06 / Your workflow
Make it yours.
The defaults get you started. Adjust your registry, security queries, and editor signals when your workspace needs something different.
Start with your editor
In VS Code, use Settings or .vscode/settings.json. In Zed, place language-server settings underlsp.dep-beacon.settings. These examples show the defaults; add only the overrides you need.
{
"depBeacon.enable": true,
"depBeacon.includePrerelease": false,
"depBeacon.checkVulnerabilities": true,
"depBeacon.registryUrl": "https://registry.npmjs.org",
"depBeacon.cacheTtlMinutes": 15,
"depBeacon.showInlineStatus": true,
"depBeacon.runInstallOnSave": false,
"depBeacon.packageManager": "auto"
}{
"lsp": {
"dep-beacon": {
"settings": {
"checkVulnerabilities": true,
"includePrerelease": false,
"registryUrl": "https://registry.npmjs.org",
"showUpdateDiagnostics": true
}
}
}
}VS Code settings at a glance
Each setting below uses the depBeacon. prefix.
| Setting | Default | What it controls |
|---|---|---|
enable | true | Enable CodeLens, diagnostics, and inline dependency status. |
includePrerelease | false | Include prerelease versions when calculating update targets. |
checkVulnerabilities | true | Query OSV.dev for vulnerability summaries. |
showInlineStatus | true | Display colored labels beside version ranges. |
cacheTtlMinutes | 15 | Reuse document analysis for 1–1440 minutes. |
runInstallOnSave | false | Run a package install after saving a supported manifest. |
packageManager | auto | Detect the manager automatically, or select npm, pnpm, or yarn. |
Registry and cache
registryUrl- Defaults to
https://registry.npmjs.org. It can point to another npm-compatible registry. Package links still open npmjs.com. - Fresh metadata
- In VS Code, run
Dep Beacon: Clear Registry Cachewhen you publish a package and want to refresh cached results immediately. - Zed diagnostics
- Set
showUpdateDiagnosticstofalseto hide update warnings. Security findings, manifest errors, hovers, and update actions remain available.