fix(deps): update dependency lockgraph to ^0.6.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lockgraph	^0.2.0 → ^0.6.0

---

Release Notes

lockgraph/lockgraph (lockgraph)

v0.6.6

Compare Source

Fixes & improvements

• refactor(api): a canonical snapshot is four projected sections (482d4bf)
• refactor(registry): bind endpoint, credential and transport into one route (8508d1a)
• refactor: name the concepts behind the worst-measured functions (85ec4a8)
• docs: PM.md imprs (04037ba)
• fix(pnpm): carry requiresBuild and certify installed trees against real installers (af793c3)
• fix(npm): replay bare workspace entries through the exact-path carrier (50022fb)

v0.6.5

Compare Source

Fixes & improvements

• fix(npm): stop flattening a legacy array engines into an object (d213eb2)
• fix(npm): retain entries carrying keys the projection cannot emit (8503090)
• fix(pnpm): preserve snapshot optional bits and numeric scalar types (76a8b75)
• fix(npm): preserve per-path entry metadata and restore vanished install paths (9049064)
• docs: state producer behaviour, not lockgraph scores (fa0d1fc)
• fix(npm): key installed-entry flags by path, carry bundled dependencie (da2571d)
• fix(yarn): preserve source-authored npm: protocol spelling in berry locks (a301670)

v0.6.4

Compare Source

Fixes & improvements

• fix(npm): carry native root metadata and accept dependency-free locks (a911315)
• fix(npm-1): bind source-authored mirror targets (4594005)
• fix(pnpm): recover verified hashed workspace peers (1818198)
• docs: make the format specs stand on their own (f8f5505)
• fix: model a hashed pnpm peer set as context, not as version (2fcd5f6)
• fix: build the pnpm v5 peer tail the way pnpm builds it (382b092)
• fix: encode pnpm workspace locators the way pnpm encodes them (f68edaf)
• fix: read a lock the way its producer reads it (3ecadfb)

v0.6.3

Compare Source

Fixes & improvements

• fix: emit pnpm locks that pnpm can install (691ec26)
• fix: read the lockfile shapes producers actually write (ca9757f)
• fix: make real-world lockfiles round-trip across five formats (e2329ea)
• fix: make real-world lockfiles round-trip across five formats (3081102)
• fix(deno): match Deno's own bytes for modified lock (8956d7d)

v0.6.2

Compare Source

Fixes & improvements

• fix(api): preserve strict Yarn projection and declaration contracts (2296426)
• fix(api): re-expose refurbish for same-format repair (7ffcd1a)
• docs: split convert.md and pairs.md (cd65d8d)

v0.6.1

Compare Source

Fixes & improvements

• docs: split readme.md and api.md (b3da8f3)

v0.6.0

Compare Source

Features

• feat(api): unify operations on one options spine and one public entry (3de5a47)
• feat(api): promote downstream seams to the root facade (698d81b)
• feat(enrich): persist verified artifact bytes in a private CAS (bd6b2a0)
• feat(enrich): fetch and verify artifact bytes from registries (f012ff7)
• feat(enrich): accept ordered artifact source lists (7feafbe)
• feat(api): unify target and enrich option shapes (0adcd8a)
• feat(registry): separate npm-tarball and yarn-checksum byte sources (a5685c1)

Fixes & improvements

• fix(baseline): attribute the subpaths package.json actually exports (2b8a6c8)
• fix(convert): forward workspace root and artifact resource policy to enrichment (d60bf43)
• fix: preserve npm alias identity across projections (86b8432)
• docs(yarn): describe how repacked zips are stored (6713f62)
• fix: preserve npm local directory resolutions (9ca05ad)
• fix: separate project roots from graph roots (8beff8c)
• refactor(api): accept the subject first in parse, stringify and check (84904ae)
• docs: record measured conversion boundaries (99074ef)
• fix: preserve dependency declaration semantics in projections (0bbd36c)
• fix(npm): suppress repeated install occurrences of aliased edges (9b64bd5)
• docs: readme imprs (f9e24b4)

v0.5.0

Compare Source

Features

• feat(deno): split deno.lock into deno-v2..deno-v5 format identities (663e15b)
• feat(deno): convert deno.lock to the npm family with required manifest evidence (deb64c6)
• feat(deno): add deno.lock adapter with native producer certification (61c09c2)

Fixes & improvements

• fix(formats): preserve producer-accepted unknown top-level extensions (93f52dd)
• docs(deno): detail what changes between lockfile versions (c1a67bf)
• docs: move spec to docs/spec, split arch and meta (a6092f1)
• docs: split registries into REGISTRIES.md, add default-registry column to PM.md (8f69721)
• docs: add PM.md — the JavaScript package manager reference (7eebc76)

v0.4.0

Compare Source

Features

• feat(interop): close the npm-4 conversion pair matrix and record its losses (50dc717)

Fixes & improvements

• fix: preserve pnpm workspace-peer names, patch markers and bun tuple structure on round-trip (1426550)
• fix: drop false version constants and make graph digests independent of tool identity (6a385ee)

v0.3.0

Compare Source

Features

• feat: provide support for npm lockfiles v4 (#​20) (d48f280)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud