ReviewOS

pantry-pm/pantry

public
Clone

Push over the same URL. A password will not work: create a token under access tokens and use it in place of one.

Star 0 Watch 0

An extremely performant & universal dependency manager that just works.

  • Closed
    Close native helper resource dependencies before publishing relocated artifacts

    #273 opened 4 hours ago by chris · 1 comment

  • Closed
    Discover executable nested npm programs without leaking skipped candidate paths

    #269 opened 4 hours ago by chris · 1 comment

  • Closed
    Update all owned auxiliary activations when selecting a new package revision

    #268 opened 4 hours ago by chris · 2 comments

  • Closed
    Resolve unversioned native producer versions from actual canonical catalog files

    #267 opened 9 hours ago by chris · 1 comment

  • Closed
    Preserve valid upstream Mach-O signatures during no-op runtime normalization

    #265 opened 9 hours ago by chris · 1 comment

  • Closed
    Honor native file locks and serialize package publication

    #262 opened 3 days ago by chris · 2 comments

  • Closed
    pantry install re-resolves past pantry.lock pins, so a lock never fixes what gets installed

    #260 opened 4 days ago by glennmichael123

  • Closed
    Publish the required OpenMP 18 runtime for pinned whisper.cpp installs

    #257 opened 4 days ago by chris · 1 comment

  • Closed
    fix(action): handle ESRCH while observing an exiting Linux service

    #256 opened 4 days ago by chris

  • Closed
    pantry install writes .env-inferred services into pantry.lock, so the committed lock depends on the local .env

    #253 opened 5 days ago by glennmichael123

  • Closed
    Support app-only archives in native package materialization

    #252 opened 6 days ago by chris · 1 comment

  • Closed
    fix(download): retry DNS server failures within the GET request budget

    #251 opened 8 days ago by chris · 3 comments

  • Closed
    publish --npm fails a release whose upload npm accepted but hasn't shown yet

    #245 opened 8 days ago by chris

  • Closed
    bun version resolution silently falls back to a stale bundled catalog when the unauthenticated GitHub API call fails

    #242 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    Add sqld (libsql-server); turso.tech needs it for `turso dev`

    #241 opened 8 days ago by chris

  • Closed
    npm installs skip platform-specific optionalDependencies (esbuild, sqld, rollup, sharp, biome, turbo...)

    #240 opened 8 days ago by chris

  • Closed
    Dependency specs keep trailing YAML comments (darwin:tcl-lang.org=8.6.16 # 9.0.2 introduced...)

    #239 opened 8 days ago by chris

  • Closed
    libpng.org 1.6.59 missing from the registry

    #238 opened 8 days ago by chris · 1 comment

  • Closed
    python.org 3.11 is not in the registry, so pkgx-mirrored Python CLIs (aws-cli) cannot run

    #237 opened 8 days ago by chris · 1 comment

  • Closed
    pkgx-style shebangs (#!/usr/bin/env -S pkgx python@3.11) are not rewritten at install

    #236 opened 8 days ago by chris

  • Closed
    pantry/.bin: bin-name collisions are resolved by install order

    #235 opened 8 days ago by chris

  • Closed
    fix(action): fail setup when required Bun installation fails

    #234 opened 8 days ago by glennmichael123

  • Closed
    --frozen-lockfile rejects a lock the tool just wrote, on a workspace with a companion deps file

    #233 opened 8 days ago by chris · 1 comment

  • Closed
    pantry.lock is not platform-independent: a Linux install rewrites a macOS-generated lock

    #232 opened 8 days ago by chris · 3 comments

  • Closed
    Workspace lock regeneration drops other-platform native dependency pins

    #231 opened 8 days ago by chris · 2 comments

  • Closed
    feat(registry): safely rescan and release quarantined false positives

    #226 opened 2 months ago by chris · 2 comments

  • Closed
    security(registry): review four Vault artifacts quarantined as Amos infostealer

    #225 opened 2 months ago by chris · 5 comments

  • Closed
    epic: publish-time malware scanning and dual-use package policy

    #224 opened 2 months ago by chris · 23 comments

  • Closed
    security(registry): gate every package publish surface on malware verdicts

    #223 opened 2 months ago by chris · 3 comments

  • Closed
    security(registry): add a fail-closed publish-time malware scanner

    #222 opened 2 months ago by chris · 3 comments