Skip to content

fix(pnpm): select correct workspace member from pnpm ls array#484

Merged
Strum355 merged 5 commits into
guacsec:mainfrom
Strum355:TC-4180
Apr 23, 2026
Merged

fix(pnpm): select correct workspace member from pnpm ls array#484
Strum355 merged 5 commits into
guacsec:mainfrom
Strum355:TC-4180

Conversation

@Strum355

@Strum355 Strum355 commented Apr 22, 2026

Copy link
Copy Markdown
Member

Summary

  • Fix pnpm workspace member dependency resolution returning 0 dependencies for both component and stack analysis
  • When pnpm ls --json runs from the workspace root, it returns an array with one entry per workspace package — the override now finds the entry matching the manifest name instead of blindly taking tree[0]
  • Add workspace member test fixtures with golden SBOMs for both stack and component analysis

Implements TC-4180

Test plan

  • pnpm workspace member stack analysis returns correct transitive dependencies
  • pnpm workspace member component analysis returns correct direct dependencies
  • All 47 existing javascript provider tests continue to pass
  • ESLint clean

🤖 Generated with Claude Code

Strum355 and others added 3 commits April 22, 2026 13:17
When pnpm ls --json runs from a workspace root, it returns an array
with one entry per workspace package. Previously, _buildDependencyTree
always selected tree[0], which is typically the workspace root — not
the member being analyzed. This caused both component and stack
analysis to return 0 dependencies for workspace members.

Now finds the array element matching the manifest name before falling
back to tree[0].

Implements TC-4180

Assisted-by: Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
pnpm ls without -r only returns the workspace root entry, omitting
workspace members entirely. Adding -r includes all workspace packages
in the output array.

Test fixtures regenerated from actual pnpm ls output (follow-redirects
resolved to 1.16.0).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Strum355
Strum355 requested a review from ruromero April 22, 2026 16:16
ruromero
ruromero previously approved these changes Apr 22, 2026

@ruromero ruromero left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Use the larger timeout value unconditionally instead of branching on
the CI environment variable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ruromero
ruromero previously approved these changes Apr 23, 2026
Signed-off-by: Noah S-C <nsantsch@redhat.com>
@Strum355
Strum355 merged commit d9c1ae4 into guacsec:main Apr 23, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants