Pastoralist tracks, documents, and cleans up your npm dependency overridesautomatically👍
Simple Override Tracking
Pastoralist creates an appendix that documents why each override exists. Track which packages depend on each override, detect security fixes, and clean up stale overrides when they're no longer needed.
- Tracks override dependencies
- Documents security fixes with CVE references
- Cleans up orphaned overrides
- Works with npm, yarn, pnpm, and bun
See the Transformation
Pastoralist reads your overrides and creates a detailed appendix documenting why each one exists, who depends on it, and any security context.
- Undocumented overrides
- Execute pastoralist
- Pastoralist manages the rest
1The Problem
Overrides exist but nobody knows why. Which packages depend on it?
Undocumented overridesBefore
package.json
{
"overrides": {
"lodash": "4.17.21"
}
}
2Run Pastoralist
Pastoralist scans your dependencies and documents your overrides.
Execute the pastoralist cliCLI
terminal
$pastoralist
└── The herd is safe! 🐑
3Automatic Documentation
Now you know why each override exists, what depends on it, and any associated CVEs.⚡
Documented overridesAfter
package.json
{
"overrides": {
"lodash": "4.17.21"
},
"pastoralist": {
"appendix": {
"[email protected]": {
"dependents": {
"express": "^4.18.0"
},
"ledger": {
"reason": "security",
"cve": "CVE-2020-8203"
}
}
}
}
}