Dep Beacon

Dep Beacon

Dependency intelligence where you edit your manifests.

Dep Beacon is a dependency intelligence engine for npm projects with integrations for VS Code and Zed. It brings version status, safe update targets, pnpm workspace catalog awareness, and OSV vulnerability warnings directly into manifests.

Documentation · VS Code · Open VSX · npm packages · Releases · Issues

Explore: Packages · Quick Start · Use in Zed · Commits · Local Extension Debugging · Status Colors

In your editor

Real dependency signals from the public sample workspace. Select either preview to open the full capture; the website includes both editors.

VS Code	Zed

Packages

Quick Start

For VS Code, install Dep Beacon from the linked Marketplace or Open VSX listing, then open a project’s package.json. The extension adds dependency status and update actions to the manifest. Use the Zed instructions below for its language-server integration.

Local development requires Node.js 22.19 or newer and the pnpm version declared in package.json.

To develop this repository locally:

pnpm install
pnpm run build
pnpm run typecheck
pnpm run test
pnpm run lint

Use in Zed

The zero-configuration Zed workflow requires Dep Beacon 0.0.3 or newer. Install the extension, then open package.json, pnpm-workspace.yaml, or pnpm-workspace.yml.

• Outdated dependencies appear as warnings.
• Security findings appear as warnings or errors based on severity.
• Click Zed's error and warning indicator or run diagnostics: deploy to review actionable dependencies from open manifests.
• Place the cursor on an actionable dependency and use cmd-. on macOS or ctrl-. on Linux and Windows for patch, minor, major, latest, or bulk updates.
• Hover a dependency for its resolved range, npm latest tag, available targets, and vulnerability details.

No Zed settings are required. Optional inlay hints can add compact status beside every dependency. See the Zed extension guide for the complete workflow and pnpm catalog behavior.

To package the extension locally:

pnpm run package:extension

To run the same local gate used before publishing:

pnpm run validate

Commits

Install Quality v1.3.0 before configuring Git hooks. On macOS and Linux, its installer verifies the native binary checksum:

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/santi020k/quality/main/install.sh \
  | sh -s -- santi020k/quality v1.3.0
pnpm run hooks:install
quality hooks status

On Windows, install the native executable from the linked release, add it to PATH, then run the same hook commands. Repeat hook installation for each clone or worktree. pnpm install installs the JavaScript dependencies; it does not install Quality or Git hooks.

Run pnpm commit after staging the intended changes. Commitprompt applies its included Conventional Commit rules, collects the message interactively, validates it, previews it, and asks before creating the commit.

Automation can discover the same rules with pnpm exec commitprompt types --json, pnpm exec commitprompt scopes --json, and pnpm exec commitprompt instructions --json. It can then format structured fields or validate an exact message without opening the questionnaire. The commit-msg hook validates every Git commit through Commitprompt, including messages generated by the included VS Code and Zed workspace instructions.

Local Extension Debugging

Open the repo in VS Code and use Run and Debug:

• Dep Beacon: Extension (Build Once) builds the core and extension, then opens examples/sample-workspace.
• Dep Beacon: Extension (Watch) is for active development after starting the vscode-dep-beacon: dev task.
• Dep Beacon: Extension (Current Workspace) opens the repo itself in the Extension Host.

Local launch configurations mirror Dep Beacon output to .vscode/dep-beacon-extension-host.log. If the Extension Development Host reports The window terminated unexpectedly (reason: 'killed', code: '15'), that means it received SIGTERM; check this log file first, then VS Code's Developer: Open Logs Folder command for the Extension Host logs.

The sample workspace includes package.json and pnpm-workspace.yaml entries for regular dependencies, catalogs, overrides, and package extensions.

Documentation validation

Run pnpm exec playwright install chromium webkit once, then pnpm run test:docs to build and check every route at 320, 375, 768, and 1440 pixels in both themes. The suite also checks mobile focus restoration, route changes, theme persistence, and keyboard-operated editor examples. pnpm run validate remains the full package gate.

See the 1.3 release notes for design decisions, migration, validation, and the automated publication boundary.

Environment

Infisical's configured development environment is the source of truth for local secrets. Use infisical run --env dev -- <command> for commands that require credentials. .env.example documents supported names; keep actual values out of committed files:

• GH_TOKEN locally for GitHub API access. Do not create a custom GITHUB_TOKEN secret; GitHub Actions provides its runtime token automatically.
• NPM_TOKEN
• VSCE_PAT
• OVSX_PAT
• ZED_EXTENSIONS_TOKEN for pushing a Zed registry update branch
• ZED_EXTENSIONS_FORK, for example santi020k/extensions
• optional ZED_EXTENSIONS_HEAD; defaults to the repository owner
• CLOUDFLARE_API_TOKEN
• CLOUDFLARE_ACCOUNT_ID
• optional CLOUDFLARE_PAGES_PROJECT_NAME
• optional TURBO_TOKEN and TURBO_TEAM

Current publishing and deployment workflows consume GitHub Actions secrets and variables. The manual Infisical workflow checks OIDC connectivity; it does not migrate those workflows or synchronize credentials. Never commit credentials or local .env files.

What It Tracks

• package.json dependency sections, peer dependencies, optional dependencies, npm overrides, Yarn resolutions, and pnpm pnpm.overrides.
• pnpm-workspace.yaml catalog, named catalogs, overrides, and packageExtensions.
• npm registry latest, next minor, next major, and prerelease-aware updates.
• OSV.dev vulnerability results for npm packages.

Status Colors

• Green: the declared range already accepts the latest stable version.
• Yellow: a newer version exists.
• Orange: low or moderate vulnerabilities are present.
• Red: the package/version is invalid, missing from npm, or has high or critical vulnerabilities.

Find your next step

License

MIT. See LICENSE.