Description

Replace regex-based pattern matching with JSON parsing for package.json validation, targeting only actual dependency sections. The previous regex approach incorrectly flagged metadata fields like name, version, description, and repository URLs as unpinned dependencies.

• Add Get-NpmDependencyViolations function that parses package.json as structured JSON and checks only dependencies, devDependencies, peerDependencies, and optionalDependencies sections
• Update npm pattern config to use ValidationFunc dispatcher instead of VersionPatterns regex approach
• Add ValidationFunc dispatch logic to Get-DependencyViolation for type-specific validation functions
• Update Test-ShellDownloadSecurity to use consistent FileInfo hashtable parameter
• Create test fixtures for metadata-only and with-dependencies npm scenarios
• Add Pester tests covering JSON parsing, dependency extraction, and version pattern matching

Related Issue(s)

Fixes #267

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

Testing

• PSScriptAnalyzer: All files passed with 0 issues
• Pester: 33 tests passed (including 4 new tests for Get-NpmDependencyViolations)
• Full dependency scan: 100% compliance, 0 violations

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

The ValidationFunc dispatcher pattern enables type-specific validation functions without relying on regex patterns. This approach provides better accuracy for structured file formats like JSON and can be extended to other dependency types in the future.

🔧 - Generated by Copilot