microsoft / microsoft/component-detection

Scan link dependencies with the Pnpm detector

Open
#130 0 comments 0 reactions 0 assignees View on GitHub
detector:pnpm status:ready type:feature
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

The pnpm-lock.ymal file can have entries that refer to modules that are present in the file system ex:
```
/query-string/4.3.4:
dependencies:
'@learningclient/common': link:../common
```
Resolving this path should take us to a folder with a `package.json` file. We could parse this file to get the version of the component.
Today the component is not registered by the PnpmDetector but by the NpmDetector. This is a little inconvenient because the NpmDetector cannot create a dependency graph for this component and does not have information if the component is a dev dependency or not.

Contributor guide

Open the contributing guide

Research direction

Start with the PnpmDetector and NpmDetector entry points, then inspect the pnpm-lock.ymal link entries and the linked folder's package.json. Done means linked modules are registered by PnpmDetector, their package versions are read, and the dependency graph preserves whether they are development dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, javascript
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.