GoKawiilToday, we're happy to announce vlt 1.0, and general availability of our hosted package registries and ecosystem mirrors. With these releases, vlt is now an end-to-end platform for developers, their teams and agents to ship faster, safer, and more reliably.
Our Package Manager
Since we first introduced vlt and vsr, the CLI has grown from a fast installer with a novel query syntax into a full-featured, security-first package manager now backed by our own infrastructure.
Here's some highlights:
over 60+ graph native pseudo selectors including ~30 focused on security — examples include :malware , :cve , :unmaintained , :outdated , :eval , :fs , :license , :vuln , :peer , :diff() , :built , :registry() , :hostname() , :dist() and more.
— examples include , , , , , , , , , , , , , and more. :host(local) allows for querying dependencies across every project on your machine at once, e.g. vlt query ':host(local) #react:v(<19)' to find which projects on your system that are on old react versions.
allows for querying dependencies across every project on your machine at once, e.g. to find which projects on your system that are on old versions. the --scope flag makes run , exec , pkg , version , pack , publish , and more even more powerful by bringing selectors to all commands.
makes , , , , , , and more even more powerful by bringing selectors to all commands. Graph Modifiers — override any dependency in vlt.json using DSS selectors with CSS-like specificity resolution.
— override any dependency in using DSS selectors with CSS-like specificity resolution. Phased installations allow vlt install to download without running scripts; and vlt build to run selectively, blocking known malware by default.
allow to download without running scripts; and to run selectively, blocking known malware by default. Catalogs help define dependency versions once in vlt.json , reference them everywhere with catalog: .
... continue reading