Overview
vg drift reports dependency currency — what is outdated across your project. It is offline by default: it reads your manifests and installed versions and tells you how far behind each dependency is, with no network call.
For known-vulnerability detection and full end-of-life governance, use vg scan --vulns; vg drift is the fast, offline currency view.
Usage
vg drift
Add --online to query the registry for the latest published versions (opt-in network):
vg drift --online
Gating CI
--fail-on exits 2 when a threshold is crossed, so a pull request can't merge past it:
vg drift --fail-on major # fail on any major-version drift
vg drift --fail-on standards # fail on your committed standards policy
major and minor gate on version distance; standards gates on the enterprise policy at .vibgrate/standards.json (for example, a banned dependency in use).
Options
| Flag | Description |
|---|---|
--online | Query the registry for latest versions (opt-in network) |
--fail-on <level> | Exit 2 on violations: major, minor, or standards |
--json | Machine-readable JSON on stdout |
--local | Never touch the network |
Related
- DriftScore — the 0–100 metric drift rolls up into
- vg scan --vulns — known-vulnerability detection
- vg scan — the full drift scan