imsnif / imsnif/synp

package-lock v3 not working with npmToYarn

Open
#99 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
788
Forks
42
PR merge metrics
No merged PRs in 30d

Description

#### Issue description:

I recently updated my npm to v9 and discovered that some functionality built on synp no longer works.

My code calls `npmToYarn()` which ends up dying in [`buildYarnTree()`](https://github.com/imsnif/synp/blob/master/lib/lockfileV1/tree.js#L24) when it passes `undefined` to `flattenPackageLock`.
After doing some digging, it appears that npm v9 does not populate the dependencies section as it was absent from my package-lock file. Hence the `undefined` value.

By modifying the line in question to pass `packageLock.packages` instead of `packageLock.dependencies` in my node_modules, I was able to get the `npmToYarn()` call to work. Perhaps changing it to `packageLock.dependencies ?? packageLock.packages` would enable package-lock v3 support without breaking backwards compatibility?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in lib/lockfileV1/tree.js at buildYarnTree and trace how npmToYarn supplies the package-lock data. Reproduce the failure with npm v9 and a package-lock v3 file, then verify conversion works while preserving compatibility with older package-lock formats.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.