Pastoralist tracks, documents, and cleans up dependency overridesautomaticallyπ
Simple Override Tracking
Packages you install bring dependencies of their own. Overrides let you choose a different version or replacement packageβfor example, to address a security issue.
Pastoralist creates an appendix that documents why each override exists. Track which packages depend on each override, detect security fixes, and clean up stale overrides when they're no longer needed.
- Tracks override dependencies
- Documents security fixes with CVE references
- Cleans up orphaned overrides
- Works with npm, yarn, pnpm, and bun
See the Transformation
Pastoralist reads your overrides and creates a detailed appendix documenting why each one exists, who depends on it, and any security context.
- Undocumented overrides
- Execute pastoralist
- Pastoralist manages the rest
1The Problem
Overrides exist but nobody knows why. Which packages depend on it?
Undocumented overridesBefore
package.json
{
"overrides": {
"lodash": "4.17.21"
}
}
2Run Pastoralist
Pastoralist scans your dependencies and documents your overrides.
Execute the pastoralist cliCLI
terminal
$pastoralist
βββ The herd is safe! π
3Automatic Documentation
Now you know why each override exists, what depends on it, and any associated CVEs.β‘
Documented overridesAfter
package.json
{
"overrides": {
"lodash": "4.17.21"
},
"pastoralist": {
"appendix": {
"[email protected]": {
"dependents": {
"express": "^4.18.0"
},
"ledger": {
"reason": "security",
"cve": "CVE-2020-8203"
}
}
}
}
}