fixup

Author: santigimeno

dep_checker/npm_audit.py

@@ -299,10 +299,9 @@ def walk(name: str, node: Dict, path_parts: Optional[list[str]] = None) -> None:
             if not version:
                 return
             key = (name, str(version))
-            if key in seen:
-                return
             package_path_parts = [*path_parts, "node_modules", name]
-            seen[key] = {"name": name, "version": str(version), "path": "/".join(package_path_parts)}
+            if key not in seen:
+                seen[key] = {"name": name, "version": str(version), "path": "/".join(package_path_parts)}
             for child_name, child in (node.get("dependencies") or {}).items():
                 if isinstance(child, dict):
                     walk(child_name, child, package_path_parts)

dep_checker/test_npm_audit.py

@@ -698,6 +698,46 @@ def test_normalize_version_range() -> None:
     assert checker.normalize_version_range(">= 1.0.0, < 2.0.0") == ">= 1.0.0, < 2.0.0"
 
 
+def test_get_installed_bundle_packages_traverses_duplicate_parent_subtrees() -> None:
+    with tempfile.TemporaryDirectory() as temp_dir:
+        package_dir = Path(temp_dir) / "deps" / "npm"
+        write_package_json(
+            package_dir / "package.json",
+            {
+                "name": "npm",
+                "version": "11.18.0",
+                "bundleDependencies": ["make-fetch-happen", "wrapper"],
+            },
+        )
+
+        checker = NPMAuditChecker(Path(temp_dir), timeout=60)
+        packages = checker.get_installed_bundle_packages(
+            package_dir,
+            {
+                "dependencies": {
+                    "wrapper": {
+                        "version": "1.0.0",
+                        "dependencies": {
+                            "make-fetch-happen": {
+                                "version": "15.0.6"
+                            }
+                        },
+                    },
+                    "make-fetch-happen": {
+                        "version": "15.0.6",
+                        "dependencies": {
+                            "ip-address": {"version": "10.2.0"}
+                        },
+                    },
+                }
+            },
+        )
+        package_map = {pkg["name"]: pkg for pkg in packages}
+
+        assert package_map["make-fetch-happen"]["path"] == "node_modules/wrapper/node_modules/make-fetch-happen"
+        assert package_map["ip-address"]["path"] == "node_modules/make-fetch-happen/node_modules/ip-address"
+
+
 def test_get_installed_bundle_packages_accepts_boolean_bundle_dependencies() -> None:
     with tempfile.TemporaryDirectory() as temp_dir:
         package_dir = Path(temp_dir) / "deps" / "npm"
@@ -808,6 +848,7 @@ def test_npm_audit_basic() -> None:
     test_parse_audit_results_normalizes_ids()
     test_preferred_advisory_id()
     test_normalize_version_range()
+    test_get_installed_bundle_packages_traverses_duplicate_parent_subtrees()
     test_get_installed_bundle_packages_accepts_boolean_bundle_dependencies()
     test_npm_cli_uses_installed_tree()