Handle deps such as dependencies, devDependencies, peerDependencies, optionalDependencies return a tuple of (dep type, list of deps) https://docs.npmjs.com/files/package.json#dependencies https://docs.npmjs.com/files/package.json#peerdependencies https://docs.npmjs.com/files/pac
(deps, package, field_name, is_direct=True)
| 1807 | |
| 1808 | |
| 1809 | def deps_mapper(deps, package, field_name, is_direct=True): |
| 1810 | """ |
| 1811 | Handle deps such as dependencies, devDependencies, peerDependencies, optionalDependencies |
| 1812 | return a tuple of (dep type, list of deps) |
| 1813 | https://docs.npmjs.com/files/package.json#dependencies |
| 1814 | https://docs.npmjs.com/files/package.json#peerdependencies |
| 1815 | https://docs.npmjs.com/files/package.json#devdependencies |
| 1816 | https://docs.npmjs.com/files/package.json#optionaldependencies |
| 1817 | """ |
| 1818 | #TODO: verify, merge and use logic at BaseNpmHandler.update_dependencies_by_purl |
| 1819 | npm_dependency_scopes_attributes = { |
| 1820 | 'dependencies': dict(is_runtime=True, is_optional=False), |
| 1821 | 'devDependencies': dict(is_runtime=False, is_optional=True), |
| 1822 | 'peerDependencies': dict(is_runtime=True, is_optional=False), |
| 1823 | 'optionalDependencies': dict(is_runtime=True, is_optional=True), |
| 1824 | 'resolutions': dict(is_runtime=True, is_optional=False, is_pinned=True), |
| 1825 | } |
| 1826 | dependencies = package.dependencies |
| 1827 | |
| 1828 | deps_by_name = {} |
| 1829 | if field_name == 'optionalDependencies': |
| 1830 | # optionalDependencies override the dependencies with the same name |
| 1831 | # so we build a map of name->dep object for use later |
| 1832 | for d in dependencies: |
| 1833 | if d.scope != 'dependencies': |
| 1834 | continue |
| 1835 | purl = PackageURL.from_string(d.purl) |
| 1836 | npm_name = purl.name |
| 1837 | if purl.namespace: |
| 1838 | npm_name = '/'.join([purl.namespace, purl.name]) |
| 1839 | deps_by_name[npm_name] = d |
| 1840 | |
| 1841 | for fqname, requirement in deps.items(): |
| 1842 | # Handle cases in ``resolutions`` with ``**`` |
| 1843 | # "resolutions": { |
| 1844 | # "**/@typescript-eslint/eslint-plugin": "^4.1.1", |
| 1845 | if fqname.startswith('**'): |
| 1846 | fqname = fqname.replace('**', '') |
| 1847 | ns, name = split_scoped_package_name(fqname) |
| 1848 | if not name: |
| 1849 | continue |
| 1850 | |
| 1851 | if ':' in requirement and '@' in requirement: |
| 1852 | # dependencies with requirements like this are aliases and should be reported |
| 1853 | aliased_package, _, requirement = requirement.rpartition('@') |
| 1854 | _, _, aliased_package_name = aliased_package.rpartition(':') |
| 1855 | ns, _ , name = aliased_package_name.rpartition('/') |
| 1856 | |
| 1857 | purl = PackageURL(type='npm', namespace=ns, name=name).to_string() |
| 1858 | |
| 1859 | # optionalDependencies override the dependencies with the same name |
| 1860 | # https://docs.npmjs.com/files/package.json#optionaldependencies |
| 1861 | # therefore we update/override the dependency of the same name |
| 1862 | overridable = deps_by_name.get(fqname) |
| 1863 | |
| 1864 | if overridable and field_name == 'optionalDependencies': |
| 1865 | overridable.purl = purl |
| 1866 | overridable.is_optional = True |