Documentation
¶
Index ¶
- func AddNodeIfMissing(depsGraph *sdk.Graph, node *sdk.Dependency) error
- func AnnotateScopesFromPackageJSON(projectPath string, depsGraph *sdk.Graph) error
- func ApplyDirectDependencyScopes(depsGraph *sdk.Graph, rootID string, directScopes map[string]sdk.Scope)
- func DepGraphFromNPMJSON(raw []byte) (*sdk.Graph, error)
- func DepGraphFromNPMNode(root *NPMListNode) (*sdk.Graph, error)
- func DepGraphFromPNPMJSON(raw []byte) (*sdk.Graph, error)
- func DepGraphFromYarnJSON(raw []byte) (*sdk.Graph, error)
- func DependencySourceFromSpecifier(value string) sdk.DependencySource
- func DirectDependencyScopes(manifest PackageJSONManifest) map[string]sdk.Scope
- func MergeStringMaps(left map[string]string, right map[string]string) map[string]string
- func NormalizeVersionToken(value string) string
- func PackageManagerWarnings(projectDir string, manager sdk.PackageManager, lockfile LockfileFormat) []sdk.DetectorWarning
- func ParseIntegrityDigests(integrity string) []sdk.Digest
- func StripUTF8BOM(data []byte) []byte
- type BaseDetector
- type LockfileFormat
- type NPMListNode
- type PackageJSONManifest
- type UnknownComponent
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddNodeIfMissing ¶
func AddNodeIfMissing(depsGraph *sdk.Graph, node *sdk.Dependency) error
AddNodeIfMissing adds a package to a graph or merges scope into the existing package.
func AnnotateScopesFromPackageJSON ¶
AnnotateScopesFromPackageJSON annotates graph packages using direct dependency scopes from package.json.
func ApplyDirectDependencyScopes ¶
func ApplyDirectDependencyScopes(depsGraph *sdk.Graph, rootID string, directScopes map[string]sdk.Scope)
ApplyDirectDependencyScopes annotates direct root dependencies and their transitive dependencies with normalized scopes.
func DepGraphFromNPMJSON ¶
DepGraphFromNPMJSON maps npm list JSON output into a dependency graph.
func DepGraphFromNPMNode ¶
func DepGraphFromNPMNode(root *NPMListNode) (*sdk.Graph, error)
DepGraphFromNPMNode maps a npm dependency tree node into a dependency graph.
func DepGraphFromPNPMJSON ¶
DepGraphFromPNPMJSON maps pnpm list JSON output into a dependency graph.
func DepGraphFromYarnJSON ¶
DepGraphFromYarnJSON maps Yarn list JSON output into a dependency graph.
func DependencySourceFromSpecifier ¶ added in v0.19.0
func DependencySourceFromSpecifier(value string) sdk.DependencySource
DependencySourceFromSpecifier classifies a Node dependency specifier by where its resolved artifact originates.
func DirectDependencyScopes ¶
func DirectDependencyScopes(manifest PackageJSONManifest) map[string]sdk.Scope
DirectDependencyScopes builds direct dependency scopes from package.json dependency maps.
func MergeStringMaps ¶
MergeStringMaps returns a shallow merge of two string maps.
func NormalizeVersionToken ¶
NormalizeVersionToken removes common package-manager range and protocol markers from a version token.
func PackageManagerWarnings ¶ added in v0.20.2
func PackageManagerWarnings(projectDir string, manager sdk.PackageManager, lockfile LockfileFormat) []sdk.DetectorWarning
PackageManagerWarnings reports non-fatal problems with a Node project's package-manager configuration: the detector resolved a correct graph, but the project as committed will trip up an install elsewhere, typically in CI. lockfile describes the lockfile the caller parsed, if any.
Every check reads committed files only — package.json, that lockfile, pnpm-workspace.yaml, and .npmrc. Nothing is executed: `pnpm`/`yarn` on PATH are frequently Corepack shims, and running one can download the pinned manager on demand, which would put a network call in a plain scan. Comparing what the repository declares is also the more accurate question, since that is what CI installs with, not whatever is on this machine's PATH.
Unreadable or unrecognized inputs are skipped: malformed lockfiles are the detector's error to report, not this check's.
func ParseIntegrityDigests ¶
ParseIntegrityDigests parses a space-separated integrity string (for example "sha512-abc sha1-xyz") into Digest values. Returns nil when the string is empty.
func StripUTF8BOM ¶ added in v0.19.0
StripUTF8BOM removes an optional UTF-8 byte-order mark from input.
Types ¶
type BaseDetector ¶
BaseDetector provides shared command execution behavior for Node package-manager detectors.
func (BaseDetector) Install ¶
func (d BaseDetector) Install(ctx context.Context, req sdk.DetectionRequest, executable string, defaultArgs []string, detectorName string) error
Install runs a package-manager install command for detectors that support install-first.
func (BaseDetector) ProjectDir ¶
func (d BaseDetector) ProjectDir(projectPath string) string
ProjectDir returns the configured working directory or falls back to the project path.
func (BaseDetector) ResolveGraph ¶
func (d BaseDetector) ResolveGraph(stderr io.Writer, projectPath string, verbose bool, executable string, args []string, detectorName string, parse func([]byte) (*sdk.Graph, error)) (*sdk.Graph, error)
ResolveGraph runs a package-manager CLI command and maps its JSON output into a graph.
type LockfileFormat ¶ added in v0.20.2
type LockfileFormat struct {
File string // base name, e.g. "pnpm-lock.yaml"
Version string // format version as written, e.g. "9.0"
}
LockfileFormat identifies the lockfile a Node detector parsed and the format version it declares. The zero value means the detector has no format version to compare (Bun text lockfiles record none), which disables the format-versus-declaration check without disabling the rest.
type NPMListNode ¶
type NPMListNode struct {
Name string `json:"name"`
Version string `json:"version"`
Dependencies map[string]*NPMListNode `json:"dependencies"`
}
NPMListNode is the npm list JSON node shape used by npm CLI and v1 package-lock parsing.
type PackageJSONManifest ¶
type PackageJSONManifest struct {
Name string `json:"name"`
Version string `json:"version"`
Dependencies map[string]string `json:"dependencies"`
OptionalDependencies map[string]string `json:"optionalDependencies"`
PeerDependencies map[string]string `json:"peerDependencies"`
DevDependencies map[string]string `json:"devDependencies"`
}
PackageJSONManifest is the subset of package.json used by Node detectors.
func ReadPackageJSONManifest ¶
func ReadPackageJSONManifest(projectPath string) (PackageJSONManifest, error)
ReadPackageJSONManifest reads the package.json manifest used by Node lockfile parsers.
type UnknownComponent ¶ added in v0.19.0
UnknownComponent describes a disconnected component attached to its owning manifest root with an unknown relationship.
func AttachUnknownComponents ¶ added in v0.19.0
func AttachUnknownComponents(graph *sdk.Graph, rootID string, logger *zap.Logger, detector, manifest string) ([]UnknownComponent, error)
AttachUnknownComponents attaches every component without an incoming edge beneath rootID. Only the component root is marked unknown; known descendant edges remain transitive.
func AttachUnknownComponentsToApplication ¶ added in v0.19.0
func AttachUnknownComponentsToApplication(graph *sdk.Graph, logger *zap.Logger, detector, manifest string) ([]UnknownComponent, error)
AttachUnknownComponentsToApplication finds the application root and delegates to AttachUnknownComponents. Graphs without an application root are left for consolidation to normalize beneath a manifest root.
Source Files
Directories