feat: transitive dependency visibility in Dependency Health view (v2.2.0)

[DevonL]

• Lockfile-based transitive resolution for 15+ ecosystems
• Vulnerability, license, and policy overlays on resolved dependencies
• Upstream proxy gap analysis with pull-through caching
• Tree visualization with diamond dependency collapsing and filtered views
• Compliance report WebView
• Single-dependency and bulk pull-through with format-specific registry endpoints
• Inverted index coverage strategy, parallel pagination, batched tree updates
• Security hardening: redirect validation, workspace confinement, input sanitization

📄 Summary

Expands the functionality of the Dependency Health View

🔍 Related Issues

Link to any related GitHub issues (e.g., Fixes #12, Closes #34):

🧪 Type of Change

Please check the relevant type tag for this PR title:

• [FIX] Bug fix
• [NEW] New thing
• [REFACTOR] Internal changes such as code restructuring or optimization that does not alter functionality
• [DOC] Documentation-only changes
• [CHORE] Maintenance, cleanup, or CI configuration

🧪 How Has This Been Tested?

Automated and manual testing

📸 Screenshots (if applicable)

If UI or logs are affected, include before/after screenshots or output.

✅ Checklist

• I’ve read and followed the CONTRIBUTING.md.
• I’ve added or updated documentation as needed.
• I’ve verified the change is tested and works as intended.
• CI/CD checks pass and do not break existing functionality.
• My code follows the style guidelines of this project.

[Copilot]

Pull request overview

This PR (v2.2.0) adds transitive dependency visibility to the Dependency Health view, introducing comprehensive lockfile resolution for 15+ ecosystems, vulnerability/license/policy enrichment, upstream proxy gap analysis, tree visualization, and a compliance reporting WebView. The changes represent a significant expansion of the VS Code extension's capability to analyze and visualize dependency relationships.

Changes:

• Added 15+ lockfile parsers (npm, Python, Maven, Gradle, Go, Rust, Ruby, Docker, NuGet, Dart, PHP, Helm, Swift, Hex, Elixir) with consistent format and transitive resolution
• Created upstream proxy gap analysis with controlled concurrency (5 concurrent requests) to identify uncovered dependencies
• Added vulnerability, license, and policy enrichers with caching and batching strategies
• Implemented compliance report WebView with HTML escaping and proper styling
• Updated ManifestParser to delegate pyproject.toml parsing to shared helpers for consistency
• Added package name normalization with input sanitization (null byte removal, length limits)
• Implemented workspace confinement security using path validation and symlink detection

Reviewed changes

Copilot reviewed 73 out of 86 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
util/upstreamGapAnalyzer.js	New 213-line module for analyzing uncovered dependency reach to upstream proxies with controlled concurrency
util/upstreamChecker.js	Refactored to extract helper functions to module level (isCacheObjectRecord, getUpstreamRequestOptions, isAbortError, isWarningWorthyUpstreamFormatError) with new export for getActiveUpstreamsFromRepositoryState
util/packageNameNormalizer.js	New 143-line utility for normalizing package names across 15+ ecosystems with input sanitization and ecosystem-to-format mapping
util/manifestParser.js	Updated to use shared lockfile utilities (getWorkspacePath, pathExists, readUtf8) and delegate pyproject.toml parsing to manifestHelpers
util/lockfileResolver.js	New 140+ line orchestrator registering all 15 lockfile parsers with workspace path validation
views/complianceReportProvider.js	New 678-line WebView provider with comprehensive HTML escaping and compliance report generation
util/lockfileParsers/*.js	15 new parser modules for different package ecosystems, all following consistent interface pattern
util/dependencyVulnEnricher.js	New vulnerability enricher with caching (10-min TTL, 5000-entry limit) and concurrency control
test/*.test.js	15+ comprehensive test files with multi-format fixtures and edge case coverage

Files not reviewed (2)

• test/fixtures/npm/package-lock.json: Language not supported
• test/fixtures/npm/pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DevonL]

Superseded by following PRs:
#41
#42
#43
#44
#45
#46