feat(npm) add lockfileVersion 1 support via fromDependenciesTree#20
Merged
feat(npm) add lockfileVersion 1 support via fromDependenciesTree#20
Conversation
indexzero
force-pushed
the
feat/link-resolve-v1
branch
from
2efd18a to
10a7f13
Compare
fromPackageLock only iterates the v2/v3 packages map. v1 lockfiles store deps in a nested dependencies tree and produced zero results. fromDependenciesTree walks the v1 tree iteratively (depth-first) and yields the same Dependency shape. fromPackageLock falls back to it when packages is empty and dependencies exists. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the assertion that v1 returns empty with tests proving v1 now yields deps. Add 12 tests for fromDependenciesTree covering flat deps, nested conflict resolution, scoped packages, string vs object input, and fallback delegation from fromPackageLock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
indexzero
force-pushed
the
feat/link-resolve-v1
branch
from
10a7f13 to
e22cdf0
Compare
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Dependency type has included resolved and link since they were added to types.js, but the README output example omitted link. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
fromPackageLocknow parses npm lockfileVersion 1 files by falling back to a newfromDependenciesTreegenerator when thepackagesmap is empty anddependenciesexists. The new function walks the nested v1 tree iteratively and yields the sameDependencyshape (name,version,integrity?,resolved?).Why
v1 lockfiles use a nested
dependenciestree instead of the v2/v3packagesmap.fromPackageLockiteratedpackages || {}, so v1 files silently produced zero results. The v2/v3 path is unchanged — v2 lockfiles that have bothpackagesanddependenciesalways usepackages.Risk Assessment
Low risk: v2/v3 codepath is unchanged. The fallback only activates when
packageshas zero non-root entries ANDdependenciesexists. 465 tests pass including 12 newfromDependenciesTreetests and the updated v1 fixture test.