microsoft / microsoft/component-detection
Scan link dependencies with the Pnpm detector
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
The pnpm-lock.ymal file can have entries that refer to modules that are present in the file system ex:
```
/query-string/4.3.4:
dependencies:
'@learningclient/common': link:../common
```
Resolving this path should take us to a folder with a `package.json` file. We could parse this file to get the version of the component.
Today the component is not registered by the PnpmDetector but by the NpmDetector. This is a little inconvenient because the NpmDetector cannot create a dependency graph for this component and does not have information if the component is a dev dependency or not.
Contributor guide
Research direction
Start with the PnpmDetector and NpmDetector entry points, then inspect the pnpm-lock.ymal link entries and the linked folder's package.json. Done means linked modules are registered by PnpmDetector, their package versions are read, and the dependency graph preserves whether they are development dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, javascript
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100