depcurfew v1.6.1
On this page

Warnings and errors of init and apply

The codes of the warnings, notes and errors that depcurfew init and depcurfew apply give, with what each one means.

init warnings and notes

depcurfew init says what it wrote and, as warnings and notes with a code, what to look at before depcurfew apply: the projects it listed, a directory it left out of them, the delay it kept and what the default policy blocks. The text, on stdout, shows each with its level word, the message with its code in parentheses and what to do on the next line. depcurfew init --json (also with --user) prints one JSON document and nothing on stderr: policy (the file written, as the text names it; null when the directory does not exist or the home directory cannot be used), written, action (create or overwrite, null when nothing was written), projects, tools (each detected tool with tool, name, directory and supported; null with --user, which detects none), warnings and notices (each with code, level, location with file and, when known, line, message and fix; paths relative to the directory init works on, under ~/ with --user) and errors, why nothing was written, with the codes of apply (policy-exists, cannot-write, directory-not-found, not-a-directory, home-missing). The exit codes are those of the text: 0 written (warnings and notes included), 1 not written (the file exists without --force, it cannot be written, or with --user the home directory cannot be used), 2 a usage error or a directory that does not exist.

Install scripts: init reads the lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, deno.lock, as lockfile-install-scripts reads them) and writes the packages whose scripts depcurfew knows into installScripts.deny, each with a note that says why and what changes (install-script-denied, install-script-project-task). esbuild works without its postinstall as long as optional dependencies are installed, which hold its binary (without the script the esbuild command starts through a small Node.js script instead of the binary); fsevents loses nothing, since the package already contains the built fsevents.node; lefthook's postinstall only runs lefthook install, which installs the git hooks (and does nothing in CI), and the note says to run lefthook install after each clone of the repository, as the lefthook documentation says for projects that do not use its postinstall script (depcurfew never edits scripts). These notes are given for a package from a registry only: a package of the same name from git, a URL or a local path, or an entry whose resolved URL is the tarball of another package, is listed with the other packages to review. A known package that the package manager's own allow-list of install scripts (in package.json, pnpm-workspace.yaml or deno.json) already lets run its script stays out of installScripts.deny, as the project decided otherwise there; a note to review names it with that list and its line (install-scripts-to-review). Each fact names the release it was checked at, and a note says so when the lockfile has another one. The other packages with install scripts are listed in a note to review (install-scripts-to-review), and a lockfile that does not record install scripts (pnpm-lock.yaml, yarn.lock) gets a note too (install-scripts-not-recorded).

Warnings:

  • warning project-left-out: A direct subdirectory with a manifest or lockfile is left out of projects, because depcurfew apply would refuse it (it has a depcurfew.json of its own, it is a separate git repository, or its name differs from that of a listed directory only in case).

Notes:

  • note projects-listed: The repository root has no manifest or lockfile, but direct subdirectories do, so init lists them under projects in depcurfew.json.
  • note cooldown-kept: The repository (with --user, the user file of an installed tool) already sets a longer release-age delay, so cooldown.minimum keeps it instead of the default; a fixed date of uv, PDM or Deno counts as the whole days since it.
  • note sources-kept: An .npmrc of the repository already denies a dependency source the default policy allows (allow-file=none, allow-directory=none), so init writes "deny" for it in sources.
  • note security-delay-kept: Renovate already delays security updates (vulnerabilityAlerts.minimumReleaseAge), so init writes cooldown.securityUpdates "delay" instead of "bypass", which would make depcurfew apply remove the delay.
  • note exclusions-kept: The tools' own exception lists already exempt packages from the release-age delay (npm's min-release-age-exclude, pnpm's minimumReleaseAgeExclude, Dependabot's cooldown.exclude...), so init lists them in cooldown.exclude, where depcurfew apply keeps them; review each before depcurfew apply.
  • note install-scripts-kept: The package managers' own allow-lists already let packages run install scripts (pnpm's allowBuilds or onlyBuiltDependencies, Bun's trustedDependencies, Yarn's dependenciesMeta, npm's or Deno's allowScripts), so init lists them in installScripts.allow; review each before depcurfew apply.
  • note python-builds-denied: installScripts.default "deny" also blocks building Python packages from source, so a package without wheels for the platform stops installing until it is allowed.
  • note tool-only-in-ci: A tool appears only in a CI setup step, so depcurfew apply does not configure it under targets "auto".
  • note install-script-denied: A lockfile has a package whose install script depcurfew knows it does not need (esbuild, fsevents), so init adds it to installScripts.deny; the note says what changes without the script.
  • note install-script-project-task: A lockfile has a package whose install script only does a task of the project (lefthook installs the git hooks), so init adds it to installScripts.deny; the fix says how the project runs that task itself.
  • note install-scripts-to-review: A lockfile has other packages with install scripts, or composer.lock has Composer plugins (the note says which ones config.allow-plugins in composer.json already allows), which installScripts.default "deny" blocks; review each before depcurfew apply.
  • note composer-source-checkouts: config.preferred-install in composer.json makes Composer install packages of composer.lock from their VCS repositories, which sources.git "deny" does not allow, so depcurfew doctor reports them; the note says which entry and which packages.
  • note bot-config-unreadable: The Dependabot configuration uses a YAML alias, which Dependabot does not accept, so it reads no configuration from the file, and init does not read the delays it sets when it chooses cooldown.minimum.
  • note install-scripts-not-recorded: A lockfile does not record which packages have install scripts (pnpm-lock.yaml, yarn.lock, a bun.lock that marks none, which Bun before 1.4.4 writes), or is in a format depcurfew does not read, so init can name only the packages depcurfew knows.

apply warnings and errors

Each warning and error of apply has a code. The text output shows it in parentheses after the message, with what to do on the next line, like a doctor finding. depcurfew apply --json (also with --dry-run) prints one JSON document and nothing on stderr: changes (each file with its action and unified diff), warnings and errors (each with code, level, message and fix; tool when it concerns one tool; location when it concerns one file, with file and, when known, line; for an invalid policy also issues), snippets to add by hand, notices (such as policy-from-parent) and written. A run that writes nothing because of an error lists no changes and exits with 1. Diffs, on the terminal, in a pipe and in changes, show the values of secrets as <redacted> (_authToken, _auth, _password and the client key key in .npmrc, keys ending in token or password, the user part of a URL up to the last @ before its host, also a token alone such as https://TOKEN@host or git+https://ghp_…@github.com, but not the login name of an ssh URL such as git+ssh://git@github.com), also under a quoted key such as "//registry.npmjs.org/:_authToken" and in a line of .npmrc or pip.conf that a lone carriage return splits in two, as npm and pip read it. A value that goes on over several lines is hidden on every line: in YAML a block scalar (|, >), a quoted value that does not close on the key's line, a plain value that continues on more indented lines and a value on the lines below its key; in TOML a multi-line string and an array or inline table, also under a quoted or dotted key such as "acme".token. In JSON files they also show every value of Composer's credentials, which Composer keys by host (github-oauth, gitlab-oauth, gitlab-token, bearer, http-basic, bitbucket-oauth, custom-headers, client-certificate, forgejo-token and the HTTP headers of a repository), read by their place in the document, so also in a minified composer.json. So a diff can be shared or logged; the files keep the values. The lines that doctor (config-drift) and doctor --user quote show secrets the same way. The text diff also shows control and bidirectional characters from the files as text (\x1b, ‮), so that a value cannot drive the terminal or a CI log; changes keeps them, escaped by JSON.

Warnings:

  • warning nothing-to-configure: depcurfew found no supported package manager or bot, so nothing is configured.
  • warning environment-overrides: apply --user: an environment variable makes a tool read another user file or none, or overrides a value apply writes there.
  • warning depcurfew-outdated: The project installs a newer depcurfew than the one running, which may not know settings that version writes.
  • warning file-unreadable: A file that shows which tools a project uses cannot be read or parsed (too large, a symlink out of the repository, no read permission, invalid), so depcurfew may configure fewer tools than the project uses.
  • warning tool-not-supported: A detected or installed tool is not supported (Yarn Classic), so nothing is written for it.
  • warning target-not-found: With projects, a package manager listed under targets is configured in each directory (the root or a project) that uses it, and none uses it, so nothing is written for it.
  • warning tool-only-in-ci: A tool appears only in a CI setup step, with no manifest, lockfile or configuration in the repository, so targets "auto" does not configure it.
  • warning version-not-pinned: No exact version of a package manager is pinned, so depcurfew configures for the latest version it knows.
  • warning version-too-old: The pinned version of a tool (with apply --user, the installed one) lacks a setting the policy needs, so that setting is not written.
  • warning version-in-use-too-old: Another npm the repository runs than the pinned one (one a declared Node.js comes with, such as Node.js 24 in .nvmrc, or a CI job or Dockerfile installs) lacks a setting apply writes for the release-age delay or a dependency source, so that setting has no effect there; doctor reports the same places as manager-version-too-old. A place that only runs npm ci needs no delay.
  • warning version-unknown: apply --user: the installed version of a tool cannot be read from its files, and a value it does not understand would stop every command, so nothing is written for it.
  • warning no-user-config: apply --user: the tool has no user-level configuration file, so nothing is written for it.
  • warning user-setting-project-only: apply --user: the tool reads a part of the policy only from project files, so it is not written into the user file.
  • warning user-directory-relative: apply --user: the environment variable that names the directory of the user file (XDG_CONFIG_HOME, APPDATA) is a relative path, so the tool looks in another place from each directory, or where it looks then is not known; nothing is written for it.
  • warning user-file-uncertain: apply --user: a library the tool calls decides where its user file is (platformdirs for Poetry and PDM on macOS), and its version cannot be read from files, so apply --user writes where the tool's docs say and names the other files the tool may read.
  • warning user-setting-overridden: apply --user: a file the tool reads ahead of its user file (~/.npmrc for pnpm 10) sets a key apply writes there to another value, so the value written has no effect.
  • warning version-not-used: apply --user: --for gives the version of a tool that apply --user does not configure (not in PATH with targets "auto", or not listed under targets).
  • warning cooldown-not-written: The release-age delay cannot be written for a tool (for Bundler: a source call of the Gemfile apply does not edit, no source "https://rubygems.org", or a Gemfile depcurfew cannot read as Ruby does from the line given on, which it then does not edit at all; for pnpm 12.15 and later: include in pnpm-workspace.yaml gives minimumReleaseAge to a config dependency or to a file outside the directory).
  • warning cooldown-shortened: A release-age delay set outside depcurfew's markers (in JSON files also one an earlier apply wrote) is longer than the policy, and apply replaces it with the shorter one; a fixed date of uv, PDM or Deno counts as the time since that date.
  • warning cooldown-overridden: A setting in the file apply writes the delay to undoes it for some or all packages, and apply does not change it (Cargo: resolver.incompatible-publish-age = "allow", or a shorter registries.crates-io.min-publish-age, which wins over the global key for crates.io).
  • warning cooldown-limits: The release-age delay apply writes does not cover everything the tool installs (Cargo: cargo install of a crate, versions a registry gives no publish time, fixes it holds back as well, and a value in $CARGO_HOME/config.toml or the environment that overrides the project).
  • warning cooldown-environment-only: pip reads no project configuration, so the release-age delay has to be set in the environment where pip runs.
  • warning exclude-pattern-unsupported: A cooldown exception uses a wildcard the tool does not support, so it is not written.
  • warning exclude-ignored-by-exec: npx, npm exec and npm x do not read min-release-age-exclude: the packages of cooldown.exclude that they download still wait for the release-age delay.
  • warning exclude-unsupported: The tool has no setting for cooldown exceptions, so the release-age delay applies to every package (Bundler: also because the policy has no names for Ruby gems).
  • warning exclude-not-written: The setting that holds the cooldown exceptions (Composer's config.policy.cooldown.ignore) has a value of a type the tool does not accept there, so apply leaves it as it is and does not add the exceptions; the release-age delay is written.
  • warning exclude-entry-outside-policy: A cooldown exception in a file without depcurfew's markers (Composer's config.policy.cooldown.ignore) exempts a package that cooldown.exclude does not; apply removes only the entries it wrote, recognised by their reason, and leaves this one.
  • warning allow-pattern-unsupported: An installScripts.allow entry is a pattern, but the tool takes package names only, so it is not written.
  • warning deny-pattern-unsupported: An installScripts.deny entry is a pattern, but the tool records denials by package name only, so it is not written.
  • warning allow-all-unsupported: The tool has no setting that allows every install script, so installScripts "allow" is not written.
  • warning allow-all-replaced: A setting that allowed every install script (with any value the tool reads as true, also one that a YAML merge key brings in, or pnpm 10's dangerously-allow-all-builds in .npmrc) was set to false, or replaced with the policy's allow-list where the setting is the list itself (Deno's allowScripts, Composer's allow-plugins, which then may be {}), because the policy denies install scripts.
  • warning allow-list-entry-outside-policy: An install-script allow-list in the repository (with apply --user, in a user file) lets a package run scripts the policy does not allow, or will once the tool reads the list (Deno before 2.6.0 does not read allowScripts); apply does not remove it.
  • warning deny-conflicts-with-file: An entry in a tool's own list lets a package of installScripts.deny run its install scripts, or blocks a package of installScripts.allow; apply does not change entries it did not write.
  • warning deny-needs-optional-dependencies: A package of installScripts.deny takes its binary from an optional dependency (esbuild), but npm leaves optional dependencies out (omit=optional or optional=false in .npmrc, --omit=optional or --no-optional on an install of a CI job or Dockerfile, NPM_CONFIG_OMIT=optional), so the package cannot find its binary after that install.
  • warning unexpected-value: A setting apply adds to has a value of a type the tool does not accept there, so apply leaves it as it is and writes nothing into it.
  • warning built-in-list-replaced: Bun's built-in list of trusted packages is replaced by the policy's allow-list.
  • warning scripts-not-enforceable: The pinned (with apply --user, the installed) npm or pnpm, or another npm the repository runs (one a declared Node.js comes with, or a CI job or Dockerfile installs), runs every install script and has no allow-list, so "deny" cannot be enforced; also given for an npm the repository runs whose version depcurfew cannot tell, which counts as one that runs them, and for Bundler, which builds the native extensions of gems at install time and has no setting that stops it.
  • warning strict-allow-scripts-for-npm-in-use: An npm the repository runs (the pinned one, one a CI job or Dockerfile installs, or one a declared Node.js comes with, for a project also through the root version files and root Dockerfiles that build it) is 11.16 to 11.x and runs install scripts the allow-list does not cover unless strict-allow-scripts is set, so apply writes strict-allow-scripts=true, which makes npm 12 stop the install at such a script; not given when that npm is the pinned one and no place runs npm 12.
  • warning before-overrides-cooldown: before= in .npmrc takes the place of the release-age delay apply writes, or makes npm stop with an error next to it (apply --user then does not write the delay).
  • warning exact-version-gap: The pinned (with apply --user, the installed) pnpm skips the release-age delay for packages requested by exact version.
  • warning setting-owned-elsewhere: pnpm 12.15 and later: include in pnpm-workspace.yaml gives a setting the policy needs to a config dependency or to a file outside the directory, so apply does not write it (pnpm refuses a setting with two owners, ERR_PNPM_DUPLICATE_SETTING) and cannot check its value; the release-age delay itself gives cooldown-not-written.
  • warning source-not-enforceable: The tool has no setting for a dependency source the policy denies; doctor checks the lockfile instead, where it reads it (not Gemfile.lock).
  • warning source-loosened: A dependency-source setting outside depcurfew's markers is stricter than the policy (npm's allow-file or allow-directory none or root, pnpm's blockExoticSubdeps true, a Yarn approvedGitRepositories list without **), and apply replaces it with the value the policy's "allow" gives.
  • warning security-delay-removed: Renovate delays security updates (vulnerabilityAlerts.minimumReleaseAge), but cooldown.securityUpdates is "bypass", so apply sets it to null and Renovate proposes them at once.
  • warning exclusion-dropped: A cooldown exception set outside depcurfew's markers (an entry of npm's min-release-age-exclude, pnpm's minimumReleaseAgeExclude, Yarn's npmPreapprovedPackages, Bun's minimumReleaseAgeExcludes, Deno's minimumDependencyAge.exclude, uv's exclude-newer-package, PDM's exclude-newer-override, Poetry's min-release-age-exclude or Dependabot's cooldown.exclude) is not in cooldown.exclude, so apply comments it out (removes it in JSON), and the package waits again. Also an entry of uv's exclude-newer-package with a date or a duration that holds its package back less than cooldown.minimum; one that holds it back longer stays in the managed block.
  • warning source-switch-indirect-only: The pnpm setting for git and tarball sources stops them only for indirect dependencies.
  • warning source-switch-combined: One pnpm setting covers git and tarball sources, so denying one denies both.
  • warning forced-source-build: Python packages on the allow-list are always built from source, because no tool can only allow a build.
  • warning build-switch-scope: The tool's switch forbids building only packages from an index; git, local and archive dependencies are still built.
  • warning build-switch-install-only: Poetry applies its build switch when installing; poetry lock may still build source distributions.
  • warning build-switch-environment-only: The tool has no project setting that forbids building from source, so it has to be set in the environment where the tool runs.
  • warning requirements-file-missing: There is no requirements file to write pip options into.
  • warning build-switch-undone: A line of a requirements file pip reads (requirements.txt or a file it includes with -r or -c) has --no-binary or --only-binary=:none:, which undoes the --only-binary=:all: apply writes, and apply cannot comment it out: the option follows a requirement, shares its line with other options or continues on the next line.
  • warning requirements-include-unread: A requirements file pip reads includes another one (-r, -c) that apply cannot check for lines that undo --only-binary=:all: (a URL, a path outside the directory configured, a missing file, or a file it cannot read).
  • warning manifest-missing: A setting belongs in a project manifest (package.json, deno.json, pyproject.toml, Pipfile, composer.json, Gemfile) that does not exist, and apply does not create manifests.
  • warning lockfile-out-of-date: The lockfile records, or is checked against, a setting apply changed, so it has to be locked again.
  • warning file-ignored-by-git: A file apply writes matches a .gitignore rule, so the change may never reach the repository.
  • warning bot-config-missing: A bot has no configuration file, and depcurfew does not create one.
  • warning bot-config-not-edited: A bot configuration file is in a place or format depcurfew does not edit; a snippet shows what to add.
  • warning bot-entries-missing: The Dependabot configuration has no entries for the package managers in use.
  • warning bot-config-unreadable: The Dependabot configuration uses a YAML alias, which Dependabot does not accept, so it reads no configuration from the file (the cooldown apply writes included), and depcurfew does not read the delays the file sets.
  • warning bot-rule-shortens-delay: A Renovate packageRules entry apply does not manage gives every package of a registry, Renovate manager or category in use, the actions of the workflows or the dependencies of an ecosystem updated by bots only (Cargo, Go modules, Maven, Gradle, NuGet), or some update types of them, a shorter release-age delay than the one apply writes; or a Dependabot updates entry apply writes the cooldown into has a cooldown.include list, which limits the cooldown to the dependencies it names, or keeps a cooldown.exclude list that matches every dependency (an entry for actions, Ruby gems or an ecosystem updated by bots only, whose list apply does not replace). The bot uses these, and apply does not change them.
  • warning security-delay-unsupported: Dependabot cannot delay security updates, so securityUpdates "delay" is not applied.

Errors (nothing is written):

  • error cannot-edit: A file cannot be read or edited safely (invalid syntax, a symlink, a style depcurfew does not edit, a file over the size depcurfew reads, 1 MiB for configuration and 64 MiB for lockfiles, also one that the change would make larger than that), so nothing is written.
  • error cannot-write: A file cannot be written (no permission, a read-only file system, a full disk, a directory or symlink in its place); the files already written are put back, so nothing changes.
  • error policy-missing: The directory has no depcurfew.json.
  • error policy-invalid: depcurfew.json does not follow the schema; issues lists the problems.
  • error policy-unreadable: depcurfew.json cannot be read.
  • error policy-exists: depcurfew init found a depcurfew.json and writes it only with --force.
  • error directory-not-found: The directory given on the command line does not exist or cannot be opened.
  • error not-a-directory: The path given on the command line is a file, not a directory.
  • error usage: The command line is not valid: an unknown command, option or hook, a missing or extra argument, an option without its value or with one it does not take (such as a --registry that is not an http:// or https:// URL), or options that cannot go together (exit code 2); with --json the document holds only schemaVersion and this error.
  • error project-not-found: A directory listed in projects in depcurfew.json does not exist, so nothing is written.
  • error project-not-a-directory: A path listed in projects in depcurfew.json is a file, not a directory, so nothing is written.
  • error project-symlink: A directory listed in projects in depcurfew.json is a symlink or lies under one, which may lead out of the repository, so nothing is written.
  • error project-has-policy: A directory listed in projects has a depcurfew.json of its own, a second policy for the same files, so nothing is written.
  • error project-is-repository: A directory listed in projects is a separate git repository or lies in one (it has a .git of its own, as a git submodule does), whose files belong to that repository, so nothing is written.
  • error project-in-workspace: A directory listed in projects is, holds or lies in a workspace package of the repository root, which the root configuration already covers, so nothing is written.
  • error home-missing: apply --user and init --user: the home directory (HOME, USERPROFILE on Windows) does not exist or is not an absolute path, so nothing is written.