Refactor ecosystem checkers to use shared resolver and pins utilities - #3
Merged
Merged
Conversation
Prototype the migration described in #2 for npm and pypi, leaving Maven on its bespoke parser per the issue's exception: - Parse package.json, requirements.txt, and pyproject.toml through git-pkgs/manifests instead of hand-rolled parsers. pyproject.toml now also covers Poetry's [tool.poetry] tables, not just PEP 621. - Identify exact pins and compare pinned-vs-latest versions with git-pkgs/vers ecosystem rules instead of raw string equality. - Resolve latest versions through git-pkgs/enrichment (enrichment.NewEcosystemsClient() explicitly, avoiding GIT_PKGS_DIRECT/ git-config-dependent behavior), reading PackageInfo.LatestVersion instead of maintaining npm/PyPI HTTP clients. - Add pkg/util/resolver.Resolver as an injectable seam around enrichment so tests supply a fake instead of hitting the network, and pkg/util/pins for shared exact-pin/diff logic used by both ecosystems. Binary size grew from ~10.0MB to ~12.0MB (manifests/registries register every parser and registry), cold-start overhead is a few ms and well under typical hook timeouts. The enrichment resolver's own timeout (10s) stays under Claude Code's hook timeout regardless of the underlying client's default. Note: this sandbox's egress policy blocks packages.ecosyste.ms, so the live resolver path is exercised by construction/unit tests with a fake resolver, not a real network call.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR refactors the npm and pypi ecosystem checkers to use a shared, injected resolver interface and consolidates version pinning logic into a new
pkg/util/pinspackage. This eliminates duplicate code, improves testability by removing hard-coded HTTP calls, and leverages git-pkgs libraries for consistent manifest parsing and version comparison across ecosystems.Key Changes
New
pkg/util/pinspackage: ProvidesExactVersion()to identify exactly-pinned dependencies (handling npm's bare semver and pypi's "==" operator requirements) andDiff()to compare pinned versions against latest releases. Uses git-pkgs/vers for ecosystem-aware version comparison.New
pkg/util/resolverpackage: Defines aResolverinterface for looking up latest versions by PURL, with anEnrichmentResolverimplementation backed by git-pkgs/enrichment. Enables dependency injection for testing.Refactored npm checker:
pins.ExactVersion()Resolvertype; now accepts injectedresolver.Resolverpins.Diff()for version comparison logicRefactored pypi checkers (requirements.txt and pyproject.toml):
parsePypiPins()using git-pkgs/manifestspins.ExactVersion()(withrequireOperator=truefor pypi)Resolvertype; now accepts injectedresolver.Resolverpins.Diff()for version comparison logicUpdated main.go: Changed
checkersfrom a global slice tonewCheckers(res)function that injects the shared resolver into npm and pypi checkers.Test improvements: Replaced HTTP mocking with simple
fakeResolverimplementations; tests now verify resolver lookup counts instead of HTTP request counts.Notable Implementation Details
ExactVersion()handles ecosystem-specific syntax: npm accepts bare versions, pypi requires "==" operator; both strip environment markers/commentsDiff()only reports pins that were added or changed by the write, ignoring untouched pins even if outdatedhttps://claude.ai/code/session_01BwRfS8pJnmHGmWdLt1t6Y6