jsrreg

Documentation

Overview

Package jsrreg asks jsr.io what it knows about the JSR packages a deno.lock diff touches. Neither OSV.dev nor deps.dev has a JSR ecosystem, so for jsr: packages this package IS the metadata layer, not a fallback:

• Release ages and the ⏱ cooldown flag, from each version's createdAt in the package's meta.json — the exact document Deno itself resolves against.
• Yanked versions land in the deprecation lane (JSR keeps yanked versions listed in meta.json, so a yank is visible, not a hole).
• Archived packages (jsr.io's package-level retirement) land in the deprecation lane too.
• Unlisted detection: JSR does not let publishers delete versions — yanking keeps them listed — so an incoming version missing from meta.json while the package's other versions ARE listed is a strong signal that something was scrubbed. Packages jsr.io does not know at all are never flagged.
• The upstream GitHub repository the package links on jsr.io, which the changelog layers turn into verified compare links and release notes.

JSR publishes are sigstore-signed across the board (there is no unattested baseline to fall from), so provenance-drop detection does not apply. JSR has no per-release license history either, so license-change detection is honestly left out.

Two anonymous GETs per changed package (meta.json + the package API for archived/repository), both against CORS-open endpoints — the same route works native and in the browser (wasm) build.

Index

• Constants
• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Constants

const Prefix = "jsr:"

Prefix marks JSR packages inside npm-ecosystem lockfiles (deno.lock keeps npm and jsr dependencies side by side; the parser prefixes the latter since OSV has no JSR ecosystem to put them in).

Variables

var APIBaseURL = "https://jsr.io"

APIBaseURL serves /api/scopes/{scope}/packages/{name}; a var so tests can fake it (defaults to BaseURL's host in fetch when empty).

var BaseURL = "https://jsr.io"

BaseURL serves /@scope/name/meta.json; a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills jsr.io metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against jsr.io. freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.