Npm: support target-level dependency scoping for v3 lockfiles by zlav · Pull Request #1732 · fossas/fossa-cli · GitHub

Overview

Scopes package-lock.json v3 results per workspace for --only-target/--exclude-target. Previously the v3 path ignored targets, so every workspace in an npm-workspaces monorepo returned the same blended whole-repo inventory.

Target names resolve to root-relative workspace paths via their package.json manifests (resolveNpmV3WorkspacePaths) and match the lockfile's top-level path keys — so selection works even when an entry omits its name (npm does this when the folder basename equals the package name).
Workspace link entries are followed, so a dependency on a sibling workspace resolves to the sibling's real versioned deps, not a versionless link stub.
Selecting all targets (the default) reproduces the exact pre-scoping graph (tests pin this); a filter matching nothing yields an empty graph plus a warning. npm v1/v2, yarn, pnpm, and bun are untouched.

Acceptance criteria

fossa analyze --only-target 'npm@./:<workspace-name>' on an npm workspaces monorepo with a v3 root lockfile reports only that workspace's dependencies; default analysis output is unchanged.

Testing plan

Unit tests in PackageLockV3Spec: per-path scoping, all-selected == unscoped equivalence, cross-workspace link following (incl. mutually-dependent workspaces), empty graph for non-matching selections, and a regression for a workspace whose lockfile entry has no name field.
Unit tests in NodeSpec for resolveNpmV3WorkspacePaths (root → "", nested workspace paths).
Integration test (NpmLockV3WorkspaceSpec) runs discovery + analysis end-to-end over a vendored v3 workspaces monorepo fixture and asserts distinct per-workspace results.

Risks

Dev/prod labeling of shared installs is not re-derived per workspace (dev flags in a v3 lockfile are global to the install); scoping only restricts which packages are reported.

Metrics

N/A

References

Path-based workspace resolution adopted from #1734.

Checklist

I added tests for this PR's change (or explained in the PR description why tests don't make sense).
If this PR introduced a user-visible change, I added documentation into docs/.
If this PR added docs, I added links as appropriate to the user manual's ToC in docs/README.ms and gave consideration to how discoverable or not my documentation is.
If this change is externally visible, I updated Changelog.md. If this PR did not mark a release, I added my changes into an ## Unreleased section at the top.
If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated docs/references/files/*.schema.json AND I have updated example files used by fossa init command. You may also need to update these if you have added/removed new dependency type (e.g. pip) or analysis target type (e.g. poetry).
If I made changes to a subcommand's options, I updated docs/references/subcommands/<subcommand>.md.

🤖 Generated with Claude Code

@coderabbitai review

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Walkthrough

Adds npm v3 lockfile target-level dependency scoping. Workspace build targets are mapped to root-relative lockfile paths, scoped graphs prune unrelated entries, and linked workspace stubs expand to linked workspace dependencies. Unit and integration tests cover workspace selection, cross-workspace links, nameless roots, and complete repository graphs. Documentation and the changelog describe v3 scoping support.

🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: target-level dependency scoping for npm v3 lockfiles.
Description check	✅ Passed	The description includes the required overview, acceptance criteria, testing plan, risks, metrics, references, and checklist.

Comment @coderabbitai help to get the list of available commands.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@integration-test/Analysis/NpmLockV3WorkspaceSpec.hs`:
- Around line 86-111: Strengthen the dependency assertions in the tests around
apiGraph, cliGraph, sharedGraph, webGraph, and wholeGraph so they require every
expected dependency, not merely allow subsets. Add membership checks for each
workspace’s complete expected dependency set while preserving the exclusions and
linked-workspace version checks, and assert the whole repository graph matches
the full expected dependency set rather than only containing a partial list.

In `@src/Strategy/Node.hs`:
- Around line 333-340: Update manifestToWorkspacePath to propagate the Nothing
result from stripProperPrefix rootDir manifestDir instead of converting it to an
empty path. Preserve the rootDir case and separator normalization for valid
descendants, while ensuring manifests outside the workspace root are excluded
rather than assigned the root workspace key.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info ⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: e914eac3-43e4-474e-8ed8-2b322f35b584

📥 Commits

Reviewing files that changed from the base of the PR and between c45a34a and 36f86b8.

⛔ Files ignored due to path filters (1)

test/Node/testdata/npm-lock-v3-workspaces/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (15)

Changelog.md
docs/references/strategies/languages/nodejs/npm-lockfile.md
integration-test/Analysis/NpmLockV3WorkspaceSpec.hs
spectrometer.cabal
src/Strategy/Node.hs
src/Strategy/Node/Npm/PackageLockV3.hs
test/Node/NodeSpec.hs
test/Node/PackageLockV3Spec.hs
test/Node/testdata/lockfileV3/graphing/nameless-workspace-package-lock.json
test/Node/testdata/lockfileV3/graphing/workspace-links-package-lock.json
test/Node/testdata/npm-lock-v3-workspaces/package.json
test/Node/testdata/npm-lock-v3-workspaces/packages/api-service/package.json
test/Node/testdata/npm-lock-v3-workspaces/packages/cli-tool/package.json
test/Node/testdata/npm-lock-v3-workspaces/packages/shared-utils/package.json
test/Node/testdata/npm-lock-v3-workspaces/packages/web-client/package.json

Thread FoundTargets into the package-lock.json v3 analyzer so --only-target / --exclude-target scope the dependency graph to the selected workspaces, following workspace link entries so sibling workspace deps are attributed with real versions. When all targets are selected (the default) the unscoped whole-repo graph is preserved exactly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Apply two semantics-preserving hlint suggestions in Strategy.Node.Npm.PackageLockV3: move mapMaybe inside concatMap in resolveDirectDeps, and fuse concatMap/map in expandLinks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

A --only-target selection that matched zero root/workspace entries in a v3 lockfile silently fell back to the whole unscoped graph. Honor the user's filter instead (matching v1/v2 behavior): produce an empty graph and emit a warning naming the unmatched targets. The selection logic is lifted into a pure scopedSelection helper shared by buildGraph and analyze; analyze gains a Logger constraint, threaded from its caller in Strategy.Node. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…-workspace link resolution Replace matching build target names against lockfile entries' "name" fields with resolving target names to root-relative workspace paths via package.json manifests (resolveNpmV3WorkspacePaths, adopted from #1734) and matching the lockfile's top-level path keys. npm omits a workspace entry's "name" when the folder basename equals the package name, so name matching silently failed there; path matching does not. Kept from this branch: cross-workspace link expansion (expandLinks), all-selected == unscoped equivalence, and empty graph + warning when the filter matches no root/workspace entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…root key

nficca mentioned this pull request Jul 24, 2026

[ANE-3062] Support workspace target scoping for npm v3 lockfiles #1734

Closed

6 tasks

zlav marked this pull request as ready for review July 24, 2026 14:54

zlav requested a review from a team as a code owner July 24, 2026 14:54

zlav requested a review from csasarak July 24, 2026 14:54

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread integration-test/Analysis/NpmLockV3WorkspaceSpec.hs

Comment thread src/Strategy/Node.hs Outdated

nficca approved these changes Jul 24, 2026

View reviewed changes

zlav and others added 7 commits July 26, 2026 11:52

Fill in changelog PR link

c8b52c5

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Satisfy hlint: fuse map/concatMap in PackageLockV3

c6ac904

Apply two semantics-preserving hlint suggestions in Strategy.Node.Npm.PackageLockV3: move mapMaybe inside concatMap in resolveDirectDeps, and fuse concatMap/map in expandLinks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Satisfy hlint: use tuple-section in resolveNpmV3WorkspacePaths

d75d52d

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

[ANE-3062] Drop out-of-root manifests instead of mapping them to the …

66ca366

…root key

nficca force-pushed the npm-lockfile-v3-target-scoping branch from 5d38f2c to 66ca366 Compare July 26, 2026 15:59

nficca merged commit b5d4104 into master Jul 26, 2026
19 checks passed

nficca deleted the npm-lockfile-v3-target-scoping branch July 26, 2026 16:21

Npm: support target-level dependency scoping for v3 lockfiles by zlav · Pull Request #1732 · fossas/fossa-cli · GitHub

Uh oh!

Npm: support target-level dependency scoping for v3 lockfiles - #1732

Npm: support target-level dependency scoping for v3 lockfiles#1732
nficca merged 7 commits into
masterfrom
npm-lockfile-v3-target-scoping

zlav commented Jul 23, 2026 •
edited
Loading

Uh oh!

Uh oh!

nficca commented Jul 24, 2026

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Npm: support target-level dependency scoping for v3 lockfiles by zlav · Pull Request #1732 · fossas/fossa-cli · GitHub

Uh oh!

Npm: support target-level dependency scoping for v3 lockfiles - #1732

Npm: support target-level dependency scoping for v3 lockfiles#1732nficca merged 7 commits intomasterfossas/fossa-cli:masterfrom npm-lockfile-v3-target-scopingfossas/fossa-cli:npm-lockfile-v3-target-scopingCopy head branch name to clipboard

Conversation

zlav commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Acceptance criteria

Testing plan

Risks

Metrics

References

Checklist

Uh oh!

nficca commented Jul 24, 2026

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Npm: support target-level dependency scoping for v3 lockfiles#1732
nficca merged 7 commits into
masterfrom
npm-lockfile-v3-target-scoping

zlav commented Jul 23, 2026 •
edited
Loading

coderabbitai Bot commented Jul 24, 2026 •
edited
Loading

coderabbitai Bot commented Jul 24, 2026 •
edited
Loading