utils/dep_freshness
Krzysztof kuhy Rudnicki 1439c0f5c0 Make the allowlist inheritable, and cache the quarantine lookups
Two things that were fine in utils and would not have been in the next forty
repos.

**The allowlist is now fleet-wide plus per-repo.** `typescript-eslint` blocks
TS 7 in EVERY repo that pins typescript -- eight of them and counting -- and a
repo-only allowlist meant hand-copying one entry into eight files that then rot
independently. That is the four-way fork of the 250-line cap, reproduced inside
the mechanism built to avoid it. `~/utils/dependency-freshness.allowlist.yaml`
is inherited by every repo; a repo entry for the same `ecosystem:package`
overrides it.

Inherited entries are exempt from the no-longer-needed check everywhere except
the repo that owns the file. Without that carve-out a fleet-wide hold on
typescript exits 2 in every Flutter app -- it excuses nothing there, which is
the normal case, not rot -- and those repos become uncommittable. Confirmed
against punchme, which now exits 0 while utils still reports the entry as in
use.

**`quarantine.py` bypassed the cache entirely.** It ran for every npm finding
and fetched the FULL packument -- 7MB for react, 16MB for typescript -- with no
TTL and no reuse, inside a pre-commit hook. One finding in utils, but the JS
repos ahead have 16 to 37 each. Now cached under the normal 6h TTL, keyed
`<name>@<dist-tag>`: the tag has to be part of the key rather than clamped
afterwards, because clamping returns the ceiling and the ceiling is frequently
the very release the quarantine is excluding.

**Both cache and shared allowlist are now redirected by AUTOUSE fixtures.** A
quarantine test had already seeded a fake answer for package "x" into the real
~/.cache/dep-freshness/registry.json, and the next run read its own pollution
back and passed for the wrong reason. Removed the entry; the fixture makes it
unrepeatable.

292 tests, 100% branch coverage on every module.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
2026-08-28 13:58:44 +02:00
..
parsers Judge peer dependencies by range, and check the packageManager pin 2026-08-28 13:38:40 +02:00
registries Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
tests Make the allowlist inheritable, and cache the quarantine lookups 2026-08-28 13:58:44 +02:00
__init__.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
__main__.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
_tables.py Make the allowlist inheritable, and cache the quarantine lookups 2026-08-28 13:58:44 +02:00
allowlist.py Make the allowlist inheritable, and cache the quarantine lookups 2026-08-28 13:58:44 +02:00
cache.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
check.py Make the allowlist inheritable, and cache the quarantine lookups 2026-08-28 13:58:44 +02:00
constraints.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
discover.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
evaluate.py Judge peer dependencies by range, and check the packageManager pin 2026-08-28 13:38:40 +02:00
models.py Judge peer dependencies by range, and check the packageManager pin 2026-08-28 13:38:40 +02:00
quarantine.py Make the allowlist inheritable, and cache the quarantine lookups 2026-08-28 13:58:44 +02:00
report.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
resolve.py Add the shared dependency-freshness gate 2026-08-28 13:00:35 +02:00
versions.py Accept exact pins with more than three version components 2026-08-28 13:37:12 +02:00