Dep Beacon
Built and published dependency tools for VS Code and Zed that bring npm dependency status, update targets, pnpm workspace catalog context, and OSV security signals into package manifests.
En esta página 1 sección
Project notes
Active project
Building dependency signals for VS Code and Zed
- Estimated reading time
- About 4 minutes
- In this project story
- 6 sections
Dep Beacon is a dependency intelligence engine for npm projects with extensions for VS Code and Zed. It brings version status, safe update targets, pnpm workspace catalog awareness, and OSV vulnerability warnings directly into the manifests developers already edit.
The project includes a shared analysis core, a VS Code extension, a language server with a Zed adapter, and an Astro documentation site at beacon.santi020k.com. The VS Code extension is available from the Visual Studio Marketplace and Open VSX.
The Dep Beacon Zed extension is now available in the Zed extension registry. It brings dependency diagnostics, hovers, npm links, and individual or bulk update actions into Zed through the Language Server Protocol. See the Zed installation guide for setup and usage.
Outcomes
Available for VS Code through Visual Studio Marketplace and Open VSX, and for Zed through its extension registry
Shows inline dependency status, diagnostics, CodeLens update actions, and package-manager commands
Understands package.json, pnpm workspace catalogs, overrides, package extensions, and OSV vulnerability signals
Goals
Keep dependency decisions in context by showing status beside the version ranges developers already review.
Make update targets practical with patch, minor, major, and latest actions that preserve common range prefixes like
^and~.Respect workspace policy by resolving default and named pnpm catalogs before reporting package status.
Surface security risk early with OSV advisory checks that distinguish routine update work from vulnerable dependency ranges.
What I built
A shared analysis core
(
@santi020k/dep-beacon-core) that parses package manifests, npm registry metadata, semver ranges, pnpm catalogs, and OSV advisory responses.A VS Code extension
(
vscode-dep-beacon) with CodeLens update actions, inline status decorations, diagnostics, sorting, cache controls, prerelease toggles, and install commands.A Zed integration
powered by
@santi020k/dep-beacon-lspand a thin Rust/WebAssembly adapter, with dependency diagnostics, hovers, and update code actions.Manifest support
for
package.json, npm overrides, Yarn resolutions, pnpm overrides,pnpm-workspace.yaml, default catalogs, named catalogs, and package extensions.A documentation site
built with Astro, including installation, configuration, VS Code usage, pnpm workspace behavior, and security-signal documentation.
Release tooling
for package validation, extension packaging, marketplace publishing, Open VSX publishing, and docs deployment.
Technical highlights
- Zed integration
a language server shares dependency analysis with the VS Code extension while exposing diagnostics, hovers, and code actions through Zed.
- VS Code integration
VS Code Extension API, CodeLens providers, diagnostics, command contributions, output channels, and document-aware activation.- Dependency intelligence
npm-compatible registry lookups, semver target selection, package-range parsing, prerelease controls, and cache-aware analysis.
- Workspace awareness
pnpm catalog snapshots, overrides, package extensions, and manifest sections that centralize dependency policy.
- Security checks
OSV.dev vulnerability queries that map advisory severity to visible editor status.
- Documentation
an Astro docs app with generated preview assets, Open Graph images, and focused setup pages.
Results
- Available in both VS Code and Zed, with editor-specific integrations built around the same dependency analysis core.
- Dependency maintenance moved into the editorinstead of another dashboard or terminal-only workflow.
- Safer update decisionswith clear choices for patch, minor, major, and latest targets.
- Better monorepo supportfor teams using pnpm catalogs to coordinate versions across packages.
- A privacy-aware security pathwhere OSV checks can be disabled when a team does not want package/version data sent to an external advisory service.
Why it matters
Dependency reviews are usually small, repetitive decisions until they are not.
One range is stale. Another is catalog-managed. Another is vulnerable. Another is invalid or unpublished. Dep Beacon turns those scattered checks into visible editor signals so maintainers can decide faster without losing the nuance behind each manifest line.
That is the kind of developer tool I like building: small enough to stay close to the workflow, but opinionated enough to remove friction every time the file opens.
De este proyecto
Dentro del trabajo.
Project introduction
Dep Beacon: Dependency Signals Inside VS Code
Why I built Dep Beacon, a VS Code extension that keeps npm update paths, pnpm catalog context, and OSV security warnings inside manifests.
Leer artículoTool ecosystem
How I Built the santi020k Developer Tool Ecosystem
How Lumen, ESLint Config Basic, Quality, Astro Doctor, Commitprompt, Dep Beacon, OG, Theme, and Auth form one practical system for my projects.
Leer artículoComparte este artículo
Compártelo.
La copia automática no está disponible.
