Resolve workspace paths for transitive remediation

Open
  • Is something wrong?
#1,548 3 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
54/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bun, node.js, typescript
Domain
backend, cli, security

Research direction

Read src/remediation/npm-transitive-resolution.ts and src/scanner.ts, then inspect the package-manager workspace maps and existing remediation and fixture-scan tests. Run the workspace fixture scans for npm, Yarn, pnpm, and bun where supported, without manually injecting workspace metadata. Done means scan-level tests cover multiple workspace paths, root-only dependencies, and package-manager-specific commands while preserving root behavior when no workspace applies.

Written by the indexing model from the issue text.

Description

bug parser

Summary

Workspace scans can produce root-level within-range remediation commands instead of member-aware commands. Update the transitive resolver to read workspace dependency paths and propagate the relevant workspace metadata into fix plans.

Context

In src/remediation/npm-transitive-resolution.ts, collectWorkspacesFromAllPaths currently considers only three-segment paths. A workspace path can include a workspace member as an additional segment. The scanner and resolver also need the appropriate package-manager workspace map to identify members.

In PR #1547, a real scan of the Yarn Berry workspace example was reported to print yarn up -R follow-redirects at the root. The workspace test supplies workspace metadata manually, so it does not establish how a real scan derives that metadata. The requester reports a similar root-level result for the npm workspace example. This behavior can affect npm, Yarn, pnpm, and bun.

Affected areas include src/remediation/npm-transitive-resolution.ts, src/scanner.ts, package-manager workspace maps, and remediation and fixture-scan tests.

Acceptance criteria

  • Resolve workspace members from actual transitive dependency paths and pass the appropriate workspace metadata through the scanner and resolver.
  • Add scan-level coverage for npm, Yarn, pnpm, and bun workspace fixtures where supported. Do not manually inject the workspace metadata being tested.
  • Verify the resulting commands and their package-manager-specific behavior. Do not assume that Yarn's recursive refresh is limited to one workspace.
  • Cover multiple workspace paths and root-only dependencies. Preserve correct root-level behavior when no workspace applies.

Requested by @RClaudiuM.

PR: https://github.com/OWASP/cve-lite-cli/pull/1547
Review discussion: https://github.com/OWASP/cve-lite-cli/pull/1547#discussion_r4496215037

Dominant language
TypeScript
Stars
786
Forks
189
Avg merge
3d 2h
Merged PRs (30d)
97

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/cve-lite-cli

All issues in OWASP/cve-lite-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.