Dep Beacon

Dep Beacon is a dependency intelligence engine for npm projects with integrations for VS Code and Zed. It brings version status, safe update targets, pnpm workspace catalog awareness, and OSV vulnerability warnings directly into manifests.

Install

• VS Code Marketplace
• Open VSX Registry
• Zed installation guide
• Core library: pnpm add @santi020k/dep-beacon-core

The editor extensions work without project configuration. Open a package.json, pnpm-workspace.yaml, or pnpm-workspace.yml file to see dependency status and security findings.

Packages

• @santi020k/dep-beacon-core analyzes package manifests, npm registry metadata, semver ranges, and OSV advisories.
• vscode-dep-beacon adds CodeLens, inline status decorations, diagnostics, update commands, sorting, cache control, and install-on-save workflows to VS Code.
• @santi020k/dep-beacon-lsp provides the language server that powers dependency diagnostics, hovers, npm links, and individual or bulk update actions in Zed.
• extensions/dep-beacon contains the thin Rust/WASM adapter distributed through the Zed extension registry.
• @santi020k/dep-beacon-docs is the Astro documentation site.

Quick Start

Local development requires Node.js 22.19 or newer and the pnpm version declared in package.json.

pnpm install
pnpm run build
pnpm run typecheck
pnpm run test
pnpm run lint

Use in Zed

The zero-configuration Zed workflow requires Dep Beacon 0.0.3 or newer. Install the extension, then open package.json, pnpm-workspace.yaml, or pnpm-workspace.yml.

• Outdated dependencies appear as warnings.
• Security findings appear as warnings or errors based on severity.
• Click Zed's error and warning indicator or run diagnostics: deploy to review actionable dependencies from open manifests.
• Place the cursor on an actionable dependency and use cmd-. on macOS or ctrl-. on Linux and Windows for patch, minor, major, latest, or bulk updates.
• Hover a dependency for its resolved range, npm latest tag, available targets, and vulnerability details.

No Zed settings are required. Optional inlay hints can add compact status beside every dependency. See the Zed extension guide for the complete workflow and pnpm catalog behavior.

To package the extension locally:

pnpm run package:extension

To run the same local gate used before publishing:

pnpm run validate

Commits

Run pnpm commit after staging the intended changes. Commitprompt applies its included Conventional Commit rules, collects the message interactively, validates it, previews it, and asks before creating the commit.

Automation can discover the same rules with pnpm exec commitprompt types --json, pnpm exec commitprompt scopes --json, and pnpm exec commitprompt instructions --json. It can then format structured fields or validate an exact message without opening the questionnaire. The commit-msg hook validates every Git commit through Commitprompt, including messages generated by the included VS Code and Zed workspace instructions.

Local Extension Debugging

Open the repo in VS Code and use Run and Debug:

• Dep Beacon: Extension (Build Once) builds the core and extension, then opens examples/sample-workspace.
• Dep Beacon: Extension (Watch) is for active development after starting the vscode-dep-beacon: dev task.
• Dep Beacon: Extension (Current Workspace) opens the repo itself in the Extension Host.

Local launch configurations mirror Dep Beacon output to .vscode/dep-beacon-extension-host.log. If the Extension Development Host reports The window terminated unexpectedly (reason: 'killed', code: '15'), that means it received SIGTERM; check this log file first, then VS Code's Developer: Open Logs Folder command for the Extension Host logs.

The sample workspace includes package.json and pnpm-workspace.yaml entries for regular dependencies, catalogs, overrides, and package extensions.

Environment

Copy .env.example to .env for local release or deploy commands. Use these names for local envs and GitHub secrets or variables:

• GH_TOKEN locally for GitHub API access. Do not create a custom GITHUB_TOKEN secret; GitHub Actions provides its runtime token automatically.
• NPM_TOKEN
• VSCE_PAT
• OVSX_PAT
• ZED_EXTENSIONS_TOKEN for pushing a Zed registry update branch
• ZED_EXTENSIONS_FORK, for example santi020k/extensions
• optional ZED_EXTENSIONS_HEAD; defaults to the repository owner
• CLOUDFLARE_API_TOKEN
• CLOUDFLARE_ACCOUNT_ID
• optional CLOUDFLARE_PAGES_PROJECT_NAME
• optional TURBO_TOKEN and TURBO_TEAM

Production GitHub workflows fetch publishing and deployment credentials from Infisical through OIDC. Keep .env files local and never commit credentials.

What It Tracks

• package.json dependency sections, peer dependencies, optional dependencies, npm overrides, Yarn resolutions, and pnpm pnpm.overrides.
• pnpm-workspace.yaml catalog, named catalogs, overrides, and packageExtensions.
• npm registry latest, next minor, next major, and prerelease-aware updates.
• OSV.dev vulnerability results for npm packages.

Status Colors

• Green: the declared range already accepts the latest stable version.
• Yellow: a newer version exists.
• Orange: low or moderate vulnerabilities are present.
• Red: the package/version is invalid, missing from npm, or has high or critical vulnerabilities.