chore(licenses): read dependencies directly from lockfiles - #9540
Conversation
Spawning Yarn and npm makes the license check pay their startup and dependency-tree construction costs on every lint run. Reading Yarn, npm, and Bun lockfiles directly reduced the representative end-to-end check from 285.8 ms to 32.1 ms.
Overall package sizeSelf size: 7.46 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.2 | 124.41 kB | 440.65 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: 0e4eee8 | Docs | Datadog PR Page | Give us feedback! |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #9540 +/- ##
========================================
Coverage 98.43% 98.43%
========================================
Files 947 947
Lines 128152 128152
Branches 10912 11142 +230
========================================
Hits 126142 126142
Misses 2010 2010 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
BenchmarksBenchmark execution time: 2026-07-27 14:41:47 Comparing candidate commit 0e4eee8 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 2325 metrics, 33 unstable metrics.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e4eee8c6f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| deps.add(name) | ||
|
|
||
| collectDependencies(deps, dependency) | ||
| dependencies.add(dependency.name ?? getNameFromPackagePath(packagePath)) |
There was a problem hiding this comment.
When vendor/package.json contains a file: or workspace dependency, npm generates a valid v3 lockfile with a linked node_modules/dep entry and a separate target entry such as dep that may have no name. The link entry is skipped above, but this target reaches getNameFromPackagePath('dep') and crashes the license check instead of processing the dependency tree. This shape is expected because npm includes link targets separately in the lockfile, as documented in the npm package-lock packages specification, so target entries need to be recognized rather than rejected.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
We can keep this risk for now. It is not something we need to support until we want to include such dependency
Spawning Yarn and npm makes the license check pay their startup and dependency-tree construction costs on every lint run. Reading Yarn, npm, and Bun lockfiles directly reduced the representative end-to-end check from 285.8 ms to 32.1 ms.
Spawning Yarn and npm makes the license check pay their startup and dependency-tree construction costs on every lint run. Reading Yarn, npm, and Bun lockfiles directly reduced the representative end-to-end check from 285.8 ms to 32.1 ms.
2 participants
Summary
Spawning Yarn and npm made every license check build dependency trees in separate processes. This reads Yarn, npm, and Bun lockfiles directly and follows their production dependency graphs. On the repository lockfiles, mean end-to-end time dropped from 285.8 ms to 32.1 ms.