scripts/check-outdated.mjs

@@ -2,7 +2,13 @@
  * check-outdated.mjs — pnpm outdated advisory-only tiered report (D-06 / OQ-01).
  *
  * Classifies all outdated packages into four tiers in priority order:
- *  1. AUDIT-ADVISORY    — the package's current version carries a known advisory
+ *  1. OUTDATED-WITH-ADVISORY — an outdated DIRECT dep whose name also appears as
+ *     an advisory subject. NOTE (WR-04): `pnpm outdated` lists only direct/top-
+ *     level deps, while most advisories are on TRANSITIVE deps (e.g. esbuild), so
+ *     the two sets rarely intersect and this tier usually reports "(none)". It is
+ *     a best-effort flag for the case where a *direct* dependency you control is
+ *     both outdated and carries an advisory — NOT a full advisory cross-check of
+ *     the dependency tree. The authoritative advisory gate is check-audit.mjs.
  *  2. MAJOR-BEHIND-INTENTIONAL — latest major > current major, pin reason exists in outdated-pins.json
  *  3. MAJOR-BEHIND-UNPINNED    — latest major > current major, no pin reason (potential liability)
  *  4. ROUTINE-DRIFT             — same major, minor/patch behind (low priority)
@@ -72,7 +78,7 @@ try {
   }
 } catch {
   // Audit parse failure is non-fatal for the outdated report
-  console.warn('[check-outdated] Warning: could not parse pnpm audit output; AUDIT-ADVISORY cross-check skipped');
+  console.warn('[check-outdated] Warning: could not parse pnpm audit output; OUTDATED-WITH-ADVISORY cross-check skipped');
 }
 
 // ── Run pnpm outdated ────────────────────────────────────────────────────────
@@ -112,7 +118,9 @@ for (const [pkgName, info] of Object.entries(outdatedData)) {
     dependentPackages: info.dependentPackages,
   };
 
-  // Priority 1: the package has an active advisory on the pinned version
+  // Priority 1: this outdated DIRECT dep also appears as an advisory subject.
+  // Rarely fires — most advisories are on transitive deps (see WR-04 note in the
+  // file header); the authoritative advisory gate is check-audit.mjs.
   if (hasAdvisory) {
     tiers.auditAdvisory.push(entry);
   // Priority 2: major behind + intentional pin
@@ -132,8 +140,9 @@ console.log('');
 console.log('=== DEPENDENCY HEALTH REPORT ===');
 console.log('');
 
-// Tier 1: AUDIT-ADVISORY
-console.log('[AUDIT-ADVISORY] Packages with active advisories on the pinned version:');
+// Tier 1: OUTDATED-WITH-ADVISORY (direct deps only — see WR-04 note in header)
+console.log('[OUTDATED-WITH-ADVISORY] Outdated direct deps that also appear as an advisory subject');
+console.log('  (best-effort; most advisories are on transitive deps — authoritative gate is check-audit.mjs):');
 if (tiers.auditAdvisory.length === 0) {
   console.log('  (none)');
 } else {