Skip to main content

Roadmap

This is a rough list of items from my personal backlog that I'll be working on the coming weeks, plus the open feature requests from the issue tracker. Feel free to upvote or comment on any of the linked issues if one of them matters to you.

Minor features

  • Let dependencies find redundant references and version conflicts in npm, yarn and pnpm projects too (today it only reads NuGet restore output)
  • Make dependencies match project references through AssemblyName instead of the project file name
  • Report dependency hygiene findings in the SARIF output, and fail the PackageGuard build itself on them with --severity error
  • Allow specifying the location of dotnet.exe
  • Allow ignoring certain .csproj files or folders using Globs or wildcards (e.g. build.csproj)
  • Expose the internal engine through the PackageGuard.Core NuGet package
  • Add direct support for Nuke
  • Add a --why flag to analyze that shows an abbreviated dependency path inline on a violation, without needing a separate explain call
  • Build a real parent-child dependency graph for npm, yarn and pnpm projects, so --sbom and explain output for those ecosystems is as accurate as it already is for NuGet
  • Scope explain's NuGet registry and license lookups to the resolved package's own dependencies too, the same way its risk-signal fetching already is, so a lookup in a large solution doesn't fetch metadata for every unrelated package first

Ecosystem support

  • #219 Add support for Python dependencies (requirements.txt, poetry.lock, uv.lock)

CI/CD and IDE integration

  • #213 A first-party GitHub Action with SARIF violation annotations on pull requests
  • #221 MSBuild integration that reports violations as build warnings in the IDE
  • #215 A pull-request diff mode that analyses only added or upgraded packages

Policy and configuration

  • #218 Built-in policy presets that configurations can extend
  • #217 Support SPDX license expressions (OR, AND, WITH) instead of plain identifiers
  • #225 A feed provenance policy asserting which feed a package must come from
  • #211 A baseline and suppression file so existing codebases can adopt PackageGuard incrementally

Reporting and output

  • #214 Machine-readable violation output (JSON, Markdown, SARIF, JUnit)
  • #216 Generate a third-party attribution / NOTICE file with full license texts
  • #224 Track risk scores over time and show trends in the report

Security and supply chain

  • #220 Detect typosquatting and dependency-confusion risks