feat: properly filter workspace devDependencies in production mode#456
feat: properly filter workspace devDependencies in production mode#456oNaiPs wants to merge 3 commits intoCycloneDX:mainfrom
Conversation
When using --prod flag in monorepo workspaces, devDependencies declared in workspace packages were not being filtered out correctly. This resulted in devDependencies appearing in production SBOMs. This fix adds proper tracking of workspace package devDependencies and filters them during dependency traversal when omitDevDependencies is enabled. Signed-off-by: Jose Luis Pereira <onaips@gmail.com>
oNaiPs
force-pushed
the
fix/workspace-devdeps-filtering
branch
from
991e16b to
c33b224
Compare
oNaiPs
changed the title
There was a problem hiding this comment.
Pull request overview
This PR fixes an issue where devDependencies declared in workspace packages were not being filtered out when using the --prod flag in monorepo setups, causing them to incorrectly appear in production SBOMs.
Changes:
- Added
gatherWorkspaceDevDependencies()method to collect devDependencies from all workspace packages - Modified
getDeps()to filter out workspace package devDependencies when in production mode - Added comprehensive test coverage with new
workspace-devdepstestbed and snapshots
Reviewed changes
Copilot reviewed 9 out of 12 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/builders.ts | Implements core logic for gathering and filtering workspace devDependencies in production mode |
| tests/integration/index.test.js | Adds new workspace-devdeps test setup to test suite |
| tests/_data/testbeds/workspace-devdeps/* | Creates comprehensive test fixture with monorepo structure and dependencies |
| tests/_data/snapshots/prod-arg_workspace-devdeps.* | Adds expected test output snapshots showing only production dependencies |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (pkg.reference.startsWith('workspace:')) { | ||
| const devDeps = new Set<string>() | ||
| for (const depIdent of workspace.manifest.devDependencies.keys()) { | ||
| devDeps.add(depIdent) |
There was a problem hiding this comment.
The depIdent being added to the Set is an IdentHash (from workspace.manifest.devDependencies.keys()), but later in line 384 it's compared with depDesc.identHash. While this works, the variable should be named consistently (e.g., devDeps.add(depIdentHash)) or the type should be clarified to avoid confusion. The Set should store identHash values, not depIdent keys directly.
|
@oNaiPs I see you've used AI/vibe coding. how was the process? was anything missing - did the AI suggest adding any helper files along the way, that could be beneficial for further AI assistance? |
Description
Fixes an issue where devDependencies declared in workspace packages were not being filtered out when using the
--prodflag in monorepo setups. This resulted in devDependencies incorrectly appearing in production SBOMs.The fix adds proper tracking of workspace package devDependencies and filters them during dependency traversal when
omitDevDependenciesis enabled.Changes:
gatherWorkspaceDevDependencies()method to collect devDeps from all workspace packagesgetDeps()to filter out devDependencies of workspace packages when in production modeworkspace-devdepstestbedResolves or fixes issue: #256
AI Tool Disclosure
Affirmation