fix: fixed possible missing fields and dev/optional deps

snyk · Apr 29, 2024 · dc40d04 · dc40d04
1 parent c898448
commit dc40d04
Show file tree

Hide file tree

Showing 5 changed files with 40 additions and 7 deletions.
diff --git a/lib/dep-graph-builders/pnpm/build-dep-graph-pnpm.ts b/lib/dep-graph-builders/pnpm/build-dep-graph-pnpm.ts
@@ -17,8 +17,12 @@ export const buildDepGraphPnpm = async (
   options: PnpmProjectParseOptions,
   workspaceArgs?: PnpmWorkspaceArgs,
 ) => {
-  const { strictOutOfSync, includeOptionalDeps, pruneWithinTopLevelDeps } =
-    options;
+  const {
+    strictOutOfSync,
+    includeOptionalDeps,
+    includeDevDeps,
+    pruneWithinTopLevelDeps,
+  } = options;
 
   const depGraphBuilder = new DepGraphBuilder(
     { name: 'pnpm' },
@@ -51,6 +55,7 @@ export const buildDepGraphPnpm = async (
     extractedPnpmPkgs,
     strictOutOfSync,
     includeOptionalDeps,
+    includeDevDeps,
     // we have rootWorkspaceOverrides if this is workspace pkg with overrides
     // at root - therefore it should take precedent
     // TODO: inspect if this is needed at all, seems like pnpm resolves everything in lockfile
@@ -74,6 +79,7 @@ const dfsVisit = async (
   extractedPnpmPkgs: NormalisedPnpmPkgs,
   strictOutOfSync: boolean,
   includeOptionalDeps: boolean,
+  includeDevDeps: boolean,
   overrides: Overrides,
   pruneWithinTopLevel: boolean,
   lockFileParser: PnpmLockfileParser,
@@ -92,6 +98,7 @@ const dfsVisit = async (
       extractedPnpmPkgs,
       strictOutOfSync,
       includeOptionalDeps,
+      includeDevDeps,
       lockFileParser,
     );
 
@@ -138,6 +145,7 @@ const dfsVisit = async (
       extractedPnpmPkgs,
       strictOutOfSync,
       includeOptionalDeps,
+      includeDevDeps,
       overrides,
       pruneWithinTopLevel,
       lockFileParser,

diff --git a/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts b/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts
@@ -67,7 +67,8 @@ export abstract class PnpmLockfileParser {
           version,
           isDev: versionData.dev == 'true',
           dependencies: versionData.dependencies,
-          optionalDependencies: versionData.dependencies,
+          devDependencies: versionData.devDependencies,
+          optionalDependencies: versionData.optionalDependencies,
         };
         packages[`${pkg.name}@${pkg.version}`] = pkg;
       },
@@ -140,19 +141,33 @@ export abstract class PnpmLockfileParser {
 
       const subDeps = this.rawPnpmLock.importers[resolvedPathDep] || {
         dependencies: {},
+        devDependencies: {},
+        optionalDependencies: {},
       };
-      // todo: consider getting devDependencies, optionaldependencies
+
       const resolvedDeps = this.normalizePackagesDeps(
-        subDeps.dependencies,
+        subDeps.dependencies || {},
         isDev,
       );
 
+      const resolvedDevDeps = this.normalizePackagesDeps(
+        subDeps.devDependencies || {},
+        true,
+      );
+
+      const resolvedOptionalDeps = this.normalizePackagesDeps(
+        subDeps.optionalDependencies || {},
+        true,
+      );
+
       this.extractedPackages[`${name}@${version}`] = {
         name,
         version,
         id: `${name}@${version}`,
         isDev,
         dependencies: resolvedDeps,
+        devDependencies: resolvedDevDeps,
+        optionalDependencies: resolvedOptionalDeps,
       };
     }
     return version;

diff --git a/lib/dep-graph-builders/pnpm/types.ts b/lib/dep-graph-builders/pnpm/types.ts
@@ -27,6 +27,7 @@ export type NormalisedPnpmPkg = {
   id: string;
   isDev: boolean;
   dependencies: Record<string, string>;
+  devDependencies: Record<string, string>;
   optionalDependencies?: Record<string, string>;
 };
 

diff --git a/lib/dep-graph-builders/pnpm/utils.ts b/lib/dep-graph-builders/pnpm/utils.ts
@@ -15,6 +15,7 @@ export const getPnpmChildNode = (
   pkgs: NormalisedPnpmPkgs,
   strictOutOfSync: boolean,
   includeOptionalDeps: boolean,
+  includeDevDeps: boolean,
   lockfileParser: PnpmLockfileParser,
 ): PnpmNode => {
   const resolvedVersion =
@@ -57,14 +58,21 @@ export const getPnpmChildNode = (
       depData.dependencies || {},
       depInfo.isDev,
     );
+    const devDependencies = includeDevDeps
+      ? getGraphDependencies(depData.devDependencies || {}, true)
+      : {};
     const optionalDependencies = includeOptionalDeps
       ? getGraphDependencies(depData.optionalDependencies || {}, depInfo.isDev)
       : {};
     return {
       id: `${name}@${depData.version}`,
       name: name,
       version: resolvedVersion,
-      dependencies: { ...dependencies, ...optionalDependencies },
+      dependencies: {
+        ...dependencies,
+        ...optionalDependencies,
+        ...devDependencies,
+      },
       isDev: depInfo.isDev,
     };
   }

diff --git a/test/jest/dep-graph-builders/pnpm-lock.test.ts b/test/jest/dep-graph-builders/pnpm-lock.test.ts
@@ -49,7 +49,7 @@ describe.each(['pnpm-lock-v5', 'pnpm-lock-v6'])(
               pkgLockContent,
               {
                 includeDevDeps: false,
-                includeOptionalDeps: true,
+                includeOptionalDeps: false,
                 strictOutOfSync: false,
                 pruneWithinTopLevelDeps: false,
               },
@@ -64,6 +64,7 @@ describe.each(['pnpm-lock-v5', 'pnpm-lock-v6'])(
                 'utf8',
               ),
             );
+
             expect(
               Buffer.from(JSON.stringify(newDepGraph)).toString('base64'),
             ).toBe(