fix: fix cross refs on multiple levels

snyk · May 15, 2024 · eb24b57 · eb24b57
1 parent e81f206
commit eb24b57
Show file tree

Hide file tree

Showing 49 changed files with 8,417 additions and 494 deletions.
diff --git a/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts b/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts
@@ -86,17 +86,37 @@ export abstract class PnpmLockfileParser {
     includeOptionalDeps?: boolean;
     includePeerDeps?: boolean;
   }): PnpmDeps {
-    const prodDeps = this.normalizeTopLevelDeps(this.dependencies || {}, false);
+    let importerName;
+    if (this.isWorkspaceLockfile()) {
+      importerName = this.workspaceArgs?.workspacePath;
+    }
+    const prodDeps = this.normalizeTopLevelDeps(
+      this.dependencies || {},
+      false,
+      importerName,
+    );
     const devDeps = options.includeDevDeps
-      ? this.normalizeTopLevelDeps(this.devDependencies || {}, true)
+      ? this.normalizeTopLevelDeps(
+          this.devDependencies || {},
+          true,
+          importerName,
+        )
       : {};
 
     const optionalDeps = options.includeOptionalDeps
-      ? this.normalizeTopLevelDeps(this.optionalDependencies || {}, false)
+      ? this.normalizeTopLevelDeps(
+          this.optionalDependencies || {},
+          false,
+          importerName,
+        )
       : {};
 
     const peerDeps = options.includePeerDeps
-      ? this.normalizeTopLevelDeps(this.peerDependencies || {}, false)
+      ? this.normalizeTopLevelDeps(
+          this.peerDependencies || {},
+          false,
+          importerName,
+        )
       : {};
 
     return { ...prodDeps, ...devDeps, ...optionalDeps, ...peerDeps };
@@ -106,9 +126,15 @@ export abstract class PnpmLockfileParser {
     name: string,
     version: string,
     isDev: boolean,
+    importerName?: string,
   ): string {
     if (this.isWorkspaceLockfile()) {
-      version = this.resolveWorkspacesCrossReference(name, version, isDev);
+      version = this.resolveWorkspacesCrossReference(
+        name,
+        version,
+        isDev,
+        importerName,
+      );
     }
     if (!valid(version)) {
       version = this.excludeTransPeerDepsVersions(version);
@@ -131,6 +157,7 @@ export abstract class PnpmLockfileParser {
     name: string,
     version: string,
     isDev: boolean,
+    importerName?: string,
   ): string {
     if (!this.workspaceArgs) {
       return version;
@@ -142,10 +169,13 @@ export abstract class PnpmLockfileParser {
       //   version: link:../pkg-b
       const depPath = version.split('link:')[1];
       const resolvedPathDep = pathUtil
-        .join(this.workspaceArgs.workspacePath, depPath)
+        .join(importerName || '.', depPath)
         .replace(/\\/g, '/');
       // cross referenced package, we add it to the extracted packages
       version = this.workspaceArgs.projectsVersionMap[resolvedPathDep];
+      if (!version) {
+        version = 'undefined';
+      }
 
       const subDeps = this.rawPnpmLock.importers[resolvedPathDep] || {
         dependencies: {},
@@ -156,16 +186,19 @@ export abstract class PnpmLockfileParser {
       const resolvedDeps = this.normalizePackagesDeps(
         subDeps.dependencies || {},
         isDev,
+        resolvedPathDep,
       );
 
       const resolvedDevDeps = this.normalizePackagesDeps(
         subDeps.devDependencies || {},
         true,
+        resolvedPathDep,
       );
 
       const resolvedOptionalDeps = this.normalizePackagesDeps(
         subDeps.optionalDependencies || {},
         true,
+        resolvedPathDep,
       );
 
       this.extractedPackages[`${name}@${version}`] = {
@@ -197,9 +230,13 @@ export abstract class PnpmLockfileParser {
   //      specifier: 1.3.7
   //      version: 1.3.7
 
-  abstract normalizePackagesDeps(dependencies, isDev): Record<string, string>;
+  abstract normalizePackagesDeps(
+    dependencies,
+    isDev,
+    importerName?,
+  ): Record<string, string>;
 
-  abstract normalizeTopLevelDeps(dependencies, isDev): PnpmDeps;
+  abstract normalizeTopLevelDeps(dependencies, isDev, importerName?): PnpmDeps;
 
   // Dependency paths are parsed differently based on lockfile version
   // For lockfile v5, pnpm provides the 'dependency-path' package that parses a dep path

diff --git a/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-v5.ts b/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-v5.ts
@@ -27,10 +27,11 @@ export class LockfileV5Parser extends PnpmLockfileParser {
   public normalizeTopLevelDeps(
     dependencies: Record<string, string>,
     isDev: boolean,
+    importerName?: string,
   ): PnpmDeps {
     return Object.entries(dependencies).reduce(
       (pnpmDeps: PnpmDeps, [name, version]) => {
-        version = this.normalizeVersion(name, version, isDev);
+        version = this.normalizeVersion(name, version, isDev, importerName);
         pnpmDeps[name] = {
           name,
           version,
@@ -46,10 +47,11 @@ export class LockfileV5Parser extends PnpmLockfileParser {
   public normalizePackagesDeps(
     dependencies: Record<string, string>,
     isDev: boolean,
+    importerName?: string,
   ): Record<string, string> {
     return Object.entries(dependencies).reduce(
       (pnpmDeps: Record<string, string>, [name, version]) => {
-        version = this.normalizeVersion(name, version, isDev);
+        version = this.normalizeVersion(name, version, isDev, importerName);
         pnpmDeps[name] = version;
         return pnpmDeps;
       },

diff --git a/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-v6.ts b/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-v6.ts
@@ -38,10 +38,16 @@ export class LockfileV6Parser extends PnpmLockfileParser {
   public normalizeTopLevelDeps(
     dependencies: Record<string, Record<string, string>>,
     isDev: boolean,
+    importerName?: string,
   ): PnpmDeps {
     return Object.entries(dependencies).reduce(
       (pnpmDeps: PnpmDeps, [name, depInfo]) => {
-        const version = this.normalizeVersion(name, depInfo.version, isDev);
+        const version = this.normalizeVersion(
+          name,
+          depInfo.version,
+          isDev,
+          importerName,
+        );
         pnpmDeps[name] = {
           name,
           version,
@@ -57,10 +63,16 @@ export class LockfileV6Parser extends PnpmLockfileParser {
   public normalizePackagesDeps(
     dependencies: Record<string, Record<string, string>>,
     isDev: boolean,
+    importerName?: string,
   ): Record<string, string> {
     return Object.entries(dependencies).reduce(
       (pnpmDeps: Record<string, string>, [name, depInfo]) => {
-        const version = this.normalizeVersion(name, depInfo.version, isDev);
+        const version = this.normalizeVersion(
+          name,
+          depInfo.version,
+          isDev,
+          importerName,
+        );
         pnpmDeps[name] = version;
         return pnpmDeps;
       },

diff --git a/...ders/fixtures/pnpm-lock-v5/workspace-undefined-versions/other-packages/pkg-c/package.json b/...ders/fixtures/pnpm-lock-v5/workspace-undefined-versions/other-packages/pkg-c/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "package-c",
+    "dependencies": {
+        "body-parser": "1.20.0"
+    }
+  }
+
diff --git a/test/jest/dep-graph-builders/fixtures/pnpm-lock-v5/workspace-undefined-versions/package.json b/test/jest/dep-graph-builders/fixtures/pnpm-lock-v5/workspace-undefined-versions/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "pnpm-1-workspace-with-cross-ref",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "private": true
+}