pkg-fence

pkg-fence

A command line tool that glance over package lockfile.

Usage

Input & Output

The lockfile is reading from stdin only. i.e.

cat package-lock.json | npx pkg-fence <...>

[!NOTE] Currently only support package-lock.json or npm-shrinkwrap.json (could use npm shrinkwrap to generate it on-the-fly).

Exit code: 0 for empty results, 1 for anything matched.

Built-in Presets

• --lodash: pkg naming starts by lodash. or equals to lodash
• --nolyfill: list of names from https://github.com/SukkaW/nolyfill
• --relief: list of names from https://github.com/es-tooling/module-replacements
  • --relief-native
  • --relief-micro
  • --relief-preferred

Extra & Ignore

to specify addition names:

--extra abc --extra def --extra=foo,bar

to ignore some names:

--ignore abc --ignore def --ignore=foo,bar

Available

NPM

executable only

npx          pkg-fence
bun    x     pkg-fence
pnpm dlx     pkg-fence
yarn dlx     pkg-fence
deno run npm:pkg-fence

JSR

executable, multi ESM exports, Typing

deno run jsr:@imcotton/pkg-fence

Caveat

Does not differentiate between dev or non-dev dependencies.

• use npm ls ... or npm why ... to make further inspection

Results are unordered, possible in duplications.

• use sort, uniq, or grep etc...

License

AGPLv3

Changelog

[0.5.0] - 2024-07-13

Added

• New presets --relief (#19)

  This based on https://github.com/es-tooling/module-replacements v2.1.0.

  It can also toggled individually via:

  • --relief-native
  • --relief-micro
  • --relief-preferred