Detect JS/TS tech tags from workspace package manifests

[zacharyr0th]

What changed

DeepSec now detects JavaScript/TypeScript tech tags from package manifests in declared workspaces, in addition to the root package.json.

This covers package.json workspaces, object-form workspaces.packages, and pnpm-workspace.yaml package globs, including excluded globs. It also makes the documented Next.js config sentinel emit the nextjs tag.

Why

Framework-gated matchers can stay inactive in monorepos when framework dependencies live in workspace packages instead of the root package.json.

The implementation follows package-manager-declared workspace manifests instead of recursively scanning arbitrary nested package.json files.

Verification

• pnpm test passes
• pnpm lint passes
• pnpm knip passes
• pnpm test:bundle passes
• pnpm typecheck:deepsec passes

Notes for reviewer

Root package-manager catalogs are intentionally not treated as framework usage. A workspace package must list the dependency for the framework tag to be emitted.

[vercel]

@zacharyr0th is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.