dependency-management: an empty .gitmodules is "submodules", Composer's default type is not library, R DESCRIPTION and Julia Project.toml say "no dependencies are declared", license-notice third_party/, a project's own submodule is "third-party"

Start in project_validator/checks/dependency_management.py, where SUBMODULES = ".gitmodules" tests only for the file's presence, and in project_validator/ecosystems/php/init.py around line 125, where the Composer 'library' default is missing. Each report has a repro: an empty .gitmodules, a composer.json with no type, or a Project.toml with [deps] should no longer produce the false warning or message. Done means those repros pass and the other ecosystems' outputs are unchanged.

kubespray: WARN "third-party code is committed (git submodules)" for a 0-byte .gitmodules (its pre-commit even forbids submodules). guzzle and laravel: told to commit composer.lock because type is missing, but Composer's documented default is library. dplyr/testthat/data.table and Documenter.jl: PASS "no dependencies are declared" although DESCRIPTION Imports: and [deps] declare twenty (ggplot2 and DataFrames get "not applicable" instead: inconsistent). golangci-lint's third_party/ holds only license notices. cetz's one submodule is the organisation's shared scripts. terraform-aws-modules: 29 "declaring" files are examples/ and shared modules deliberately commit no lockfile.

Evidence from the corpus audit

kubernetes-sigs/kubespray / dependency-management

• kind: FALSE_POSITIVE
• actual: WARN "third-party code is committed (git submodules (.gitmodules))" with the hint "fetch third-party code
  with the ecosystem's package manager instead of committing a copy of it"
• expected: no such claim: .gitmodules exists but is empty (0 bytes); the project has no submodules (its pre-commit
  config even runs forbid-new-submodules).
• evidence: wc -c .gitmodules → 0 .gitmodules; .pre-commit-config.yaml:13: - id: forbid-new-submodules.
  Validator: project_validator/checks/dependency_management.py:14: SUBMODULES = ".gitmodules" (presence, not
  content, is tested).
• repro: an empty .gitmodules in any project.
• confidence: high

golangci/golangci-lint / dependency-management

• kind: FALSE_POSITIVE
• actual: WARN: third-party code is committed (third_party/); dependencies are declared in docs/go.mod, go.mod, ... and locked in ...
• expected: PASS: third_party/ holds nothing but license notices for linters that were forked into pkg/; no third-party code is committed.
• evidence: ls third_party/* -> third_party/dogsled: LICENSE, third_party/gochecknoglobals: LICENSE, third_party/gochecknoinits: LICENSE, third_party/gometalinter: LICENSE, third_party/lll: LICENSE, third_party/nakedret: LICENSE, third_party/x_tools: LICENSE (one file each)
• repro: third_party/foo/LICENSE only, plus go.mod/go.sum. Expect no "third-party code" warning (a directory with no source files is not code).
• confidence: medium

JuliaDocs/Documenter.jl / dependency-management

• kind: MESSAGE
• actual: PASS: no dependencies are declared
• expected: wording that says Julia is not judged (DataFrames and JuMP get SKIP: not applicable to Julia); Documenter's Project.toml declares ~20 [deps], so "no dependencies are declared" is false. The PASS comes from the JavaScript place alone (no package.json).
• evidence: Project.toml:5-9: [deps] / ANSIColoredPrinters = "a4c015fc-..." / AbstractTrees = "1520ce14-..." / Base64 = ... / CodecZlib = ...; JuliaDocs__Documenter.jl.json places: JavaScript/TypeScript | . | PASS | no dependencies are declared
• repro: Project.toml with [deps] and one assets/x.js
• confidence: medium

guzzle/guzzle, laravel/framework / dependency-management

• kind: FALSE_POSITIVE
• actual: WARN: dependencies are declared in composer.json, vendor-bin/composer-normalize/composer.json,
  vendor-bin/php-cs-fixer/composer.json and 1 more (Composer) but not locked (guzzle); PHP: the root: dependencies are declared in composer.json, src/Illuminate/Auth/composer.json, ... and 33 more (Composer) but not locked (laravel)
• expected: PASS: Composer's documented default for a missing type is library; both are libraries (neither commits
  a lock file by design, laravel even ignores it). Secondary: guzzle's vendor-bin/*/composer.json are
  bamarni/composer-bin-plugin tool manifests (one dependency each), not the project's dependency declarations.
• evidence: guzzle composer.json:1-4: { / "name": "guzzlehttp/guzzle", / "description": "Guzzle is a PHP HTTP client library", / "license": "MIT", — no top-level "type" (the only "type" keys, lines 83 and 103, are inside
  repositories); laravel composer.json: no "type" key; laravel .gitignore:13: composer.lock; validator
  project_validator/ecosystems/php/__init__.py:125: library=lambda _path, text: _composer(text).get("type") == "library",.
• repro: composer.json with require and no type, no composer.lock → WARN "not locked" (reproduced in
  repro-php; adding "type": "library" → PASS).
• confidence: high

tidyverse/dplyr, r-lib/testthat, Rdatatable/data.table / dependency-management

• kind: MESSAGE
• actual: PASS: no dependencies are declared; "if the project has dependencies, consider a dependency manager: CPM, FetchContent, Meson wraps, vcpkg or Conan"
• expected: either SKIP for the R package (as ggplot2 and targets get: "not applicable to R") or a sentence about DESCRIPTION; "no dependencies are declared" is false (dplyr's DESCRIPTION declares Imports: cli (>= 3.6.2), generics, glue (>= 1.3.2), lifecycle (>= 1.0.5), magrittr (>= 1.5), ...) and the CPM/vcpkg hint is noise for an R package. The sentence comes from the C/C++ profile judging the src/ code (previous DETECTION finding) and is printed without a language prefix.
• evidence: dplyr DESCRIPTION:24-26: Imports: / cli (>= 3.6.2), / generics, ...; dplyr .allow.txt: [PASS] dependency-management: no dependencies are declared.
• repro: as the DETECTION repro above; expect dependency-management to SKIP or prefix "C/C++:".
• confidence: low (cosmetic; root cause is the DETECTION finding)

cetz-package/cetz / dependency-management

• kind: MESSAGE
• actual: WARN: dependency-management: third-party code is committed (git submodules (.gitmodules)); ... / fetch third-party code with the ecosystem's package manager instead of committing a copy of it
• expected: WARN wording should not call it third-party: the one submodule is the project's own organisation's shared scripts repository (and is not even checked out here), not vendored dependency code.
• evidence: .gitmodules:1-3: [submodule "common"] / path = common / url = https://github.com/cetz-package/common.git.
• repro: .gitmodules whose url is under the same owner as the repository; expect "a submodule of the project's own" or no warning.
• confidence: low

terraform-aws-modules/terraform-aws-vpc, -eks, -lambda / dependency-management

• kind: MESSAGE
• actual: WARN: dependencies are declared in examples/block-public-access/main.tf, examples/block-public-access/versions.tf, examples/complete/main.tf and 29 more (Terraform providers) but not locked / commit .terraform.lock.hcl
• expected: a note that the lockfile is for root configurations: these are shared modules that deliberately do not commit a lockfile (the repo ignores it and tells terraform-docs not to show one), and the 29+ "declaring" files are mostly examples/. The WARN itself is defensible policy; the message and the file list are misleading for a module repository.
• evidence: .gitignore:4-5: # Terraform lockfile / .terraform.lock.hcl; .pre-commit-config.yaml:7-9: - id: terraform_docs / args: / - '--args=--lockfile=false'.
• repro: module repo with versions.tf and .gitignore ignoring .terraform.lock.hcl; expect the message to distinguish root configurations from modules.
• confidence: low

xmlunit/xmlunit / dependency-management

• kind: FALSE_POSITIVE
• actual: WARN: third-party code is committed (git submodules (.gitmodules)); ... fetch third-party code with the ecosystem's package manager instead of committing a copy of it
• expected: no "third-party code" remark: the only submodule is the project's own test-data repository.
• evidence: .gitmodules:1-3: [submodule "test-resources"] / path = test-resources /
  url = https://github.com/xmlunit/test-resources.git (same GitHub organisation as the project).
• repro: .gitmodules whose url is under the same owner as the repository.
• confidence: medium

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt