New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

@lyv/depwatch

Package Overview
Dependencies
Maintainers
1
Versions
4
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@lyv/depwatch

Detects dependency changes so you know when you need to restore them

  • 0.1.8
  • latest
  • Source
  • npm
  • Socket score

Version published
Maintainers
1
Created
Source

Dep-watch

dep-watch is a tool for detecting changes to dependencies so you know whether anything needs to be restored. This is useful for workflows that involve frequent merging of other branches. Rather than always running npm i or pod install after every merge to be certain that you have the latest dependencies installed, just run dep-watch to know what to restore.

This is done by storing a snapshot of the dependencies, and comparing to the snapshot when ran. Default snapshot file is ./depwatch.cache.json. You will likely want to include the snapshot file in your .gitignore file. If you are using the default file name you can do this automatically by running depwatch gitignore from the project root.

Motivation

Most of my work is done in react-native. I am frequently changing branches, merging changes, etc. As part of my workflow I have become accustomed to running npm ci && (cd ios && pod install) frequently to ensure that all dependencies are correct before running the application. For large projects with multiple pre- and post-install scripts this often takes 2-5 minutes to run to completion. In order to save some time, I decided to build a tool that would detect if any changes were made to dependencies, so I could have confidence skipping this step without having to diff the dependency manifests manually.

Disclaimer

This library is currently being built for my specific use cases. At this time I will not be implementing requested features that are not in the Future Work section. If you have a feature that you would like to include, please contact me or put in a pull request.

Installation

npm install -g @lyv/depwatch

Usage

depwatch [command] [options]

CLI Commands

Check

Performs comparison of dependencies with the snapshot.

Gitignore

Appends an entry in the .gitignore file to prevent the default snapshot file from being commited.

Update

Updates the snapshot without running check. Recommended to add this to postinstall script to ensure that it is kept in sync.

CLI options

OptionAliasDescription
all-aChecks for changes to all dependencies
restore-rRestore dependencies if missing
update-uUpdate the snapshot
node-nCheck for changes to JavaScript dependencies
pods-nCheck for changes to CocoaPod dependencies (not implemented)

Package.json

Alternatively, you can specify configuration in the package.json file.

{
    "depwatch": {
        "cacheFile": "./cache/depwatch.cache.json", // path to dependency cache file
        "checkNode": true,                          // Whether to check JavaScript dependencies
        "restore": true                             // Whether to restore missing dependencies
    }
}

Future work

  • support for CocoaPods
  • ability to restore packages automatically from dep-watch
  • option to only restore dependencies that have changed
  • option to store configuration in .depwatchrc instead of just package.json
  • add watcher

Keywords

FAQs

Package last updated on 31 Jan 2020

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc