internal/

Package actreg resolves GitHub Actions workflow pins against the action repositories' real tag lists, fetched anonymously over git smart-HTTP (one GET per repository, no API rate limits — the same channel internal/taglink uses).

Package adopr fetches the lockfile changes of an Azure DevOps pull request (or comparison / commit) via the REST API, so it can be vetted without cloning the repository.

Package ansreg asks Ansible Galaxy what it knows about the collections and roles a requirements.yml diff touches.

Package bbpr fetches the lockfile changes of a Bitbucket Cloud pull request (or comparison / commit) via the REST API, so it can be vetted without cloning the repository.

Package bzlreg asks the Bazel Central Registry what it knows about the modules a MODULE.bazel.lock diff touches.

Package cargoreg asks crates.io what it knows about the versions a diff introduces:

Package conanreg asks ConanCenter what it knows about the packages a conan.lock diff touches.

Package condareg asks anaconda.org what it knows about the conda packages a diff touches (pixi.lock and conda-lock.yml resolve from conda channels).

Package cranreg asks CRAN what it knows about the R packages a diff touches (renv.lock resolves CRAN-sourced packages).

Package depsdev queries deps.dev for registry metadata: when a version was published (fresh-release detection) and whether it is deprecated.

Package diffx computes the semantic difference between two lockfiles.

Package flakereg explains Nix flake.lock changes from what the lockfile already records — fully offline, zero requests:

Package gemreg asks RubyGems.org what it knows about the versions a diff introduces:

Package ghpr fetches the lockfile changes of a GitHub pull request via the REST API, so a PR can be vetted without cloning the repository.

Package gitx shells out to git for revision-aware file access.

Package glmr fetches the lockfile changes of a GitLab merge request (or comparison / commit) via the REST API, so it can be vetted without cloning the repository.

Package goreg asks the Go module proxy what it knows about the modules a diff introduces:

Package gradlereg asks services.gradle.org what it knows about the Gradle distribution a gradle-wrapper.properties diff pins.

Package gtpr fetches the lockfile changes of a Gitea / Forgejo pull request (or a single commit) via the REST API, so it can be vetted without cloning the repository.

Package hcache is a small on-disk cache for registry and advisory HTTP responses.

Package helmreg asks the chart repository a Helm dependency resolves from what its own index.yaml says about it.

Package hexreg asks hex.pm what it knows about the Hex packages a diff touches (Elixir mix.lock and Gleam manifest.toml both resolve against Hex).

Package hkgreg asks Hackage what it knows about the Haskell packages a diff touches (stack.yaml.lock and cabal.project.freeze pin Hackage releases).

Package ignore reads .lockvetignore files: acknowledged findings that should stop tripping -fail-on gates without turning the gate off.

Package jsrreg asks jsr.io what it knows about the JSR packages a deno.lock diff touches.

Package latest resolves "the latest version" of a package straight from its registry, for `lockvet pkg <ecosystem>:<name>` when no version is given.

Package lock parses dependency lockfiles into a common representation.

Package mvnreg asks the Maven repositories themselves — Maven Central and Google's Maven repository — about the artifacts a diff introduces:

Package npmreg asks the npm registry whether versions run install scripts (preinstall / install / postinstall) and whether they were published with sigstore provenance attestations.

Package nugetreg asks NuGet.org what it knows about the packages a diff touches, via the registration index — the same metadata endpoint `dotnet restore` itself reads:

Package ocireg verifies container base-image changes (Dockerfile FROM pins, Compose image: values) against the image registries themselves.

Package orbreg asks the CircleCI orb registry what it knows about the orbs a .circleci/config.yml diff pins.

Package osv queries the OSV.dev vulnerability database.

Package phpreg asks Packagist what it knows about the Composer packages a diff touches.

Package pkgspec parses `lockvet pkg` package specs — <ecosystem>:<name>[@version] — into the ecosystem, the name as the matching lockfile format would record it, and the version.

Package podreg asks the CocoaPods registry what it knows about the pods a diff touches (Podfile.lock resolves against the trunk registry via the CDN).

Package pubreg asks pub.dev what it knows about the Dart/Flutter packages a diff touches (pubspec.lock resolves against pub.dev).

Package pypireg asks PyPI's simple API (the JSON flavour, PEP 691) what it knows about the versions a diff introduces:

Changelog-file fallback: many projects never publish GitHub Releases (Phoenix stopped at v1.5.3; most GitLab-, Codeberg- and Bitbucket-hosted projects never started) but keep a CHANGELOG.md at the repository root.

Package render prints diffs as colored terminal output or markdown.

Package squat flags newly-added dependencies whose names are one edit away from a popular package on the same registry — the shape of a typosquatting attack (npm, PyPI, crates.io, RubyGems, Packagist).

Package swiftreg verifies SwiftPM Package.resolved pins against the upstream repositories' real tags, fetched anonymously over git smart-HTTP (one GET per repository, no API rate limits — the same channel internal/taglink and internal/actreg use).

Package taglink turns version bumps into verified upstream links: it fetches each source repository's tag list over git's smart-HTTP protocol (one anonymous GET per repo, no API tokens, no rate limits) and, when the old and new versions match real tags, builds compare / release-notes URLs that are guaranteed not to 404.

Package tfreg asks the Terraform and OpenTofu registries what they know about the providers a .terraform.lock.hcl diff touches.

Package vcpkgreg verifies what vcpkg manifests pin.

Package vers implements lenient version parsing and comparison that tolerates semver, Python versions (1.2.3.post1), Go pseudo-versions, and other real-world strings found in lockfiles.