fix: [OSM-1996] support pnpm packages aliases

snyk · Aug 13, 2024 · d42528b · d42528b
1 parent ac9bf00
commit d42528b
Show file tree

Hide file tree

Showing 15 changed files with 1,807 additions and 24 deletions.
diff --git a/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts b/lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts
@@ -22,13 +22,15 @@ export abstract class PnpmLockfileParser {
   public extractedPackages: NormalisedPnpmPkgs;
   public importers: PnpmImporters;
   public workspaceArgs?: PnpmWorkspaceArgs;
+  public resolvedPackages: Record<string, PnpmDepPath>;
 
   public constructor(rawPnpmLock: any, workspaceArgs?: PnpmWorkspaceArgs) {
     this.rawPnpmLock = rawPnpmLock;
     this.lockFileVersion = rawPnpmLock.lockfileVersion;
     this.workspaceArgs = workspaceArgs;
     this.packages = rawPnpmLock.packages || {};
     this.extractedPackages = {};
+    this.resolvedPackages = {};
     this.importers = this.normaliseImporters(rawPnpmLock);
   }
 
@@ -61,6 +63,7 @@ export abstract class PnpmLockfileParser {
           optionalDependencies: versionData.optionalDependencies || {},
         };
         packages[`${pkg.name}@${pkg.version}`] = pkg;
+        this.resolvedPackages[depPath] = `${pkg.name}@${pkg.version}`;
       },
     );
     return packages;

diff --git a/lib/dep-graph-builders/pnpm/utils.ts b/lib/dep-graph-builders/pnpm/utils.ts
@@ -20,11 +20,19 @@ export const getPnpmChildNode = (
   includeDevDeps: boolean,
   lockfileParser: PnpmLockfileParser,
 ): PnpmNode => {
-  const resolvedVersion =
+  let resolvedVersion =
     valid(depInfo.version) || depInfo.version === undefined
       ? depInfo.version
       : lockfileParser.excludeTransPeerDepsVersions(depInfo.version);
-  const childNodeKey = `${name}@${resolvedVersion}`;
+  let childNodeKey = `${name}@${resolvedVersion}`;
+  // For aliases, the version is the dependency path that
+  // shows up in the packages section of lockfiles
+  if (lockfileParser.resolvedPackages[depInfo.version]) {
+    childNodeKey = lockfileParser.resolvedPackages[depInfo.version];
+    const pkgData = pkgs[childNodeKey];
+    name = pkgData.name;
+    resolvedVersion = pkgData.version;
+  }
   if (!pkgs[childNodeKey]) {
     if (lockfileParser.isWorkspaceLockfile()) {
       return {