Remixware 0.4.0 widens the dependency gate. remixware deps now reads pnpm-lock.yaml (lockfile versions 5, 6 and 9), yarn.lock from Yarn 1 and from Yarn 2 and later, and uv.lock. Before this release, a change to one of them came out as not-checked. Now their packages go through the same allow list, install-script and registry checks as npm, Go and Python lockfiles. A package counts as from the public registry only when the lockfile downloads the registry’s own file for that package.
There’s also a GitHub Action, softdevstudio/[email protected]. It runs check or deps, puts each problem on the pull request as an annotation, and writes a job summary. On a pull request it compares with the base branch under the base branch’s policy. The flags behind it, --format github and --summary, work without the action too.
Run on real commits, the gate flagged the 27 new packages in vite’s move to Oxlint and a new package in a Babel security update. It flagged chrome-devtools-mcp in React, which keeps 46 Yarn 1 lockfiles, and boxd in pydantic-ai’s uv lockfile. Two rounds of independent review found 20 problems, mostly ways a lockfile could make a package look like a different one. All were fixed with tests first. The release post has the details. Open source, with releases for Linux, macOS and Windows.