feat: add npm 7 support

snyk · Apr 26, 2021 · ef1c3c8 · ef1c3c8
1 parent 991a21d
commit ef1c3c8
Show file tree

Hide file tree

Showing 51 changed files with 332 additions and 70 deletions.
diff --git a/lib/parsers/index.ts b/lib/parsers/index.ts
@@ -56,7 +56,8 @@ export interface PkgTree extends DepTreeDep {
   };
   meta?: {
     nodeVersion?: string;
-    packageManagerVersion?: string;
+    lockfileVersion?: number;
+    packageManager?: string;
   };
   hasDevDependencies?: boolean;
   cyclic?: boolean;
@@ -70,6 +71,7 @@ export enum Scope {
 
 export enum LockfileType {
   npm = 'npm',
+  npm7 = 'npm7',
   yarn = 'yarn',
   yarn2 = 'yarn2',
 }
@@ -120,7 +122,9 @@ export function getTopLevelDeps(
     });
   }
 
-  if (isNpm7(lockfile) && targetFile.peerDependencies) {
+  // Only include peerDependencies if using npm and npm is at least
+  // version 7 as npm v7 automatically installs peerDependencies
+  if (lockfile.type === LockfileType.npm7 && targetFile.peerDependencies) {
     for (const [name, version] of Object.entries(targetFile.peerDependencies)) {
       dependencies.push({
         name,
@@ -131,15 +135,6 @@ export function getTopLevelDeps(
   return dependencies;
 }
 
-// Only include peerDependencies if using npm and npm is at least
-// version 7 as npm v7 automatically installs peerDependencies
-function isNpm7(lockfile: Lockfile): boolean {
-  return (
-    lockfile.type === LockfileType.npm &&
-    (lockfile as PackageLock).lockfileVersion === 2
-  );
-}
-
 export function createDepTreeDepFromDep(dep: Dep): DepTreeDep {
   return {
     labels: {

diff --git a/lib/parsers/package-lock-parser.ts b/lib/parsers/package-lock-parser.ts
@@ -1,4 +1,11 @@
-import { Dep, Lockfile, LockfileType, Scope } from './index';
+import {
+  Dep,
+  Lockfile,
+  LockfileType,
+  ManifestFile,
+  PkgTree,
+  Scope,
+} from './index';
 import { InvalidUserInputError } from '../errors';
 import { DepMap, DepMapItem, LockParserBase } from './lock-parser-base';
 import { config } from '../config';
@@ -7,8 +14,8 @@ export interface PackageLock {
   name: string;
   version: string;
   dependencies?: PackageLockDeps;
-  lockfileVersion: number;
-  type: LockfileType.npm;
+  lockfileVersion: 1 | 2;
+  type: LockfileType.npm | LockfileType.npm7;
 }
 
 export interface PackageLockDeps {
@@ -32,7 +39,11 @@ export class PackageLockParser extends LockParserBase {
   public parseLockFile(lockFileContents: string): PackageLock {
     try {
       const packageLock: PackageLock = JSON.parse(lockFileContents);
-      packageLock.type = LockfileType.npm;
+      packageLock.type =
+        packageLock.lockfileVersion === 1
+          ? LockfileType.npm
+          : LockfileType.npm7;
+      this.type = packageLock.type;
       return packageLock;
     } catch (e) {
       throw new InvalidUserInputError(
@@ -41,6 +52,29 @@ export class PackageLockParser extends LockParserBase {
     }
   }
 
+  public async getDependencyTree(
+    manifestFile: ManifestFile,
+    lockfile: Lockfile,
+    includeDev: boolean = false,
+    strict: boolean = true,
+  ): Promise<PkgTree> {
+    const dependencyTree = await super.getDependencyTree(
+      manifestFile,
+      lockfile,
+      includeDev,
+      strict,
+    );
+    const meta = {
+      lockfileVersion: (lockfile as PackageLock).lockfileVersion,
+      packageManager: 'npm',
+    };
+    const depTreeWithMeta = {
+      ...dependencyTree,
+      meta: { ...dependencyTree.meta, ...meta },
+    };
+    return depTreeWithMeta;
+  }
+
   protected getDepMap(lockfile: Lockfile): DepMap {
     const packageLock = lockfile as PackageLock;
     const depMap: DepMap = {};

diff --git a/lib/parsers/yarn-lock-parser.ts b/lib/parsers/yarn-lock-parser.ts
@@ -66,10 +66,13 @@ export class YarnLockParser extends LockParserBase {
       strict,
     );
 
-    if (!depTree.meta) depTree.meta = {};
-    depTree.meta.packageManagerVersion = '1';
+    const meta = { lockfileVersion: 1, packageManager: 'yarn' };
+    const depTreeWithMeta = {
+      ...depTree,
+      meta: { ...depTree.meta, ...meta },
+    };
 
-    return depTree;
+    return depTreeWithMeta;
   }
 
   protected getDepMap(lockfile: Lockfile): DepMap {

diff --git a/lib/parsers/yarn2-lock-parser.ts b/lib/parsers/yarn2-lock-parser.ts
@@ -68,10 +68,13 @@ export class Yarn2LockParser extends LockParserBase {
       strict,
     );
 
-    if (!depTree.meta) depTree.meta = {};
-    depTree.meta.packageManagerVersion = '2';
+    const meta = { lockfileVersion: 2, packageManager: 'yarn' };
+    const depTreeWithMeta = {
+      ...depTree,
+      meta: { ...depTree.meta, ...meta },
+    };
 
-    return depTree;
+    return depTreeWithMeta;
   }
 
   protected getDepMap(lockfile: Lockfile): DepMap {

diff --git a/test/lib/fixtures/cyclic-dep-simple/yarn1/expected-tree.json b/test/lib/fixtures/cyclic-dep-simple/yarn1/expected-tree.json
@@ -33,6 +33,7 @@
   "version": "0.7.1",
   "meta": {
     "nodeVersion": ">=8.0",
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/cyclic-dep-simple/yarn2/expected-tree.json b/test/lib/fixtures/cyclic-dep-simple/yarn2/expected-tree.json
@@ -33,6 +33,7 @@
   "version": "0.7.1",
   "meta": {
     "nodeVersion": ">=8.0",
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/dev-deps-only/expected-tree-empty.json b/test/lib/fixtures/dev-deps-only/expected-tree-empty.json
@@ -3,5 +3,9 @@
   "size": 1,
   "version": "0.0.1",
   "hasDevDependencies": true,
+  "meta": {
+    "lockfileVersion": 1,
+    "packageManager": "npm"
+  },
   "dependencies": {}
 }
diff --git a/test/lib/fixtures/dev-deps-only/expected-tree.json b/test/lib/fixtures/dev-deps-only/expected-tree.json
@@ -2,6 +2,10 @@
   "name": "pkg-dev-deps-only",
   "size": 3,
   "version": "0.0.1",
+  "meta": {
+    "lockfileVersion": 1,
+    "packageManager": "npm"
+  },
   "hasDevDependencies": true,
   "dependencies": {
     "debug": {
@@ -21,4 +25,5 @@
       }
     }
   }
-}
+}
+
diff --git a/test/lib/fixtures/dev-deps-only/yarn1/expected-tree-with-dev.json b/test/lib/fixtures/dev-deps-only/yarn1/expected-tree-with-dev.json
@@ -22,6 +22,7 @@
     }
   },
   "meta": {
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/dev-deps-only/yarn2/expected-tree-with-dev.json b/test/lib/fixtures/dev-deps-only/yarn2/expected-tree-with-dev.json
@@ -22,6 +22,7 @@
     }
   },
   "meta": {
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/empty-dev-deps/yarn1/expected-tree-with-dev.json b/test/lib/fixtures/empty-dev-deps/yarn1/expected-tree-with-dev.json
@@ -14,6 +14,7 @@
   "version": "0.0.3",
   "meta": {
     "nodeVersion": "6.14.1",
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/empty-dev-deps/yarn2/expected-tree-with-dev.json b/test/lib/fixtures/empty-dev-deps/yarn2/expected-tree-with-dev.json
@@ -14,6 +14,7 @@
   "version": "0.0.3",
   "meta": {
     "nodeVersion": "6.14.1",
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/external-tarball/yarn1/expected-tree.json b/test/lib/fixtures/external-tarball/yarn1/expected-tree.json
@@ -121,6 +121,7 @@
   "size": 16,
   "version": "",
   "meta": {
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/external-tarball/yarn2/expected-tree.json b/test/lib/fixtures/external-tarball/yarn2/expected-tree.json
@@ -121,6 +121,7 @@
   "size": 16,
   "version": "",
   "meta": {
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/file-as-version/expected-tree.json b/test/lib/fixtures/file-as-version/expected-tree.json
@@ -27,5 +27,9 @@
   "hasDevDependencies": false,
   "name": "pkg-dev-deps-only",
   "size": 4,
-  "version": "0.0.1"
+  "version": "0.0.1",
+  "meta": {
+    "lockfileVersion": 2,
+    "packageManager": "npm"
+  }
 }
diff --git a/test/lib/fixtures/file-as-version/yarn1/expected-tree.json b/test/lib/fixtures/file-as-version/yarn1/expected-tree.json
@@ -29,6 +29,7 @@
   "size": 4,
   "version": "0.0.1",
   "meta": {
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/file-as-version/yarn2/expected-tree.json b/test/lib/fixtures/file-as-version/yarn2/expected-tree.json
@@ -29,6 +29,7 @@
   "size": 4,
   "version": "0.0.1",
   "meta": {
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/git-ssh-url-deps/yarn1/expected-tree.json b/test/lib/fixtures/git-ssh-url-deps/yarn1/expected-tree.json
@@ -121,6 +121,7 @@
   "size": 16,
   "version": "",
   "meta": {
-    "packageManagerVersion": "1"
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/git-ssh-url-deps/yarn2/expected-tree.json b/test/lib/fixtures/git-ssh-url-deps/yarn2/expected-tree.json
@@ -121,6 +121,7 @@
   "size": 16,
   "version": "",
   "meta": {
-    "packageManagerVersion": "2"
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
   }
 }
diff --git a/test/lib/fixtures/goof/dep-tree-no-dev-deps-yarn.json b/test/lib/fixtures/goof/dep-tree-no-dev-deps-yarn.json
@@ -6554,7 +6554,7 @@
                 },
                 "supports-color": {
                   "labels": {
-                   "scope": "prod"
+                    "scope": "prod"
                   },
                   "dependencies": {
                     "has-flag": {
@@ -7143,6 +7143,8 @@
   "version": "0.0.3",
   "size": 914,
   "meta": {
-    "nodeVersion": "6.14.1"
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": 1,
+    "packageManager": "npm"
   }
 }
diff --git a/test/lib/fixtures/goof/dep-tree-no-dev-deps.json b/test/lib/fixtures/goof/dep-tree-no-dev-deps.json
@@ -3,7 +3,9 @@
   "version": "0.0.3",
   "size": 910,
   "meta": {
-    "nodeVersion": "6.14.1"
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": 1,
+    "packageManager": "npm"
   },
   "hasDevDependencies": true,
   "dependencies": {
@@ -6579,4 +6581,4 @@
       }
     }
   }
-}
+}
diff --git a/test/lib/fixtures/goof/dep-tree-with-dev-deps.json b/test/lib/fixtures/goof/dep-tree-with-dev-deps.json
@@ -13900,6 +13900,8 @@
   "version": "0.0.3",
   "size": 1791,
   "meta": {
-    "nodeVersion": "6.14.1"
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": 1,
+    "packageManager": "npm"
   }
 }
diff --git a/test/lib/fixtures/goof/yarn1/expected-tree-with-dev.json b/test/lib/fixtures/goof/yarn1/expected-tree-with-dev.json
@@ -11381,5 +11381,9 @@
   "name": "goof",
   "size": 1983,
   "version": "0.0.3",
-  "meta": { "nodeVersion": "6.14.1", "packageManagerVersion": "1" }
+  "meta": {
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": "1",
+    "packageManager": "yarn"
+  }
 }
diff --git a/test/lib/fixtures/goof/yarn1/expected-tree.json b/test/lib/fixtures/goof/yarn1/expected-tree.json
@@ -4932,5 +4932,9 @@
   "name": "goof",
   "size": 852,
   "version": "0.0.3",
-  "meta": { "nodeVersion": "6.14.1", "packageManagerVersion": "1" }
+  "meta": {
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": 1,
+    "packageManager": "yarn"
+  }
 }
diff --git a/test/lib/fixtures/goof/yarn2/expected-tree-with-dev.json b/test/lib/fixtures/goof/yarn2/expected-tree-with-dev.json
@@ -18317,5 +18317,9 @@
   "name": "goof",
   "size": 3189,
   "version": "0.0.3",
-  "meta": { "nodeVersion": "6.14.1", "packageManagerVersion": "2" }
+  "meta": {
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": 2,
+    "packageManager": "yarn"
+  }
 }
diff --git a/test/lib/fixtures/goof/yarn2/expected-tree.json b/test/lib/fixtures/goof/yarn2/expected-tree.json
@@ -6658,5 +6658,9 @@
   "name": "goof",
   "size": 1152,
   "version": "0.0.3",
-  "meta": { "nodeVersion": "6.14.1", "packageManagerVersion": "2" }
+  "meta": {
+    "nodeVersion": "6.14.1",
+    "lockfileVersion": "2",
+    "packageManager": "yarn"
+  }
 }
diff --git a/test/lib/fixtures/missing-deps/expected-tree.json b/test/lib/fixtures/missing-deps/expected-tree.json
@@ -3,5 +3,10 @@
   "size": 1,
   "version": "1.0.0",
   "hasDevDependencies": false,
+  "meta": {
+    "lockfileVersion": 1,
+    "packageManager": "npm"
+  },
   "dependencies": {}
-}
+}
+