Vlt 1.0 and Hosted Package Registries
4 hours ago
- vlt 1.0 is now generally available, along with hosted package registries and ecosystem mirrors.
- vlt has evolved into a full platform for developers, teams, and agents to ship faster, safer, and more reliably.
- vlt CLI includes over 60 graph pseudo-selectors, with around 30 security-focused ones like :malware, :cve, :unmaintained, and :vuln.
- New features include :host(local) for cross-project queries, --scope flag for commands, Graph Modifiers for dependency overrides, phased installations, catalogs, and OIDC trusted publishing.
- vlt serves as a drop-in replacement for npm, supporting workflows like init, install, build, publish, and deprecate.
- The hosted registries are backward-compatible with the npm registry API, supporting npm, pnpm, yarn, bun, and deno.
- A generous free tier is available for getting started with private registries.
- Packages are served from edge infrastructure, offering up to 38% faster clean installs compared to npm.
- Security features include blocking known-malicious packages at indexing time, with over 275k flagged package versions.
- Users can book a demo or contact support for more information on hosted services.