vlt v1.7.0: vlt deploy, selective updates and pinned git dependencies

vlt v1.7.0 is out, and the main addition is the new vlt deploy command. It copies one workspace and its production dependencies into a standalone folder, ready to ship in a container image, the way pnpm deploy does. The dependencies are installed from the project's vlt-lock.json, so the folder gets the exact versions the project uses, and the workspaces it depends on are copied in as real folders, so nothing links back to the monorepo.

$ vlt deploy -w apps/api ./dist/api
📦 Deployed @acme/api@1.0.0 to /path/to/acme/dist/api
📚 2 dependencies installed
🔗 1 workspace copied: @acme/shared

The second highlight is vlt update <pkg>. vlt update now takes package names, or a query with --target, and resolves only those dependencies again: vlt update react react-dom leaves everything else on its locked version.

The third is that git dependencies are now locked to a commit. A dependency like github:user/repo#main used to be locked to its branch, so once the branch moved, an install from the lockfile could fail its integrity check or bring in different code. The lockfile now records the commit, vlt ci installs exactly that commit, and vlt update <name> moves it forward. Lockfiles written by older versions are pinned by the next vlt install.

Other changes

• vlt skills init scaffolds an agent skill. vlt skills init <name> writes a starter skills/<name>/SKILL.md and adds skills to the files of package.json when needed, so the skill ships with the package.
• vlt setup installs vlt's agent skills. vlt's own skills (vlt-cli, dss-query and vlt-registry-migration) are now published as @vltpkg/skills. vlt setup --config=project offers to install them as its last step, and vlt setup --skills runs just that step, with no prompt.
• Update notices. vlt now checks for a newer version in the background, at most once every 24 hours, and a later command prints a notice after its output. It stays silent in CI and when the output isn't a terminal, and --no-update-notifier turns it off.
• vlt publish --recursive keeps going. A private workspace or a version that was already published used to abort the whole run and leave every later package unpublished. With --recursive, --workspace, --workspace-group or --scope, those packages are now skipped and reported, and any other error still stops the run.
• vlt install rewrites workspace references to workspace:*. A dependency that links a workspace by a plain range or dist-tag, like "@acme/utils": "^1.0.0", is now saved as workspace:* in package.json and the lockfile. A range the workspace version doesn't satisfy is kept, with a warning. npm and Yarn v1 can't install workspace: specs, so opt out with --no-migrate-workspaces if the project still needs them.
• :types and :type selectors. :types matches packages that have a types package (@types/*) in the graph, a bare :type matches the types packages themselves, and :type(orphan) finds the ones whose target is missing from the graph.
• Graph modifiers reach peer dependencies. A modifier that ends on a peer dependency, like "#react-dom > #react": "18.2.0", was silently ignored and now replaces the peer range. Modifiers that share part of a path, like #react-dom > #scheduler and #react-dom > #loose-envify, now all apply, where only one of them did. And vlt query ':overridden' lists the modified dependencies again after an install.
• Invalid selectors match nothing. A query with more than one selector ignores an invalid one instead of failing. A few shapes, like :not(:foo), #a, matched every package instead, and now match only what the valid selectors select.
• gitlab: dependencies install again. The default GitLab archive URL returned a 404, and the GitHub one went through the REST API, which allows 60 unauthenticated requests per hour. Both defaults now point at archive URLs that work without that limit, and the install docs cover private GitHub repositories.
• More git dependencies install without git. github:user/repo, and hosted dependencies using ::path: or #semver:, were cloned on every install. They are now downloaded as the host's archive at the locked commit, with its integrity in the lockfile, and ::path: unpacks only its directory. Repositories with submodules are still cloned, and resolving a #semver: range still uses git to list the tags.
• Clearer integrity errors for git archives. When a host re-packs the archive of a locked commit, the install error now names the dependency and the commands that lock the new archive.

Thanks to @drawliin for the update notices, the workspace reference rewrite and the types selectors.

Try it

You can find every patch note in the GitHub releases. To install or update vlt, run:

curl -fsSL https://install.vlt.sh | bash

Already on vlt? Run vlt install -g vlt to update.