Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filter yarn deps to direct deps for main package #1623

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Filter yarn deps to direct deps for main package #1623

wants to merge 1 commit into from

Conversation

sahil-seth
Copy link

This is related to #1085

Context:

  • When creating the dependency list for the main package in yarn.lock parsing, we are currently passing all the dependencies(direct and transitive) for the parent component(main package)
  • Systems parsing the cycloneDX SBOM file to make sense of direct and transitive dependencies assume that all of these are direct dependencies(which is the case for other tech stacks)
  • This was earlier brought up in issue 1085 where it was suggested to open a pull request, but wasn't done.
  • The current logic is based on the yarn list --depth=0 which is also incorrect and has been acknowledged here

Changes:

  • I'm getting the direct dependencies list from the package.json file
  • Then filtering on the dependenciesList and only adding direct ones to the main package

Signed-off-by: Sahil Seth sseth@atlassian.com

@sahil-seth
Filter yarn deps to direct deps for main package
ff8cf8d 
When creating the dependency list for the main package in yarn.lock
parsing, filter to only include direct dependencies from package.json.
This ensures the dependency graph accurately represents direct vs
transitive dependencies.

Previously all dependencies were being added as direct dependencies for
the main package, which was incorrect. Now we read package.json to
determine which dependencies are actually direct dependencies.

Signed-off-by: Sahil Seth <sseth@atlassian.com>
Signed-off-by: sseth <sseth@atlassian.com>
@sahil-seth sahil-seth requested a review from prabhu as a code owner February 7, 2025 05:23
@sahil-seth
Copy link
Author

Please let me know your thoughts on this and we can also make minor adjustments to the code, if required.
@prabhu

@sahil-seth
Copy link
Author

@prabhu could you please take a look at this since this is kinda blocking us due to the extra dependencies?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@prabhu prabhu Awaiting requested review from prabhu prabhu is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sahil-seth