Merge pull request #239 from snyk/fix/ignore-optional-deps-if-not-ins…

…talled Fix/ignore optional deps if not installed
snyk · Jul 24, 2024 · 8da13d3 · 8da13d3
2 parents b0f1ab6 + 928e2f2
commit 8da13d3
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 25 deletions.
diff --git a/lib/dep-graph-builders/npm-lock-v2/index.ts b/lib/dep-graph-builders/npm-lock-v2/index.ts
@@ -71,23 +71,22 @@ export const buildDepGraphNpmLockV2 = async (
     key: '',
   };
 
-  const pkgKeysByName: Map<string, string[]> = Object.keys(npmLockPkgs).reduce(
-    (acc, key) => {
-      const name = key.replace(/.*node_modules\//, '');
-      if (!name) {
-        return acc;
-      }
+  const pkgKeysByName: Map<string, string[]> = Object.keys(npmLockPkgs).reduce<
+    Map<string, string[]>
+  >((acc, key) => {
+    const name = key.replace(/.*node_modules\//, '');
+    if (!name) {
+      return acc;
+    }
 
-      if (!acc.has(name)) {
-        acc.set(name, []);
-      }
+    if (!acc.has(name)) {
+      acc.set(name, []);
+    }
 
-      acc.get(name)!.push(key);
+    acc.get(name)!.push(key);
 
-      return acc;
-    },
-    new Map<string, string[]>(),
-  );
+    return acc;
+  }, new Map<string, string[]>());
 
   const visitedMap: Set<string> = new Set();
   await dfsVisit(
@@ -190,7 +189,7 @@ const dfsVisit = async (
 
 const getChildNode = (
   name: string,
-  depInfo: { version: string; isDev: boolean; isPeer: boolean },
+  depInfo: { version: string; isDev: boolean; isPeer: boolean; isOpt: boolean },
   pkgs: Record<string, NpmLockPkg>,
   strictOutOfSync: boolean,
   includeDevDeps: boolean,
@@ -227,7 +226,7 @@ const getChildNode = (
     //    Ignore the dependency as it has not been installed by the developer,
     //    if these dependencies are wanted in the parsing, then they should be locked
     //    in the lockfile
-    if (depInfo.isPeer) {
+    if (depInfo.isPeer || depInfo.isOpt) {
       return;
     } else if (strictOutOfSync) {
       throw new OutOfSyncError(`${name}@${depInfo.version}`, LockfileType.npm);
@@ -284,7 +283,12 @@ const getChildNode = (
     : {};
 
   const optionalDependencies = includeOptionalDeps
-    ? getGraphDependencies(depData.optionalDependencies || {}, depInfo.isDev)
+    ? getGraphDependencies(
+        depData.optionalDependencies || {},
+        depInfo.isDev,
+        false,
+        true,
+      )
     : {};
 
   const peerDeps = includePeerDeps

diff --git a/lib/dep-graph-builders/util.ts b/lib/dep-graph-builders/util.ts
@@ -7,7 +7,7 @@ import { LockfileType } from '../parsers';
 
 export type Dependencies = Record<
   string,
-  { version: string; isDev: boolean; isPeer: boolean }
+  { version: string; isDev: boolean; isPeer: boolean; isOpt: boolean }
 >;
 
 export interface PkgNode {
@@ -80,14 +80,17 @@ export const getGraphDependencies = (
   dependencies: Record<string, string>,
   isDev,
   isPeer?: boolean,
+  isOpt?: boolean,
 ): Dependencies => {
-  return Object.entries(dependencies).reduce(
-    (pnpmDeps: Dependencies, [name, semver]) => {
-      pnpmDeps[name] = { version: semver, isDev: isDev, isPeer: !!isPeer };
-      return pnpmDeps;
-    },
-    {},
-  );
+  return Object.entries(dependencies).reduce((pnpmDeps, [name, semver]) => {
+    pnpmDeps[name] = {
+      version: semver,
+      isDev: isDev,
+      isPeer: !!isPeer,
+      isOpt: !!isOpt,
+    };
+    return pnpmDeps;
+  }, {} as Dependencies);
 };
 
 export function parsePkgJson(pkgJsonContent: string): PackageJsonBase {