Krzysztof kuhy Rudnicki 1439c0f5c0 Make the allowlist inheritable, and cache the quarantine lookups ... Two things that were fine in utils and would not have been in the next forty repos. **The allowlist is now fleet-wide plus per-repo.** `typescript-eslint` blocks TS 7 in EVERY repo that pins typescript -- eight of them and counting -- and a repo-only allowlist meant hand-copying one entry into eight files that then rot independently. That is the four-way fork of the 250-line cap, reproduced inside the mechanism built to avoid it. `~/utils/dependency-freshness.allowlist.yaml` is inherited by every repo; a repo entry for the same `ecosystem:package` overrides it. Inherited entries are exempt from the no-longer-needed check everywhere except the repo that owns the file. Without that carve-out a fleet-wide hold on typescript exits 2 in every Flutter app -- it excuses nothing there, which is the normal case, not rot -- and those repos become uncommittable. Confirmed against punchme, which now exits 0 while utils still reports the entry as in use. **`quarantine.py` bypassed the cache entirely.** It ran for every npm finding and fetched the FULL packument -- 7MB for react, 16MB for typescript -- with no TTL and no reuse, inside a pre-commit hook. One finding in utils, but the JS repos ahead have 16 to 37 each. Now cached under the normal 6h TTL, keyed `<name>@<dist-tag>`: the tag has to be part of the key rather than clamped afterwards, because clamping returns the ceiling and the ceiling is frequently the very release the quarantine is excluding. **Both cache and shared allowlist are now redirected by AUTOUSE fixtures.** A quarantine test had already seeded a fake answer for package "x" into the real ~/.cache/dep-freshness/registry.json, and the next run read its own pollution back and passed for the wrong reason. Removed the entry; the fixture makes it unrepeatable. 292 tests, 100% branch coverage on every module. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK		2026-08-28 13:58:44 +02:00
..
__init__.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
conftest.py	Make the allowlist inheritable, and cache the quarantine lookups	2026-08-28 13:58:44 +02:00
test_allowlist.py	Make the allowlist inheritable, and cache the quarantine lookups	2026-08-28 13:58:44 +02:00
test_check.py	Make the allowlist inheritable, and cache the quarantine lookups	2026-08-28 13:58:44 +02:00
test_constraints.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_discover.py	Exclude the shared-gate checkout from dependency discovery	2026-08-28 13:24:00 +02:00
test_edges.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_evaluate.py	Judge peer dependencies by range, and check the packageManager pin	2026-08-28 13:38:40 +02:00
test_golang.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_http.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_parsers_edges.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_parsers.py	Judge peer dependencies by range, and check the packageManager pin	2026-08-28 13:38:40 +02:00
test_quarantine.py	Make the allowlist inheritable, and cache the quarantine lookups	2026-08-28 13:58:44 +02:00
test_registries.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_report.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_resolve.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_toolchain_registry.py	Add the shared dependency-freshness gate	2026-08-28 13:00:35 +02:00
test_versions.py	Accept exact pins with more than three version components	2026-08-28 13:37:12 +02:00