vlt 1.0 Released with Hosted Package Registries and Ecosystem Mirrors

vlt 1.0 Client Release

vlt 1.0 has been officially released. The client has evolved into a full-featured, security-first package manager, now supported by its own infrastructure. It includes over 60 graph-native pseudo selectors, with approximately 30 focused on security, such as :malware, :cve, and :unmaintained.

Enhanced Package Management Features

Key features in vlt 1.0 include the :host(local) selector for querying dependencies across all projects on a machine, and the --scope flag to extend selector functionality to commands like run, exec, and publish. Graph Modifiers allow overriding dependencies in vlt.json using CSS-like specificity. Phased installations enable downloading without script execution and selective building, blocking known malware by default. Catalogs help define and reference dependency versions centrally.

OIDC Trusted Publishing

vlt 1.0 introduces OIDC "trusted publishing," allowing publication from CI environments to the npm public registry without long-lived tokens. This feature works out-of-the-box with GitHub Actions and supports GitLab CI and CircleCI when their OIDC tokens are provided.

Hosted Registries and Ecosystem Mirrors

Alongside the client, vlt has made its hosted package registries and ecosystem mirrors generally available. These services are designed to be backwards compatible with the npm registry API, allowing existing tools and workflows to integrate with vlt. The vlt client functions as a drop-in replacement for npm, managing the entire package lifecycle without requiring npm as a fallback or dependency.