Include optional dependencies in pnpm dependency graphs

Open
  • Is something wrong?
#3 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript, python
Domain
backend

Research direction

Start in backend/app/scanners/analyzers/javascript.py where the _pnpm_packages parser reads dependencies:, then check how backend/app/models/dependency_relationship.py stores edge_type before deciding how optional edges are marked. Add fixture-based cases to backend/tests/scanners/test_javascript_analyzer.py for both pnpm v6 and v9 lockfiles, asserting optional and required edges separately. Done when optional edges are distinct, existing required-edge tests still pass, and the focused analyzer and scanner tests run green.

Written by the indexing model from the issue text.

Description

enhancement good first issue

Summary

The _pnpm_packages parser currently collects relationships from dependencies: but not optionalDependencies:. This leaves optional package edges out of the pnpm dependency graph or risks treating them as required if added without preserving their kind.

Affected files

  • backend/app/scanners/analyzers/javascript.py
  • backend/app/models/dependency_relationship.py (inspect the existing graph representation before implementation)
  • backend/tests/scanners/test_javascript_analyzer.py

Scope

Parse optional dependency references in the supported pnpm v6 and v9 lockfile forms. The current graph model stores directed parent-to-child edges with an edge_type string; trace graph persistence and serialization so optional status remains distinguishable to consumers. Do not change existing required-edge semantics.

Acceptance criteria

  • Optional dependency references are parsed from supported pnpm v6 and v9 lockfiles.
  • Optional edges are represented distinctly using the existing graph model (or a compatible existing mechanism).
  • Optional dependencies are not classified as required dependencies.
  • Existing required dependencies: edges and pnpm graph behavior remain unchanged.
  • Focused fixture-based tests cover both lockfile versions and assert required and optional edge semantics separately.

Testing expectations

Run the focused JavaScript analyzer tests and relevant backend scanner tests. Include regression tests for current required dependency edges.

Dominant language
Python
Stars
2
Forks
1
Avg merge
1h 22m
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ayushdoesdev/verspect

All issues in ayushdoesdev/verspect

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.