Merge pull request #291 from snyk/fix/npm-lock-v2-workspace-dependency-resolution

fix: resolve workspace package dependencies in npm lock v2 parser

Author: JamesPatrickGill

lib/dep-graph-builders/npm-lock-v2/index.ts

@@ -490,6 +490,14 @@ export const getChildNodeKey = (
       if (pkgs[fullPath]) {
         return pkgs[fullPath].name || segment;
       }
+
+      // For workspace packages, the path might not have node_modules/ prefix
+      // Check if this segment (or joined path) exists as a workspace package
+      const workspacePath = pathSegments.join('/node_modules/');
+      if (pkgs[workspacePath]) {
+        return pkgs[workspacePath].name || segment;
+      }
+
       return segment;
     });
 

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/expected.json

@@ -0,0 +1,67 @@
+{
+  "schemaVersion": "1.3.0",
+  "pkgManager": {
+    "name": "npm"
+  },
+  "pkgs": [
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "root-workspace",
+        "version": "1.0.0"
+      }
+    },
+    {
+      "id": "@test/[email protected]",
+      "info": {
+        "name": "@test/workspace-pkg",
+        "version": "1.0.0"
+      }
+    },
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "lodash",
+        "version": "4.17.21"
+      }
+    }
+  ],
+  "graph": {
+    "rootNodeId": "root-node",
+    "nodes": [
+      {
+        "nodeId": "root-node",
+        "pkgId": "[email protected]",
+        "deps": [
+          {
+            "nodeId": "@test/[email protected]"
+          }
+        ]
+      },
+      {
+        "nodeId": "@test/[email protected]",
+        "pkgId": "@test/[email protected]",
+        "deps": [
+          {
+            "nodeId": "[email protected]"
+          }
+        ],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      },
+      {
+        "nodeId": "[email protected]",
+        "pkgId": "[email protected]",
+        "deps": [],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      }
+    ]
+  }
+}

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/package-lock.json

@@ -0,0 +1,11 @@
+{
+  "name": "root-workspace",
+  "version": "1.0.0",
+  "workspaces": [
+    "packages/*"
+  ],
+  "dependencies": {
+    "@test/workspace-pkg": "file:packages/workspace-pkg"
+  },
+  "devDependencies": {}
+}

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/package.json

@@ -24,6 +24,7 @@ describe('dep-graph-builder npm-lock-v2', () => {
         'dist-tag-sub-dependency',
         'bundled-top-level-dep',
         'missing-optional-dep-minimal',
+        'workspace-nested-deps',
       ])('[simple tests] project: %s ', (fixtureName) => {
         it('matches expected', async () => {
           const pkgJsonContent = readFileSync(