open-index/open-npm huggingface dataset:
npm package: @gitlab/cluster-client
Description: A JavaScript client for Kubernetes for use in the GitLab frontend.
Latest version: 3.0.0

# @gitlab/cluster-client

A JavaScript client for Kubernetes access in the GitLab frontend, for use with
the [GitLab agent server's reverse
proxy](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/blob/master/doc/kubernetes_user_access.md).

This is an internal package for GitLab's use, as a stop-gap measure until the
[official client for
JavaScript](https://github.com/kubernetes-client/javascript) supports web
browsers ([issue](https://github.com/kubernetes-client/javascript/issues/165)).

We urge you to use the OpenAPI generator directly instead of relying on this
package.

## Usage

The generated client is in the [`client/`](client/) folder. See the generated
[`client/README.md`](client/README.md) for details on its usage.

## Development

The client is generated from the [Kubernetes OpenAPI
specification](https://github.com/kubernetes/kubernetes/blob/master/api/openapi-spec/swagger.json)
using the [OpenAPI generator for
JavaScript](https://openapi-generator.tech/docs/generators/javascript).

To regenerate the client, run:

``` shell
make clean client
```

See [`openapi-generator-config.yaml`](openapi-generator-config.yaml) for the
configuration passed to the generator.

## Contributing

See [`CONTRIBUTING.md`](CONTRIBUTING.md)
npm package: @gitlab/codeowners
Description: Parse GitLab CODEOWNERS files
Author: Mark Florian
Latest version: 0.2.7

# GitLab CodeOwners parser

A GitLab CodeOwners parser for Node.js, written in TypeScript.

It aims to implement all [documented][docs] features of the format, but it's
not quite there yet. Consider this alpha-quality software for now!

## Installation

```sh
npm install @gitlab/codeowners
```

## Usage

```js
import { parse } from '@gitlab/codeowners';

const codeowners = await parse('./CODEOWNERS');

const owners = codeowners.getOwners('README.md'); // ['@user', '@group']

const ownersDetailed = codeowners.getOwnersDetailed('README.md'); /* =>
[{
  owner: '@user',
  type: 'directOwner',
  section: 'codeowners',
  optional: true,
  approvalsNeeded: 1,
},{
  owner: '@group',
  type: 'defaultOwner',
  section: 'Maintainers',
  optional: false,
  approvalsNeeded: 5,
}]
*/
```

## Versioning

This project will use [semantic versioning](https://semver.org/). Particularly,
note [item 4](https://semver.org/#spec-item-4):

> Major version zero (0.y.z) is for initial development. Anything MAY change at
> any time. The public API SHOULD NOT be considered stable.

This project will reach 1.0.0 once it supports all features [documented][docs]
by GitLab.

## TODO

This is not yet a complete implementation of a GitLab CODEOWNERS parser. Here's
a non-exhaustive list of things where are _not_ implemented/supported:

- [Sections with duplicate names](https://docs.gitlab.com/ee/user/project/codeowners/#sections-with-duplicate-names)
- [Error handling](https://docs.gitlab.com/ee/user/project/codeowners/reference.html#error-handling-in-code-owners)
- Reporting on parsing errors/file validity
- Probably others!

[docs]: https://docs.gitlab.com/ee/user/project/codeowners
npm package: @gitlab/create-ui
Description: A starter project for GitLab UI
Author: GitLab
Latest version: 1.1.0

# GitLab Prototype Kit

A starter project for rapid GitLab UI prototyping using the design system. Includes `@gitlab/ui` components, `@gitlab/svgs` icons, and `@gitlab/fonts` typography.

## Getting started

```bash
yarn create @gitlab/ui my-gitlab-ui-app
cd my-gitlab-ui-app
yarn install
yarn start
```

See the created project's `README.md` for more information about how to use it.
npm package: @gitlab/csslab
Description: GitLab's CSS Framework
Author: GitLab
Latest version: 1.9.0
Deprecated: Package is no longer supported

# CSSLab
[![npm version](https://badge.fury.io/js/%40gitlab-org%2Fcsslab.svg)](https://badge.fury.io/js/%40gitlab-org%2Fcsslab)

* Will produce a minifed and full versions. Each containing a version with and without Bootstrap. 
```
yarn css
```

* See `package.json` for more build options.

## Lint
```
yarn lint
```

## How to publish

Note: Only [members](https://www.npmjs.com/org/gitlab-org/members) of npm group `@gitlab-org` are able to publish this project.

1. Update the package version number
2. `npm publish --access public`
npm package: @gitlab/duo-cli
Description: GitLab Duo for your command line
Latest version: 8.86.0

# GitLab Duo CLI (Beta)

GitLab Duo for your command line. An AI-powered CLI tool that brings
[GitLab Duo Agentic Chat](https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/) to your
terminal.

📖 **For installation, usage, and configuration see the [GitLab Duo CLI documentation](https://docs.gitlab.com/user/gitlab_duo_cli/).**

## Development

To run the CLI from a local checkout:

```shell
npm run cli
```

This builds and launches the app. Pass CLI flags after `--`:

```shell
npm run cli -- run --goal "example"
```

For hot-reload development, use `npm run dev:watch` instead.

See the full [Development Guide](./docs/development.md) for prerequisites, building, debugging, testing, and architecture details.

### Packages

The GitLab Duo CLI is split across two packages:

- **`packages/cli`** — CLI entry point, command routing, backend abstraction, and controllers for interactive and headless modes.
- **[`packages/tui`](../tui/)** — React-based terminal UI built on [Ink](https://github.com/vadimdemedes/ink). Pure presentation layer with zero domain logic. Renders the chat interface, messages, tool calls, diffs, and Markdown.

## License

See the [License](../../LICENSE) for details.
npm package: @gitlab/duo-ui
Description: Duo UI Components
Author: GitLab
Latest version: 15.19.1

# Duo UI

Duo UI is a library that is home to all Duo Components which are shared across multiple Host systems.

## Storbook

Latest main branch: <https://gitlab-org.gitlab.io/duo-ui/>

## Usage

1. To use Duo UI in your project, add it as a dependency:

    ```sh
    yarn add @gitlab/duo-ui
    ```

    > **Note:** Make sure to also install Duo UI's peer dependencies. Refer to the
    > [`package.json`](./package.json) for the list of peer dependencies and their expected versions.

## Quick start - development

**Note:** Duo UI isn't designed to be built on Windows natively. Either
[WSL](https://learn.microsoft.com/en-us/windows/wsl/) or
[GitPod](https://www.gitpod.io/docs/configure/authentication/gitlab) can be used to set up a
UNIX-like environment in which to build it.

Make sure you have [Node](https://nodejs.org/en/) 16.x (LTS) and [Yarn](https://yarnpkg.com/) 1.22
or newer.

```sh
# Clone the project
git clone git@gitlab.com:gitlab-org/duo-ui.git

# Navigate to the root of the project
cd duo-ui

# Install all the dependencies of the project
yarn # or yarn install

# Build and launch storybook to see the components in the browser
yarn storybook
```

Go to <http://localhost:9001/>

## Testing

### Unit tests

Components’ unit tests live in the `tests/components`. The tests are organized following the same
directory structure used to organize components.

- `yarn test:unit` runs all unit tests.

- `yarn test:unit:watch` runs all unit tests in watch mode.

- `yarn test:unit:debug` runs all unit tests and allow to attach a debugger to the test runner process.

- `yarn jest [name_pattern]` runs spec files that match the specified name pattern.

#### Examples

- `yarn jest datepicker` will match all spec files with a name that contains the word _datepicker_.

- `yarn jest datepicker -t "when draw event is emitted"` goes a step further and only runs the test
with a description that matches the argument passed to the `t` flag.

### Visual regression tests

Duo UI uses visual snapshot tests to prevent introducing regressions with CSS and
layout changes on components. Read more on this in the [visual testing documentation](doc/contributing/visual_testing.md).

## Releases

See [Updating Duo UI Packages](doc/updating-duo-ui-packages.md) for information on how the
`@gitlab/duo-ui` package is kept up to date in various projects.

## Contributing guide

Please refer to [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to add new components and
contribute in general to Duo UI.

### FAQs

Any question? Have a look at our [FAQ.md](FAQ.md), you might find the answer there.
npm package: @gitlab/eslint-config
Description: GitLab ESLint base configuration
Author: GitLab
Latest version: 4.0.0
Deprecated: Deprecated in favor of @gitlab/eslint-plugin: https://www.npmjs.com/package/@gitlab/eslint-plugin

# @gitlab/eslint-config

is GitLab's shared ESLint config file to be used in all javascript projects across [GitLab](https://about.gitlab.com/).  It encapsulates our coding standards and is based primarily upon [`eslint-config-airbnb-base`](https://github.com/airbnb/javascript/tree/master/packages/eslint-config-airbnb-base) and [`eslint-plugin-vue`](https://github.com/vuejs/eslint-plugin-vue) with the expectation that code formatting is handled separately by [prettier](https://prettier.io).

## Development quick start

1. Clone the project
1. Install [yarn](https://yarnpkg.com/en/)
1. Run `yarn install` to install the project dependencies

## Requirements
* Node.js 12.x, 14.x (or ^10.12.0)
* ESLint ^7.8.1

## Integrating

`$ npm install @gitlab/eslint-config`

after installing, make sure to add the following to your `.eslintrc` file

```
{
  "extends": [
    "@gitlab"
  ]
}
```

## Release management

This project automatically publishes the `master` branch using [semantic-release](https://github.com/semantic-release/semantic-release).
If a new commit/merge request is merged into `master` and it's commit(s) follows the [Angular Commit Message Conventions](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines),
a release will be automatically generated and published. Commits that do not follow the convention will be ignored and a release will not be made for them.
npm package: @gitlab/eslint-plugin
Description: GitLab package for our custom eslint rules
Author: GitLab Frontend Team
Latest version: 21.3.1

[![pipeline status](https://gitlab.com/gitlab-org/frontend/eslint-plugin/badges/main/pipeline.svg)](https://gitlab.com/gitlab-org/frontend/eslint-plugin/commits/main)
[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)

# @gitlab/eslint-plugin

> This package contains eslint rules developed for GitLab and shared eslint config to be used in all
> javascript projects across GitLab.

It encapsulates our coding standards and is based primarily upon
[`eslint-config-airbnb-base`](https://github.com/airbnb/javascript/tree/master/packages/eslint-config-airbnb-base)
and [`eslint-plugin-vue`](https://github.com/vuejs/eslint-plugin-vue) with the expectation that code
formatting is handled separately by [prettier](https://prettier.io).

Generally we should use upstream rules that are defined in `eslint` or `eslint-plugin-vue`. If one
of these packages lacks a rule, we can create it here in order to enforce it, and try to get it
upstream later.

## Documentation

- [Available rules](./docs/rules.md)
- [Installation and Usage](./docs/usage.md)
- [Creation & Development of rules](./docs/development.md)

## Eslint 9 migration

The TS portion of this plugin has been migrated to eslint v9 and can be used as `const gitlabPlugin = require('@gitlab/eslint-plugin/eslint9');`. You still add the `@gitlab/eslint-plugin` as a dependency.

Add these overrides to your project's package.json:

```json
  "overrides": {
    "@gitlab/eslint-plugin": {
      "@typescript-eslint/eslint-plugin": "^8.38.0",
      "@typescript-eslint/parser": "^8.38.0"
    }
  }
```

(replace the versions with what your main project uses)

## Contribution guidelines

Please refer to
[gitlab's CONTRIBUTING.md](https://gitlab.com/gitlab-org/gitlab/blob/master/CONTRIBUTING.md) for
details on our guidelines.
npm package: @gitlab/eslint-plugin-i18n
Description: Detect and autofix strings which require externalization in Vanilla JS files.
Author: Brandon Labuschagne
Latest version: 1.1.0
Deprecated: Deprecated in favor of @gitlab/eslint-plugin: https://www.npmjs.com/package/@gitlab/eslint-plugin

[![pipeline status](https://gitlab.com/gitlab-org/frontend/eslint-plugin-i18n/badges/master/pipeline.svg)](https://gitlab.com/gitlab-org/frontend/eslint-plugin-i18n/commits/master)
[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)

# eslint-plugin-i18n

Detect and autofix strings which require externalization in Vanilla JS files.

## Installation

You'll first need to install [ESLint](http://eslint.org):

```
$ npm i eslint --save-dev
```

Next, install `@gitlab/eslint-plugin-i18n`:

```
$ npm install @gitlab/eslint-plugin-i18n --save-dev
```

**Note:** If you installed ESLint globally (using the `-g` flag) then you must also install `@gitlab/eslint-plugin-i18n` globally.

## Usage

Add `@gitlab/eslint-plugin-i18n` to the plugins section of your `.eslintrc` configuration file. You can omit the `@gitlab/eslint-plugin-` prefix:

JSON:

```json
{
  "plugins": ["@gitlab/i18n"]
}
```

YAML:

```yaml
plugins:
  - @gitlab/i18n
```

Then configure the rules you want to use under the rules section.

JSON:

```json
{
  "rules": {
    "@gitlab/i18n/no-non-i18n-strings": "error"
  }
}
```

YAML:

```yaml
rules:
  "@gitlab/i18n/no-non-i18n-strings": error
```

## VueJS (.vue files)
`@gitlab/eslint-plugin-i18n` can also detect strings requiring externalization for code within the `<script></script>` tags of a **.vue** file. 

### Editor support
* [Visual studio Code](https://code.visualstudio.com/) + [Vetur](https://vuejs.github.io/vetur/linting-error.html): add `.vue` to your [linting configuration](https://vuejs.github.io/vetur/linting-error.html#linting)
* [Atom](https://atom.io/) + [linter-eslint](https://github.com/AtomLinter/linter-eslint): add `text.html.vue` to your [list of scopes](https://alligator.io/vuejs/vue-eslint-plugin/#editor-configuration)

## Supported Rules

- [no-non-i18n-strings](https://gitlab.com/gitlab-org/frontend/eslint-plugin-i18n/blob/master/docs/rules/no-non-i18n-strings.md)

## Contribution guidelines

Please refer to [gitlab-ce's CONTRIBUTING.md](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md) for details on our guidelines.
npm package: @gitlab/eslint-plugin-vue-i18n
Description: ESLint rules for internationalization (i18n) of .vue files
Author: Ezekiel Kigbo
Latest version: 2.0.0
Deprecated: Deprecated in favor of @gitlab/eslint-plugin: https://www.npmjs.com/package/@gitlab/eslint-plugin

# eslint-plugin-vue-i18n

ESLint rules for internationalization of .vue files
npm package: @gitlab/gitlab-agent-token
Description: Registers a new GitLab Kubernetes Agent with your GitLab instance, and retrieves its secret token
Latest version: 1.1.5

# GitLab Agent Token generator

This script helps setting up a new GitLab Kubernetes Agent by providing a CLI script to register a new agent with a GitLab instance and retrieve the agent's token.

The GitLab Kubernetes Agent is GitLab's cluster side component to support GitLab's Kubernetes integration features like pull based deployments. Once the token is available, it [should be added to your cluster as a secret](https://docs.gitlab.com/ee/user/clusters/agent/#create-the-kubernetes-secret). See [the GitLab documentation](https://docs.gitlab.com/ee/user/clusters/agent/) for more details about setting up the GitLab Kubernetes Agent.

## Usage

```bash
$ npx @gitlab/gitlab-agent-token
```

## Todo

See the issues: https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent-token/-/issues

## Release

Release a new version with `npm version ...` run locally
npm package: @gitlab/noop
Description: This is a noop dependency to be able to prune parts of a dependency graph.
Author: GitLab
Latest version: 1.0.1

# `@gitlab/noop`

The idea behind this package is to be able to prune subtrees of dependencies
which you might not need.

Reasons for why you might want to do this:

1. Some dependencies (e.g. treesitter) ship a node/server and a browser
   component. You might not be interested in the server component, so you could
   prune the node/server subtree of dependencies.
2. A particular part of dependencies might not be problematic and leading to
   oddities. One particular example is the `glob` package which ships a CLI
   interface which has some ESM-dependencies. One can reduce the dependency
   graph by quite a bit

## Usage

The different package managers have different resolution features.

## npm@v10

[`overrides`](https://docs.npmjs.com/cli/v10/configuring-npm/package-json#overrides)
is the native npm feature to override the version of a package. You can target
sub-dependencies:

[Example](https://gitlab.com/gitlab-org/frontend/noop/-/commit/cc85fb476e3d0afffe10edd1848c9895ef7babee):

```json
{
  "overrides": {
    "glob": {
      "jackspeak": "npm:@gitlab/noop@1.0.0"
    }
  }
}
```

### yarn@v1

Use
[Selective dependency resolutions](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/)
and add a resolutions field to the package.json. The resoltions field allows
pretty accurate sub-selection of dependencies.

[Example](https://gitlab.com/gitlab-org/frontend/noop/-/commit/4a47d3e2f36e494c6c5027efd908e8f51e5fc12d):

```json
{
  "resolutions": {
    "glob/jackspeak": "npm:@gitlab/noop@1.0.0"
  }
}
```

### yarn@v4

You can set the resolution manually with e.g.

```bash
yarn set resolution 'jackspeak@npm:^2.3.5' 'npm:@gitlab/noop@1.0.0'
```

which will only update yarn.lock. Alternatively, you can update the package.json
as well, which is a little more verbose:

[Example](https://gitlab.com/gitlab-org/frontend/noop/-/commit/c12edcf56bdd3330c16db62f61569fbc3cd3641a):

```json
{
  "resolutions": {
    "jackspeak@npm:^2.3.5": "npm:@gitlab/noop@1.0.0"
  }
}
```

### pnpm@v9

[`pnpm.overrides`](https://pnpm.io/package_json#pnpmoverrides) is the canonical
way to define a resolution for pnpm:

> NOTE: With `pnpm@9.12.0`, you don't need this package. You can simply use `-`
> as an override!

For older versions you can use
[this example](https://gitlab.com/gitlab-org/frontend/noop/-/commit/d43c27e26fab5f80fd1c020ed1586e554905f021):

```json
{
  "pnpm": {
    "overrides": {
      "glob>jackspeak": "npm:@gitlab/noop@1.0.0"
    }
  }
}
```

### bun@v1

[Bun supports both](https://bun.sh/docs/install/overrides) npm style overrides
and yarn@1 style resolutions.

[Example](https://gitlab.com/gitlab-org/frontend/noop/-/commit/459bdd9196e57826755bd600db876609f2b98f01):

```json
{
  "resolutions": {
    "jackspeak": "npm:@gitlab/noop@1.0.0"
  }
}
```
npm package: @gitlab/query-language
Description: Javascript implementation of the GLQL transpiler, wrapping the WASI/WASM build.
Author: John Hope
Latest version: 0.0.5-a-20241112

## `@gitlab/query-language`

GitLabQueryLanguage is an npm module that provides a simple interface for converting `glql`
queries into other formats.

It wraps the WebAssembly build of the `glql` compiler.

### Usage

Install the module:

```sh
npm install --save @gitlab/query-language
```

Import and use the module:

```html
<script type="module">
  import { GitLabQueryLanguage } from '@gitlab/query-language';

  const glql = GitLabQueryLanguage();
  glql.group = "gitlab-org";
  glql.username = "johnhope";
  await glql.initialize();

  let query = 'label != "backend" and author = currentUser() and weight = 1 and updated > today()';

  let graphql = glql.compile("graphql", query);

  console.log(graphql);
</script>
```

### Running the Example

Clone the repo and install the dev dependencies:

```sh
npm install
```

Build the module:

```
npm run build
```

Start the server of your choice. E.g.`wds`:

```sh
npx wds
```
npm package: @gitlab/stylelint-config
Description: GitLab Stylelint base configuration
Author: GitLab
Latest version: 6.3.0

# @gitlab/stylelint-config

This is the base Stylelint configuration used to enforce coding standards for styles in [GitLab](https://about.gitlab.com/)'s projects.

# Usage

1. Add the configuration to your dev dependencies:

```sh
yarn add --dev @gitlab/stylelint-config stylelint postcss
```

2. Extend the config in your `.stylelintrc`:

```
{
   "extends": "@gitlab/stylelint-config"
}
```

## Release management

This project automatically publishes the `main` branch using [semantic-release](https://github.com/semantic-release/semantic-release).
If a new commit/merge request is merged into `main` and it's commit(s) follows the [Angular Commit Message Conventions](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines),
a release will be automatically generated and published. Commits that do not follow the convention will be ignored and a release will not be made for them.
npm package: @gitlab/truncated-tags
Description: A semantic-release plugin that creates truncated version tags in GitLab using the API
Author: GitLab Infrastructure
Latest version: 1.1.0

# @gitlab/truncated-tags

A [semantic-release](https://github.com/semantic-release/semantic-release) plugin that creates and updates truncated Git tags using the GitLab API instead of Git commands.
This plugin is designed to work with GitLab's protected tags feature and provides the ability to create truncated version tags (e.g., `v1.2`).

## Why Use This Plugin?

Renovate is an excellent tool for keeping dependencies updated, but it can generate significant maintenance overhead through frequent update merge requests.
With truncated version tags (e.g., v1.2 instead of v1.2.3), Renovate only creates merge requests for minor or major version changes, not for every patch release.
This dramatically reduces the "noise" from constant update notifications while still keeping your dependencies current.

However, GitLab's protected tags feature prevents truncated tags from being deleted or modified through standard git operations.
Removing the tag protection means that pipelines running on these tags may not have access to secrets requires for the deployment process.

This plugin solves this dilemma by managing truncated tags through the GitLab API, allowing tags to remain protected.

## Installation

```bash
npm install --save-dev @gitlab-com/truncated-tags
```

## Configuration

1.  Add this plugin to your `package.json` file:

    ```json
    {
      "devDependencies": {
        "@gitlab/truncated-tags": "^1.0.0"
      }
    }
    ```
2.  Add this plugin to your semantic-release configuration file, e.g. `.releaserc.json`:

    ```json
    {
      "branches": ["main"],
      "plugins": [
        "@semantic-release/commit-analyzer",
        "@semantic-release/release-notes-generator",
        "@gitlab/truncated-tags",
        "@semantic-release/gitlab"
      ]
    }
    ```

    Make sure to place this plugin **before** `@semantic-release/gitlab` in your plugins list.

## Required Environment Variables

* `GITLAB_TOKEN`: A GitLab personal access token or CI token with API access to manage tags
* `CI_PROJECT_PATH`: GitLab project path (automatically set in GitLab CI/CD pipelines)
* `CI_API_V4_URL`: GitLab API URL (automatically set in GitLab CI/CD pipelines)

## How It Works

1. **Validate Version**: Checks if the new version is suitable for truncation (e.g., has more than two parts).
2. **Handle Existing Tags**: If a tag already exists, the plugin will delete and recreate it via the GitLab API.
3. **Create Truncated Version Tag**: Creates a tag with only the major and minor version components (e.g., `v1.2`).

## Custom Options

The plugin currently doesn't support custom configuration options.

## License

MIT License, see `LICENSE` file.
npm package: @gitlab/untamper-my-lockfile
Description: Checks if yarn.lock has been tampered with
Author: Dennis Appelt, GitLab Security Team
Latest version: 3.0.0

# untamper-my-lockfile

A tool for checking if `yarn.lock` was tampered with.

**IMPORTANT**: Do not rename the CI template `.gitlab-ci-template.yml` or change the visibility of this project. Doing so would break the CI pipelines of projects that "include:" the CI template.

## Why

The content of `yarn.lock` can be manipulated to resolve a declared dependency to an alternative, attacker-controlled dependencies.
This tool prevents such an attack scenario by checking that dependencies in `yarn.lock` are resolved correctly.

## Usage

### GitLab CI

Please see our instructions in [./templates](./templates/).

### Locally

The safest variant is running this tool in docker:

```bash
docker run --volume "$(pwd)/yarn.lock:/tmp/yarn.lock" --rm \
  registry.gitlab.com/gitlab-org/frontend/untamper-my-lockfile:main \
  untamper-my-lockfile --lockfile /tmp/yarn.lock
```

Otherwise you need node@10 or newer.

```bash
yarn global add '@gitlab/untamper-my-lockfile'
untamper-my-lockfile --lockfile yarn.lock
```

## How it works

In [Yarn 1](https://classic.yarnpkg.com/lang/en/), each entry in `yarn.lock` is of the form:

```
dependency@semver:
  version: x.y.z
  resolved "https://registry.yarnpkg.com/..."
  integrity "hash"
```

In [Yarn 2+](https://yarnpkg.com/), each entry is in YAML form:

```
"dependency@npm:semver, dependecy@npm:~semver2":
  version: x.y.z
  resolution: "dependency@npm:x.y.z"
  checksum: abcdef123...
```

This tool iterates over each entry in the lockfile and does:

1. Retrieve the package (`dependency`) information information from https://registry.npmjs.org
1. If the version `x.y.z` doesn't exist on the registry => Warning
1. If the `resolved` URL or `integrity` hashes do not match against what is published on the registry => Error