search

snyk / nodejs-lockfile-parser

Generate a Snyk dependency tree from package-lock.json or yarn.lock file
Other
59 stars 28 forks source link

Fix/align deptree interface #51

Closed miiila closed 4 years ago

miiila commented 4 years ago

What this does

DepTree intreface has diverged from the one used in e.g. DepGraph. The biggest difference is the dependencies keys, which is not mandatory anymore. This change is a prereq for using depgraphs.

Notes for the reviewer

Just carefully review tests and think of potential impact and omitted parts.

More information

lili2311 commented 4 years ago

👋 Please could you give a little more context:

miiila commented 4 years ago

@lili2311

Why does removed empty dependencies object helping towards moving to a graph?

As I say in description, DepTree intreface has diverged from the one used in e.g. DepGraph. The main difference is in mandatory vs optional dependencies property. Once moved to graph function, tree created out of the graph should be the same as the one created by tree function. Therefore the interface has to be same and that's why we need to align those.

How does Registry and other upstreams handle this change? Do they care?

That's what we spoke about with @darscan. What needs to be put back is top level dependencies key which might be somewhere used to checks. Apart from that, everything should be ok.

darscan commented 4 years ago

What needs to be put back is top level dependencies key which might be somewhere used to checks

Can we do that then please :D

darscan commented 4 years ago

I still think you need to split the type in two, like we do in the dep-graph lib: top-level tree type (with mandatory dependencies property) VS recursive dep type (with optional dependencies property)

Or, just use the dep-graph type in

snyksec commented 4 years ago

:tada: This PR is included in version 1.16.1 :tada:

The release is available on:

Your semantic-release bot :package::rocket: