Skip to content

Commit e33568d

Browse files
mnonnenmachermnonnenmacher
committed
fix(yarn2): Capture transitive dependencies of packages with peer deps
When a package has peer dependencies, Yarn2+ creates a virtual package for it that is used also in the output of `yarn info`. This virtual package only contains the peer dependencies, while only the non-virtual package contains the transitive dependencies. Fix the issue that transitive dependencies of such packages are ignored by mapping locators that point to virtual packages to locators that point to the non-virtual packages. Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.com>
1 parent 4e15f9d commit e33568d

3 files changed

Lines changed: 128 additions & 1 deletion

File tree

‎plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-expected-output.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ project:
7777
dependencies:
7878
- id: "NPM::asap:2.0.6"
7979
- id: "NPM:@csstools:css-color-parser:3.0.8"
80+
dependencies:
81+
- id: "NPM:@csstools:color-helpers:5.1.0"
82+
- id: "NPM:@csstools:css-calc:2.1.4"
8083
- name: "devDependencies"
8184
dependencies:
8285
- id: "NPM::cson:4.1.0"
@@ -1266,6 +1269,62 @@ packages:
12661269
url: "https://github.com/TooTallNate/util-deprecate.git"
12671270
revision: "475fb6857cd23fafff20c1be846c1350abf8e6d4"
12681271
path: ""
1272+
- id: "NPM:@csstools:color-helpers:5.1.0"
1273+
purl: "pkg:npm/%40csstools/color-helpers@5.1.0"
1274+
declared_licenses:
1275+
- "MIT-0"
1276+
declared_licenses_processed:
1277+
spdx_expression: "MIT-0"
1278+
description: "Color helpers to ease transformation between formats, gamut, etc"
1279+
homepage_url: "https://github.com/csstools/postcss-plugins/tree/main/packages/color-helpers#readme"
1280+
binary_artifact:
1281+
url: ""
1282+
hash:
1283+
value: ""
1284+
algorithm: ""
1285+
source_artifact:
1286+
url: "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz"
1287+
hash:
1288+
value: "106c54c808cabfd1ab4c602d8505ee584c2996ef"
1289+
algorithm: "SHA-1"
1290+
vcs:
1291+
type: "Git"
1292+
url: "git+https://github.com/csstools/postcss-plugins.git"
1293+
revision: "132530a36b9f711a886602ce4bf1e95de95f2a5b"
1294+
path: "packages/color-helpers"
1295+
vcs_processed:
1296+
type: "Git"
1297+
url: "https://github.com/csstools/postcss-plugins.git"
1298+
revision: "132530a36b9f711a886602ce4bf1e95de95f2a5b"
1299+
path: "packages/color-helpers"
1300+
- id: "NPM:@csstools:css-calc:2.1.4"
1301+
purl: "pkg:npm/%40csstools/css-calc@2.1.4"
1302+
declared_licenses:
1303+
- "MIT"
1304+
declared_licenses_processed:
1305+
spdx_expression: "MIT"
1306+
description: "Solve CSS math expressions"
1307+
homepage_url: "https://github.com/csstools/postcss-plugins/tree/main/packages/css-calc#readme"
1308+
binary_artifact:
1309+
url: ""
1310+
hash:
1311+
value: ""
1312+
algorithm: ""
1313+
source_artifact:
1314+
url: "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz"
1315+
hash:
1316+
value: "8473f63e2fcd6e459838dd412401d5948f224c65"
1317+
algorithm: "SHA-1"
1318+
vcs:
1319+
type: "Git"
1320+
url: "git+https://github.com/csstools/postcss-plugins.git"
1321+
revision: "7a21bdf28305a0915af8e002b98ba82bc25a1573"
1322+
path: "packages/css-calc"
1323+
vcs_processed:
1324+
type: "Git"
1325+
url: "https://github.com/csstools/postcss-plugins.git"
1326+
revision: "7a21bdf28305a0915af8e002b98ba82bc25a1573"
1327+
path: "packages/css-calc"
12691328
- id: "NPM:@csstools:css-color-parser:3.0.8"
12701329
purl: "pkg:npm/%40csstools/css-color-parser@3.0.8"
12711330
declared_licenses:

‎plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-skip-excluded-scopes-expected-output.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ project:
7777
dependencies:
7878
- id: "NPM::asap:2.0.6"
7979
- id: "NPM:@csstools:css-color-parser:3.0.8"
80+
dependencies:
81+
- id: "NPM:@csstools:color-helpers:5.1.0"
82+
- id: "NPM:@csstools:css-calc:2.1.4"
8083
packages:
8184
- id: "NPM::asap:2.0.6"
8285
purl: "pkg:npm/asap@2.0.6"
@@ -851,6 +854,62 @@ packages:
851854
url: "https://github.com/TooTallNate/util-deprecate.git"
852855
revision: "475fb6857cd23fafff20c1be846c1350abf8e6d4"
853856
path: ""
857+
- id: "NPM:@csstools:color-helpers:5.1.0"
858+
purl: "pkg:npm/%40csstools/color-helpers@5.1.0"
859+
declared_licenses:
860+
- "MIT-0"
861+
declared_licenses_processed:
862+
spdx_expression: "MIT-0"
863+
description: "Color helpers to ease transformation between formats, gamut, etc"
864+
homepage_url: "https://github.com/csstools/postcss-plugins/tree/main/packages/color-helpers#readme"
865+
binary_artifact:
866+
url: ""
867+
hash:
868+
value: ""
869+
algorithm: ""
870+
source_artifact:
871+
url: "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz"
872+
hash:
873+
value: "106c54c808cabfd1ab4c602d8505ee584c2996ef"
874+
algorithm: "SHA-1"
875+
vcs:
876+
type: "Git"
877+
url: "git+https://github.com/csstools/postcss-plugins.git"
878+
revision: "132530a36b9f711a886602ce4bf1e95de95f2a5b"
879+
path: "packages/color-helpers"
880+
vcs_processed:
881+
type: "Git"
882+
url: "https://github.com/csstools/postcss-plugins.git"
883+
revision: "132530a36b9f711a886602ce4bf1e95de95f2a5b"
884+
path: "packages/color-helpers"
885+
- id: "NPM:@csstools:css-calc:2.1.4"
886+
purl: "pkg:npm/%40csstools/css-calc@2.1.4"
887+
declared_licenses:
888+
- "MIT"
889+
declared_licenses_processed:
890+
spdx_expression: "MIT"
891+
description: "Solve CSS math expressions"
892+
homepage_url: "https://github.com/csstools/postcss-plugins/tree/main/packages/css-calc#readme"
893+
binary_artifact:
894+
url: ""
895+
hash:
896+
value: ""
897+
algorithm: ""
898+
source_artifact:
899+
url: "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz"
900+
hash:
901+
value: "8473f63e2fcd6e459838dd412401d5948f224c65"
902+
algorithm: "SHA-1"
903+
vcs:
904+
type: "Git"
905+
url: "git+https://github.com/csstools/postcss-plugins.git"
906+
revision: "7a21bdf28305a0915af8e002b98ba82bc25a1573"
907+
path: "packages/css-calc"
908+
vcs_processed:
909+
type: "Git"
910+
url: "https://github.com/csstools/postcss-plugins.git"
911+
revision: "7a21bdf28305a0915af8e002b98ba82bc25a1573"
912+
path: "packages/css-calc"
854913
- id: "NPM:@csstools:css-color-parser:3.0.8"
855914
purl: "pkg:npm/%40csstools/css-color-parser@3.0.8"
856915
declared_licenses:

‎plugins/package-managers/node/src/main/kotlin/yarn2/Yarn2.kt‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ import org.ossreviewtoolkit.utils.ort.runBlocking
5656
* The amount of package details to query at once with `yarn npm info`.
5757
*/
5858
private const val YARN_NPM_INFO_CHUNK_SIZE = 1000
59+
private val virtualPackageRegex = Regex("""^(@[^@]+)@.*#npm:([0-9]+\.[0-9]+\.[0-9]+)""")
5960

6061
data class Yarn2Config(
6162
/**
@@ -169,7 +170,15 @@ class Yarn2(override val descriptor: PluginDescriptor = Yarn2Factory.descriptor,
169170
scopes.forEach { scope ->
170171
val dependencyNames = packageJson.getDependenciesForScope(scope)
171172
val dependencies = packageInfo.children.dependencies
172-
.map { packageInfoForLocator.getValue(it.locator) }
173+
.map { dependency ->
174+
// Map virtual package locators to their corresponding real package locators as only their
175+
// package infos contain the transitive dependencies.
176+
val locator = virtualPackageRegex.find(dependency.locator)?.let {
177+
"${it.groupValues[1]}@npm:${it.groupValues[2]}"
178+
} ?: dependency.locator
179+
180+
packageInfoForLocator.getValue(locator)
181+
}
173182
.filter { it.moduleName in dependencyNames }
174183

175184
graphBuilder.addDependencies(project.id, scope.descriptor, dependencies)

0 commit comments

Comments
 (0)