dependencies/lockfiles
Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts.
Part of the dependencies configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
A lockfile line from another host installs code nobody chose, and reviewers rarely read those files.
What to do
Section titled “What to do”Install the package from the registry again, or add the host to dependencies.allowed_registries.
Example
Section titled “Example”A lockfile URL outside dependencies.allowed_registries reports its host. Install the package again from an allowed registry, or add that host to the list.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore dependencies/lockfiles --paths "<glob>" --reason "<why>"