Repolode
Submit
yowainwright

yowainwright/pastoralist

A CLI that records each package.json dependency override in an appendix and scans for security issues, so overrides can be maintained safely.

View on GitHubWebsite
Stars
109
Forks
56
Open issues
1
Last commit
13 hours ago

What is it?

Pastoralist keeps dependency overrides (npm overrides, pnpm overrides, Yarn resolutions, Bun overrides) maintained over time. Running it adds an appendix to package.json that lists, for each override, which packages depend on it, when it was first recorded, and whether it can still be removed.

The tool supports npm, pnpm (including pnpm-workspace.yaml on pnpm 11+), Yarn and Bun projects, and it handles monorepos through workspace paths and manifest globs. A read-only doctor command previews changes, and --dry-run works on the main command.

Optional vulnerability checks run against providers such as OSV (the default), GitHub, Snyk, npm, Socket and Spektion. Findings can be fixed interactively or applied automatically, and results can be cached or output as JSON for CI.

Key features

  • 01Records each override with its dependents and first-recorded date in package.json.
  • 02Supports npm, pnpm, Yarn and Bun override formats.
  • 03Previews changes with a read-only doctor command or --dry-run.
  • 04Runs vulnerability checks against OSV, GitHub, Snyk, npm, Socket and Spektion.
  • 05Finds unused overrides and can remove verified ones.
  • 06Outputs machine-readable JSON and exits non-zero on security findings in quiet mode.

Use cases

  • Keeping transitive dependency overrides for security fixes documented and up to date.
  • Auditing which overrides are still needed before cleaning them up.
  • Adding a dependency security check to CI pipelines.
  • Maintaining overrides across a monorepo with multiple package manifests.

Quick start

  1. 1

    Install the global CLI with npm

    npm install --global pastoralist
  2. 2

    Install as a dev dependency in your project

    npm install pastoralist --save-dev
  3. 3

    Preview changes with the read-only health check

    npx pastoralist doctor
  4. 4

    Run pastoralist to update the override appendix

    npx pastoralist

Things to know

  • Security scanning providers such as GitHub, Snyk, and Socket may need API tokens for use.

In collections

Security scanners, audits & threat intel tools

Topics

#dependencies#package-manager#security#npm#pnpm#yarn#bun#monorepo#dependency-manager#overrides

FAQ

What is pastoralist?
A CLI that records each package.json dependency override in an appendix and scans for security issues, so overrides can be maintained safely. Pastoralist keeps dependency overrides (npm overrides, pnpm overrides, Yarn resolutions, Bun overrides) maintained over time. Running it adds an appendix to package.json that lists, for each override, which packages depend on it, when it was first recorded, and whether it can still be removed.
Is pastoralist free to use? What license does it have?
pastoralist is open source under the MIT license. Check the license terms before using it in commercial products.
Is pastoralist still maintained?
Actively maintained. The last commit to pastoralist was on Oct 22, 2026.
What can I use pastoralist for?
Keeping transitive dependency overrides for security fixes documented and up to date. Auditing which overrides are still needed before cleaning them up. Adding a dependency security check to CI pipelines. Maintaining overrides across a monorepo with multiple package manifests.
How do I install pastoralist?
Install the global CLI with npm: npm install --global pastoralist Install as a dev dependency in your project: npm install pastoralist --save-dev Preview changes with the read-only health check: npx pastoralist doctor Run pastoralist to update the override appendix: npx pastoralist
Where can I get pastoralist?
The source code and installation instructions are on GitHub: https://github.com/yowainwright/pastoralist

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects