Skip to content

fix(npm): extract workspace member subtree from npm ls output#485

Open
Strum355 wants to merge 3 commits intoguacsec:mainfrom
Strum355:TC-4181
Open

fix(npm): extract workspace member subtree from npm ls output#485
Strum355 wants to merge 3 commits intoguacsec:mainfrom
Strum355:TC-4181

Conversation

@Strum355
Copy link
Copy Markdown
Member

@Strum355 Strum355 commented Apr 22, 2026

Summary

  • Fix npm workspace member component analysis returning 0 dependencies
  • When npm ls --package-lock-only --json runs from the workspace root, the tree is rooted at the workspace root — the override now detects this (tree root name ≠ manifest name) and extracts the member's subtree from tree.dependencies[memberName]
  • Add workspace member test fixtures with golden SBOMs for both stack and component analysis

Implements TC-4181

Test plan

  • npm workspace member component analysis returns correct direct dependencies
  • npm workspace member stack analysis returns correct transitive dependencies
  • All 47 existing javascript provider tests continue to pass
  • ESLint clean

🤖 Generated with Claude Code

Strum355 and others added 3 commits April 22, 2026 13:24
When npm ls --package-lock-only --json runs from the workspace root,
it returns a tree rooted at the workspace root package with workspace
members nested under dependencies. Component analysis failed because
_getRootDependencies read the root-level deps (workspace member
entries), not the member's actual deps — filtering by the member's
manifest dependencies found no match, returning 0 dependencies.

Now overrides _buildDependencyTree to detect when the tree root name
differs from the manifest name and extracts the member's subtree.

Implements TC-4181

Assisted-by: Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Test fixtures regenerated from actual npm ls output (follow-redirects
resolved to 1.16.0, root object has no version field, resolved path
uses relative ../packages/member-a).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Strum355 Strum355 requested a review from ruromero April 22, 2026 16:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants