[doc](arborist) document when a node would not contain a resolved field
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
the resolved field is critical to understanding the provenance of a package for security reasons
its confusing when arborist is unable to determine where a package was resolved from
I can understand there are some situations when a package may not have a straight-forward resolved value, perhaps when it is a "bundled" dependency
it would be nice to know all the cases where this is possible and why
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the npm Arborist implementation and existing documentation around the resolved field. Trace the situations in which Arborist cannot determine a resolved value, including bundled dependencies, and document each case with its reason. Done means the documentation explains all identified cases and removes the ambiguity for package provenance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100