Skip to content

Conversation

@ryanlink
Copy link
Contributor

Overview

Provide an overview of this change. Describe the intent of this change, and how it implements that intent.

Example: This PR accomplishes X by doing Y.

Acceptance criteria

If this PR is successful, what impact does it have on the user experience?

Example: When users do X, Y should now happen.

Testing plan

How did you validate that this PR works? What literal steps did you take when manually checking that your code works?

Example:

  1. Set up test case X.
  2. Run command Y. Make sure Z happens.

This section should list concrete steps that a reviewer can sanity check and repeat on their own machine (and provide any needed test cases).

Risks

Highlight any areas that you're unsure of, want feedback on, or want reviewers to pay particular attention to.

Example: I'm not sure I did X correctly, can reviewers please double-check that for me?

Metrics

Is this change something that can or should be tracked? If so, can we do it today? And how? If its easy, do it

References

Add links to any referenced GitHub issues, Zendesk tickets, Jira tickets, Slack threads, etc.

Example:

Checklist

  • I added tests for this PR's change (or explained in the PR description why tests don't make sense).
  • If this PR introduced a user-visible change, I added documentation into docs/.
  • If this PR added docs, I added links as appropriate to the user manual's ToC in docs/README.ms and gave consideration to how discoverable or not my documentation is.
  • If this change is externally visible, I updated Changelog.md. If this PR did not mark a release, I added my changes into an ## Unreleased section at the top.
  • If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated docs/references/files/*.schema.json AND I have updated example files used by fossa init command. You may also need to update these if you have added/removed new dependency type (e.g. pip) or analysis target type (e.g. poetry).
  • If I made changes to a subcommand's options, I updated docs/references/subcommands/<subcommand>.md.

ryanlink added 14 commits April 10, 2025 23:16
… for both real-world pnpm repo and test dependencies lockfiles
… unused imports, fix name shadowing warnings, update v6 lockfile test to expect correct dependencies, fixed formatting
…solution

Key changes:

- Added support for Pnpm lockfile v9 format, replacing PnpmLockGt6 with PnpmLockGt9

- Added Catalog and CatalogEntry types to handle new catalog-based version resolution

- Enhanced package key parsing with parseV9PackageKey to handle multiple formats:

  - ': ' format for direct dependencies

  - '@' format for package entries

  - '/' format for legacy entries

- Improved version handling with cleanupVersion to properly handle:

  - Peer dependencies in parentheses

  - Multiple @ symbols in version strings

  - Link prefixes and colon suffixes

- Added buildV9Graph function for v9+ lockfiles with:

  - Catalog-based version resolution

  - Proper handling of direct and deep dependencies

  - Support for peer dependencies

- Enhanced dependency resolution with new helper functions:

  - resolveDepFromImporter

  - resolveDepFromPackage

  - resolveDependency

  - resolveVersionFromCatalog

- Maintained backward compatibility for v5 and v6 lockfiles
@csasarak
Copy link
Contributor

If this PR is no longer in progress please close it and delete the branches.

@ryanlink ryanlink closed this Jun 27, 2025
@ryanlink ryanlink deleted the fix-pnpm-v9-parsing branch June 30, 2025 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants