feat: detect provenance regression, such as the axios march 2026 incident

[lirantal]

Description

Fully addresses #314

Example real-world use cases:

• pino@9.14.0 vs pino@9.13.1
• nock@15.0.0 vs nock@14

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

• I have updated the documentation (if required).
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.39%. Comparing base (aea8d21) to head (a2541b6).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #414      +/-   ##
==========================================
+ Coverage   92.51%   93.39%   +0.88%     
==========================================
  Files          32       32              
  Lines        1443     1499      +56     
  Branches      320      350      +30     
==========================================
+ Hits         1335     1400      +65     
+ Misses         93       82      -11     
- Partials       15       17       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎉 This PR is included in version 3.18.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[slorber]

Nice :)

I'll have to study the new feature, but does it mean nqp can also be used as an alternative to pnpm to detect trusted publishing regressions (facebook/docusaurus#11874)

It feels a bit awkward to use pnpm just for that, while our monorepo does not use pnpm atm:

      - name: Forbid lifecycle scripts
        working-directory: ../test-website
        run: |
          rm -rf node_modules

          npm install -g pnpm@10.33.0

          cat > pnpm-workspace.yaml <<'YAML'

          blockExoticSubdeps: true

          strictDepBuilds: true
          allowBuilds:
            '@swc/core': true
            core-js-pure: true
            core-js: true

          trustPolicy: no-downgrade
          trustPolicyExclude:
            - 'detect-port@1.6.1'
            - 'semver@6.3.1'

          YAML

          pnpm install

But afaik there was no standalone CLI alternative.

Do you also support excludes like pnpm, or plan to?

[lirantal]

Hey! :)

Multifaceted answer so here are a few thoughts from me on this topic:

1. I won't straight out recommend or say to replace pnpm with npq, because I didn't do a feature parity comparison nor am I going to try to keep that up to date. And this is beyond the fundamental difference which I'm sure you're completely aware of that npq is not a package manager so it's comparing apples to oranges. To strengthen the point here, I would actually always recommend you do use pnpm (alongside with npq as a wrapper) due to the good security defaults and fast response from pnpm.
2. In your specific case Sebastien since it seems you only use pnpm for the provenance regression feature then yes, if you want to cover your bases on that front and save the hassle of that full-on pnpm compatibility setup then you can use npq instead but I believe that pnpm looks at the entire dep tree for the provenance, meaning transitive deps too, and npq only looks at your existing package.json, or the package you want to install (npq install docusaurus). So you probably still want to stick to pnpm for that :-)

I'll update when I figure out more on the area of transitive deps scanning which would enable this. There's a dangling PR from a POC I ran a while back but I still haven't yet landed 100% on it.

Keep a watch for more good changes though :-)

[slorber]

I understand thanks!

I'll keep using pnpm for now