
2025-05-15 22:24:02 +05:30
Abhisek Datta and GitHub
7c9681ef00
Multiple Misc Updates ( #23 )
...
* docs: Update README
* docs: Add badges
2025-05-15 21:34:41 +05:30
Sudhanshu Dasgupta and GitHub
6c7e3b875a
Add new intro image ( #24 )
...
* add new into image
Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com >
* replace image
Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com >
---------
Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com >
2025-05-15 20:16:03 +05:30
Abhisek Datta and GitHub
5022d64ce4
chore: Improve UX ( #22 )
2025-05-15 18:03:46 +05:30
Abhisek Datta and GitHub
cfde1d7632
ci: Add CodeQL and OpenSSF Scorecard action ( #21 )
2025-05-15 16:59:13 +05:30
Abhisek Datta and GitHub
e86b6ef056
feat: Refactor PMG to Maintain Separation of Concerns and Clean Architecture ( #19 )
...
* feat: Add separate package manager and resolver
* fix: Npm dependency resolver
* feat: Add analyzer for malysis query
* feat: Add package manager guard as the orchestrator
* feat: Add PMG to orchestrate installation
* Add concurrent scan execution
* Introduce package manager interaction abstraction
* feat: Add UI port for guard
* Remove refactored source files
* Update README
* fix: CI script for multi-arch build
* ci: goreleaser CI fix
* fix: npm command parser to extract package names
* feat: Introduce global config primitive
* fix: Close results channel for clean goroutine exit
* ci: Add container image releaser
* test: Improve test for npm resolver
* refactor: Analyzer to generalise
* Improve UI with additional info
* fix: Goreleaser config
* fix: npm resolver bug
* fix: Fail when command exec workflow fails
* fix: Bug with transitive dependency resolution
* fix: Synchronize common data update in dependency resolver
* chore: Improve log handling
* docs: Update README
* fix: UI text wrapping
* fix: UI handling bugs
* feat: Use concurrent dependency resolver
2025-05-15 16:50:59 +05:30
8b46964c7a
fix(npm): handle multiple packages and flag parsing correctly ( #17 )
...
* fix(npm): handle multiple packages and flag parsing correctly
- Fixes issue where only the first package was scanned; now all packages in install command are parsed and processed.
- Correctly separates flags (e.g., --save-dev) from package names to avoid treating them as packages.
- Applies same fixes to both npm and pnpm flows.
- Updated wrapper to scan all packages before installing, maintaining original CLI behavior.
* refactor: fixed the registry type
* feat: continue installing other packages if one is denied
* Update pkg/wrapper/npm_base.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* fix(wrapper): exit gracefully for user-rejected packages
* fix: remove env validation
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-05-12 09:23:08 +05:30
Sahil Bansal and GitHub
f7855e99a2
docs: add CONTRIBUTORS and MAINTAINERS files, update README ( #18 )
...
* docs: README update
* docs: introduce CONTRIBUTING.md
* docs: introduce MAINTAINERS.txt
2025-05-11 22:42:27 +05:30
Sahil Bansal and GitHub
86f8bd42b7
replace AnalysePackage with QueryPackageAnalysis API & use community API ( #15 )
2025-05-11 22:41:34 +05:30
6a28fb16a1
refactor: improve progress bar logic and update display ( #14 )
...
* fix: Revise progress tracking mechanism
* chore: remove unused getDependencies func
* chore: removed unused property & add fetcher check
* Update pkg/wrapper/npm_base.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* refactor: make SetProgressTracker common for all fetchers
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-05-06 16:35:59 +05:30
df754ccc82
Add colorful outputs & remove md text ( #13 )
...
* fix: parsePackageInfo to handle pkg names with special character
* Enhance pmg outputs by adding colors and removing markdown notions
* Update pkg/wrapper/npm_base.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update npm_base.go
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* test: add tests for removeMarkdown
* chore: remove duplicate code
* refactor: convert TerminalColors to global var and split markdown utils
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-05-05 23:32:34 +05:30
Sahil Bansal and GitHub
88f39b56ff
fix: parsePackageInfo to handle pkg names with special character ( #11 )
...
* fix: parsePackageInfo to handle pkg names with special character
* test: add tests for CleanVersion and ParsePackageInfo util functions
2025-05-04 18:50:13 +05:30
Sahil Bansal and GitHub
5a6b842360
add goreleaser & goreleaser workflow ( #8 )
2025-05-02 12:37:27 +05:30
Sahil Bansal and GitHub
1aa4b06f41
Pnpm suppport ( #6 )
...
* fix: resolves issues #3 and #4
* feat: add pnpm support & introduce pkg manager wrap for npm
2025-04-30 14:26:38 +05:30
Abhisek Datta and GitHub
ec010c7d6b
Merge pull request #1 from safedep/feat/npm-support
...
project initialisation & added npm cmd support
2025-04-29 09:06:05 +05:30
Sahilb315
4f13dfbb40
chore: clean unused deps
2025-04-29 01:52:35 +05:30
Sahilb315
d4a31b14c0
ci: add vet ci
2025-04-29 01:41:50 +05:30
