dredge

LOW

maintainer ShawnMcCool 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npm install is used to locally install pnpm@12 as a build tool for the project's own frontend, not to install arbitrary external packages; this is a normal part of building the project from source and does not represent a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is used to locally install pnpm@12 as a build tool for the project's own frontend, not to install arbitrary external packages; this is a normal part of building the project from source and does not represent a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 npm install -g --prefix "$pnpm_home" pnpm@12 >/dev/null

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shawn McCool <shawn@mccool.email>
    
      2pkgname=dredge
    
      3pkgver=0.17.0
    
      4pkgrel=1
    
      5pkgdesc="Ear-first practice looper: loop sections, slow them down pitch-preserving, drill passages"
    
      6arch=('x86_64')
    
      7url="https://github.com/ShawnMcCool/dredge"
    
      8# MIT for dredge itself; the binaries bundle Rubber Band (GPL-2.0-or-later),
    
      9# so the distributed work is GPL-governed.
    
      10license=('MIT AND GPL-2.0-or-later')
    
      11depends=('pipewire' 'webkit2gtk-4.1' 'gtk3')
    
      12makedepends=('rust' 'nodejs' 'npm' 'just' 'clang' 'pkgconf' 'git')
    
      13optdepends=('ffmpeg: MP3 export, extra container formats, and demucs stem export'
    
      14            'uv: bootstrap the analyze/songformer ML venvs (beats, sections)'
    
      15            'python: ML analysis runtime'
    
      16            'demucs: 4-stem separation (vocals/drums/bass/other)')
    
      17provides=('dredge')
    
      18conflicts=('dredge-looper-bin')
    
      19# rusqlite bundles + cc-compiles sqlite3.c; makepkg's default LTO makes that a
    
      20# GCC LTO object that Rust's lld can't link (undefined sqlite3_* symbols).
    
      21options=('!lto')
    
      22source=("git+https://github.com/ShawnMcCool/dredge.git#tag=v${pkgver}")
    
      23sha256sums=('SKIP')
    
      24
    
      25build() {
    
      26  cd "${srcdir}/${pkgname}"
    
      27  # Headless daemon.
    
      28  cargo build -p server --release
    
      29  # Desktop app — install frontend deps, then build without OS bundling
    
      30  # (we install the raw binaries ourselves below).
    
      31  cd apps/desktop
    
      32  # Pin pnpm to the major the project builds against (CI uses pnpm 12) instead
    
      33  # of the host's pnpm. pnpm >=10 needs Node >=22.13 (the node:sqlite
    
      34  # builtin); every Node Arch ships (nodejs, nodejs-lts-jod/krypton) meets it.
    
      35  local pnpm_home="${srcdir}/.pnpm"
    
      36  npm install -g --prefix "$pnpm_home" pnpm@12 >/dev/null
    
      37  export PATH="$pnpm_home/bin:$PATH"
    
      38  pnpm install --frozen-lockfile
    
      39  pnpm tauri build --no-bundle
    
      40}
    
      41
    
      42package() {
    
      43  cd "${srcdir}/${pkgname}"
    
      44  install -Dm755 target/release/dredge                       "${pkgdir}/usr/bin/dredge"
    
      45  install -Dm755 target/release/dredged                      "${pkgdir}/usr/bin/dredged"
    
      46  install -Dm755 scripts/analyze                              "${pkgdir}/usr/bin/dredge-analyze"
    
      47  install -Dm755 scripts/dredge-enable-ml                    "${pkgdir}/usr/bin/dredge-enable-ml"
    
      48  install -Dm755 scripts/dredge-doctor                       "${pkgdir}/usr/bin/dredge-doctor"
    
      49  install -Dm644 scripts/analyze_impl.py                      "${pkgdir}/usr/lib/dredge/analyze_impl.py"
    
      50  install -Dm644 scripts/songformer_impl.py                   "${pkgdir}/usr/lib/dredge/songformer_impl.py"
    
      51  install -Dm644 dredge.desktop                              "${pkgdir}/usr/share/applications/dredge.desktop"
    
      52  install -Dm644 apps/desktop/src-tauri/icons/128x128@2x.png  "${pkgdir}/usr/share/icons/hicolor/256x256/apps/dredge.png"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: Shawn McCool <shawn@mccool.email>
 pkgname=dredge
-pkgver=0.16.1
+pkgver=0.17.0
 pkgrel=1
 pkgdesc="Ear-first practice looper: loop sections, slow them down pitch-preserving, drill passages"
 arch=('x86_64')
@@ -29,13 +29,11 @@
   # Desktop app — install frontend deps, then build without OS bundling
   # (we install the raw binaries ourselves below).
   cd apps/desktop
-  # Pin pnpm to the version the project builds against (lockfile is v9, CI uses
-  # pnpm 9) instead of the host's pnpm. Arch's rolling pnpm (>=10) requires
-  # Node >=22.13 (it uses the node:sqlite builtin), so on a box with an older
-  # system Node it crashes before installing anything. pnpm 9 runs across
-  # Node 18-26+, so this builds regardless of the host's Node version.
+  # Pin pnpm to the major the project builds against (CI uses pnpm 12) instead
+  # of the host's pnpm. pnpm >=10 needs Node >=22.13 (the node:sqlite
+  # builtin); every Node Arch ships (nodejs, nodejs-lts-jod/krypton) meets it.
   local pnpm_home="${srcdir}/.pnpm"
-  npm install -g --prefix "$pnpm_home" pnpm@9 >/dev/null
+  npm install -g --prefix "$pnpm_home" pnpm@12 >/dev/null
   export PATH="$pnpm_home/bin:$PATH"
   pnpm install --frozen-lockfile
   pnpm tauri build --no-bundle

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 13:42:47	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2