yarn 2 `resolutions` causes `OutOfSyncError`

As part of the optimization of the depTree in https://github.com/snyk/nodejs-lockfile-parser/pull/93, we added the following check: https://github.com/snyk/nodejs-lockfile-parser/blob/0bd6a0a2a8a629d9929d089d13cac7e4332e5970/lib/parsers/lock-parser-base.ts#L346-L348

In the case of resolutions in the package.json in Yarn 2, this error will get thrown because of the way Yarn 2 puts custom resolutions in yarn.lock.

Reproduction Steps

Create a new Yarn 2 project with package.json:

{
"dependencies": {
"lodash": "4.17.19"
},
"resolutions": {
"lodash": "4.17.20"
}
}

Run yarn, which will create a yarn.lock:


"lodash@npm:4.17.20":
version: 4.17.20
resolution: "lodash@npm:4.17.20"
checksum: b31afa09739b7292a88ec49ffdb2fcaeb41f690def010f7a067eeedffece32da6b6847bfe4d38a77e6f41778b9b2bca75eeab91209936518173271f0b69376ea
languageName: node
linkType: hard

"root-workspace-0b6124@workspace:.": version: 0.0.0-use.local resolution: "root-workspace-0b6124@workspace:." dependencies: lodash: 4.17.19 languageName: unknown linkType: soft


3. Run `snyk test`
4. See error `Dependency lodash@4.17.19 was not found in undefined. Your package.json and undefined are probably out of sync. Please run "undefined" and try again.` (the `undefined` is just because `yarn2` is missing from `lib/errors/out-of-sync-error.ts`.

**Explanation**
In the above `yarn.lock`, the root workspace has a dependency on `lodash@4.17.19`, which does not appear elsewhere in the `yarn.lock` because the only actual `lodash` is `4.17.20`, caused by the resolution. This breaks the `depMap` check, above, even when `--strict-out-of-sync=false` is passed.

**Potential Solutions**
1. When `--strict-out-of-sync=false` is passed, ignore dependencies that are not in the `depMap`; this will unblock consumers who use `resolutions`, but it doesn't add full support for `resolutions`.
2. Figure out how to add full support for `resolutions`, potentially using functionality provided by `@yarnpkg/core`.

snyk / nodejs-lockfile-parser

yarn 2 `resolutions` causes `OutOfSyncError` #99