@amedia/kragl-lockfile-lint

lockfile-lint runner for kragl. Validates every package-lock.json under the project root (excluding node_modules) on each kragl lint.

Install

npm install --save-dev @amedia/kragl-lockfile-lint

Use

Picked up automatically by kragl lint once installed.

Standalone:

kragl-lockfile-lint

Configuration

The runner is the single merge point for lockfile-lint configuration. On each invocation it:

1. Uses cosmiconfig to look for a consumer config at the repo root — in any supported format: lockfile-lint.config.{js,cjs,mjs}, .lockfile-lintrc{,.json,.yaml,.yml,.js,.cjs,.mjs}, or a "lockfile-lint" key in package.json.
2. Merges the discovered config (or {} if none) through lockfileLintConfig() — array options (allowed-hosts, allowed-schemes, allowed-urls, allowed-package-name-aliases, integrity-exclude) are concatenated with the Amedia defaults; scalar options replace them.
3. Passes the merged result to lockfile-lint as CLI flags, alongside --path <lockfile> for each discovered package-lock.json.

The merge behavior is identical across config formats, so JSON/YAML/rc configs compose with the defaults the same way lockfile-lint.config.js does. Defaults are never silently dropped because the consumer happened to pick a static format.

Recommended setup: install @amedia/lockfile-lint-config and create a two-line lockfile-lint.config.js that calls lockfileLintConfig(). That keeps the call site explicit about where defaults come from and gives project-level extension a natural home.

Notes

Requires Node 22+.