OWASP / OWASP/cve-lite-cli

fix(workspaces): packages/** and prefix globs are not matched by workspace expansion

Open
#1,119 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug in-house
Dominant language
TypeScript
Stars
715
Forks
145
Avg merge
21h 39m
Merged PRs (30d)
66

Description

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Surfaced while reviewing #1114. That PR resolves PD001/PD002 declarations against the nearest enclosing workspace member, which fixes the false positives @alamb-hex reported in #966. The fix only reaches workspaces that the existing pattern expansion can enumerate, and two common glob shapes are not among them.

What is not matched

expandWorkspacePattern (src/utils/package-json.ts:107) special-cases a whole-segment * only. Measured against the compiled parser:

workspaces pattern members found
["packages/*"] ["packages/a","packages/b"]
["packages/*/"] ["packages/a"]
["packages/**"] none
["packages/pkg-*"] none
["apps/*","!apps/legacy"] ["apps/legacy","apps/web"] (negation ignored)

packages/** and prefix globs like pkg-* are both common in real pnpm and Yarn monorepos. Those projects still get the full set of PD002 false positives the fix was meant to remove.

Notes

Negation being ignored fails in the safe direction: an excluded workspace is still read, so its declarations still count and no false positive is produced. Worth handling for correctness but not urgent.

This is shared code. resolveWorkspacePackageJsonPaths and readWorkspacePatterns feed workspace resolution generally, not just the PD rules, so the same gap affects anything else relying on member enumeration.

Pre-existing and not introduced by #1114. Filed separately so it does not sit on that PR.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at expandWorkspacePattern in src/utils/package-json.ts:107 and trace how resolveWorkspacePackageJsonPaths and readWorkspacePatterns enumerate members. Compare behavior for packages/**, prefix globs such as packages/pkg-*, and the existing patterns in the issue. Done means the missing workspace members are enumerated without regressing the documented cases; negation handling is noted as non-urgent.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.