Include optional dependencies in pnpm dependency graphs

Offen
  • Stimmt etwas nicht?
#3 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
62/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
javascript, python
Bereich
backend

Rechercherichtung

Start in backend/app/scanners/analyzers/javascript.py where the _pnpm_packages parser reads dependencies:, then check how backend/app/models/dependency_relationship.py stores edge_type before deciding how optional edges are marked. Add fixture-based cases to backend/tests/scanners/test_javascript_analyzer.py for both pnpm v6 and v9 lockfiles, asserting optional and required edges separately. Done when optional edges are distinct, existing required-edge tests still pass, and the focused analyzer and scanner tests run green.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

enhancement good first issue

Summary

The _pnpm_packages parser currently collects relationships from dependencies: but not optionalDependencies:. This leaves optional package edges out of the pnpm dependency graph or risks treating them as required if added without preserving their kind.

Affected files

  • backend/app/scanners/analyzers/javascript.py
  • backend/app/models/dependency_relationship.py (inspect the existing graph representation before implementation)
  • backend/tests/scanners/test_javascript_analyzer.py

Scope

Parse optional dependency references in the supported pnpm v6 and v9 lockfile forms. The current graph model stores directed parent-to-child edges with an edge_type string; trace graph persistence and serialization so optional status remains distinguishable to consumers. Do not change existing required-edge semantics.

Acceptance criteria

  • Optional dependency references are parsed from supported pnpm v6 and v9 lockfiles.
  • Optional edges are represented distinctly using the existing graph model (or a compatible existing mechanism).
  • Optional dependencies are not classified as required dependencies.
  • Existing required dependencies: edges and pnpm graph behavior remain unchanged.
  • Focused fixture-based tests cover both lockfile versions and assert required and optional edge semantics separately.

Testing expectations

Run the focused JavaScript analyzer tests and relevant backend scanner tests. Include regression tests for current required dependency edges.

Vorherrschende Sprache
Python
Sterne
2
Forks
1
Ø Merge
1 Std. 22 Min.
Gemergte PRs (30 T.)
2

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus ayushdoesdev/verspect

Alle Issues in ayushdoesdev/verspect

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.