@npmcli/arborist 5.0.5 → 5.1.1

package/lib/arborist/build-ideal-tree.js

@@ -124,6 +124,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       globalStyle = false,
       idealTree = null,
       includeWorkspaceRoot = false,
+      installLinks = false,
       legacyPeerDeps = false,
       packageLock = true,
       strictPeerDeps = false,
@@ -135,6 +136,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_strictPeerDeps] = !!strictPeerDeps
 
     this.idealTree = idealTree
+    this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
     this[_usePackageLock] = packageLock
@@ -410,6 +412,7 @@ Try using the package name instead, e.g:
       peer: false,
       optional: false,
       global: this[_global],
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       loadOverrides: true,
     })
@@ -424,6 +427,7 @@ Try using the package name instead, e.g:
         peer: false,
         optional: false,
         global: this[_global],
+        installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
         root,
       })
@@ -992,6 +996,7 @@ This is a one-time fix-up, please be patient...
         preferDedupe: this[_preferDedupe],
         legacyBundling: this[_legacyBundling],
         strictPeerDeps: this[_strictPeerDeps],
+        installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
         globalStyle: this[_globalStyle],
       }))
@@ -1151,6 +1156,7 @@ This is a one-time fix-up, please be patient...
     const vr = new Node({
       path: node.realpath,
       sourceReference: node,
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       overrides: node.overrides,
     })
@@ -1268,17 +1274,18 @@ This is a one-time fix-up, please be patient...
     // the object so it doesn't get mutated.
     // Don't bother to load the manifest for link deps, because the target
     // might be within another package that doesn't exist yet.
-    const { legacyPeerDeps } = this
+    const { installLinks, legacyPeerDeps } = this
+    const isWorkspace = this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)
 
-    // spec is a directory, link it
-    if (spec.type === 'directory') {
+    // spec is a directory, link it unless installLinks is set or it's a workspace
+    if (spec.type === 'directory' && (isWorkspace || !installLinks)) {
       return this[_linkFromSpec](name, spec, parent, edge)
     }
 
     // if the spec matches a workspace name, then see if the workspace node will
     // satisfy the edge. if it does, we return the workspace node to make sure it
     // takes priority.
-    if (this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)) {
+    if (isWorkspace) {
       const existingNode = this.idealTree.edgesOut.get(spec.name).to
       if (existingNode && existingNode.isWorkspace && existingNode.satisfies(edge)) {
         return edge.to
@@ -1288,7 +1295,7 @@ This is a one-time fix-up, please be patient...
     // spec isn't a directory, and either isn't a workspace or the workspace we have
     // doesn't satisfy the edge. try to fetch a manifest and build a node from that.
     return this[_fetchManifest](spec)
-      .then(pkg => new Node({ name, pkg, parent, legacyPeerDeps }), error => {
+      .then(pkg => new Node({ name, pkg, parent, installLinks, legacyPeerDeps }), error => {
         error.requiredBy = edge.from.location || '.'
 
         // failed to load the spec, either because of enotarget or
@@ -1298,6 +1305,7 @@ This is a one-time fix-up, please be patient...
           name,
           parent,
           error,
+          installLinks,
           legacyPeerDeps,
         })
         this[_loadFailures].add(n)
@@ -1307,9 +1315,9 @@ This is a one-time fix-up, please be patient...
 
   [_linkFromSpec] (name, spec, parent, edge) {
     const realpath = spec.fetchSpec
-    const { legacyPeerDeps } = this
+    const { installLinks, legacyPeerDeps } = this
     return rpj(realpath + '/package.json').catch(() => ({})).then(pkg => {
-      const link = new Link({ name, parent, realpath, pkg, legacyPeerDeps })
+      const link = new Link({ name, parent, realpath, pkg, installLinks, legacyPeerDeps })
       this[_linkNodes].add(link)
       return link
     })

package/lib/arborist/load-actual.js

@@ -283,6 +283,7 @@ module.exports = cls => class ActualLoader extends cls {
       .then(pkg => [pkg, null], error => [null, error])
       .then(([pkg, error]) => {
         return this[normalize(path) === real ? _newNode : _newLink]({
+          installLinks: this.installLinks,
           legacyPeerDeps: this.legacyPeerDeps,
           path,
           realpath: real,

package/lib/arborist/load-virtual.js

@@ -278,6 +278,7 @@ module.exports = cls => class VirtualLoader extends cls {
     const peer = sw.peer
 
     const node = new Node({
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       root: this.virtualTree,
       path,
@@ -304,6 +305,7 @@ module.exports = cls => class VirtualLoader extends cls {
   [loadLink] (location, targetLoc, target, meta) {
     const path = resolve(this.path, location)
     const link = new Link({
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       path,
       realpath: resolve(this.path, targetLoc),

package/lib/audit-report.js

@@ -134,16 +134,7 @@ class AuditReport extends Map {
     const seen = new Set()
     for (const advisory of advisories) {
       const { name, range } = advisory
-
-      // don't flag the exact same name/range more than once
-      // adding multiple advisories with the same range is fine, but no
-      // need to search for nodes we already would have added.
       const k = `${name}@${range}`
-      if (seen.has(k)) {
-        continue
-      }
-
-      seen.add(k)
 
       const vuln = this.get(name) || new Vuln({ name, advisory })
       if (this.has(name)) {
@@ -151,44 +142,50 @@ class AuditReport extends Map {
       }
       super.set(name, vuln)
 
-      const p = []
-      for (const node of this.tree.inventory.query('packageName', name)) {
-        if (!shouldAudit(node, this[_omit], this.filterSet)) {
-          continue
-        }
+      // don't flag the exact same name/range more than once
+      // adding multiple advisories with the same range is fine, but no
+      // need to search for nodes we already would have added.
+      if (!seen.has(k)) {
+        const p = []
+        for (const node of this.tree.inventory.query('packageName', name)) {
+          if (!shouldAudit(node, this[_omit], this.filterSet)) {
+            continue
+          }
 
-        // if not vulnerable by this advisory, keep searching
-        if (!advisory.testVersion(node.version)) {
-          continue
-        }
+          // if not vulnerable by this advisory, keep searching
+          if (!advisory.testVersion(node.version)) {
+            continue
+          }
 
-        // we will have loaded the source already if this is a metavuln
-        if (advisory.type === 'metavuln') {
-          vuln.addVia(this.get(advisory.dependency))
-        }
+          // we will have loaded the source already if this is a metavuln
+          if (advisory.type === 'metavuln') {
+            vuln.addVia(this.get(advisory.dependency))
+          }
 
-        // already marked this one, no need to do it again
-        if (vuln.nodes.has(node)) {
-          continue
-        }
+          // already marked this one, no need to do it again
+          if (vuln.nodes.has(node)) {
+            continue
+          }
 
-        // haven't marked this one yet.  get its dependents.
-        vuln.nodes.add(node)
-        for (const { from: dep, spec } of node.edgesIn) {
-          if (dep.isTop && !vuln.topNodes.has(dep)) {
-            this[_checkTopNode](dep, vuln, spec)
-          } else {
+          // haven't marked this one yet.  get its dependents.
+          vuln.nodes.add(node)
+          for (const { from: dep, spec } of node.edgesIn) {
+            if (dep.isTop && !vuln.topNodes.has(dep)) {
+              this[_checkTopNode](dep, vuln, spec)
+            } else {
             // calculate a metavuln, if necessary
-            const calc = this.calculator.calculate(dep.packageName, advisory)
-            p.push(calc.then(meta => {
-              if (meta.testVersion(dep.version, spec)) {
-                advisories.add(meta)
-              }
-            }))
+              const calc = this.calculator.calculate(dep.packageName, advisory)
+              p.push(calc.then(meta => {
+                if (meta.testVersion(dep.version, spec)) {
+                  advisories.add(meta)
+                }
+              }))
+            }
           }
         }
+        await Promise.all(p)
+        seen.add(k)
       }
-      await Promise.all(p)
 
       // make sure we actually got something.  if not, remove it
       // this can happen if you are loading from a lockfile created by

package/lib/dep-valid.js

@@ -53,9 +53,7 @@ const depValid = (child, requested, requestor) => {
       return semver.satisfies(child.version, requested.fetchSpec, true)
 
     case 'directory':
-      // directory must be a link to the specified folder
-      return !!child.isLink &&
-        relative(child.realpath, requested.fetchSpec) === ''
+      return linkValid(child, requested, requestor)
 
     case 'file':
       return tarballValid(child, requested, requestor)
@@ -108,6 +106,18 @@ const depValid = (child, requested, requestor) => {
   return false
 }
 
+const linkValid = (child, requested, requestor) => {
+  const isLink = !!child.isLink
+  // if we're installing links and the node is a link, then it's invalid because we want
+  // a real node to be there
+  if (requestor.installLinks) {
+    return !isLink
+  }
+
+  // directory must be a link to the specified folder
+  return isLink && relative(child.realpath, requested.fetchSpec) === ''
+}
+
 const tarballValid = (child, requested, requestor) => {
   if (child.isLink) {
     return false

package/lib/edge.js

@@ -215,6 +215,11 @@ class Edge {
 
   reload (hard = false) {
     this[_explanation] = null
+    if (this[_from].overrides) {
+      this.overrides = this[_from].overrides.getEdgeRule(this)
+    } else {
+      delete this.overrides
+    }
     const newTo = this[_from].resolve(this.name)
     if (newTo !== this[_to]) {
       if (this[_to]) {

package/lib/node.js

@@ -86,6 +86,7 @@ class Node {
       name,
       children,
       fsChildren,
+      installLinks = false,
       legacyPeerDeps = false,
       linksIn,
       hasShrinkwrap,
@@ -152,6 +153,7 @@ class Node {
     }
     this.integrity = integrity || pkg._integrity || null
     this.hasShrinkwrap = hasShrinkwrap || pkg._hasShrinkwrap || false
+    this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
     this.children = new CaseInsensitiveMap()
@@ -792,6 +794,9 @@ class Node {
       target.root = root
     }
 
+    if (!this.overrides && this.parent && this.parent.overrides) {
+      this.overrides = this.parent.overrides.getNodeRule(this)
+    }
     // tree should always be valid upon root setter completion.
     treeCheck(this)
     treeCheck(root)
@@ -1146,6 +1151,9 @@ class Node {
       for (const kid of node.children.values()) {
         kid.parent = this
       }
+      if (node.isLink && node.target) {
+        node.target.root = null
+      }
     }
 
     if (!node.isRoot) {

package/lib/place-dep.js

@@ -45,6 +45,7 @@ class PlaceDep {
       auditReport,
       legacyBundling,
       strictPeerDeps,
+      installLinks,
       legacyPeerDeps,
       globalStyle,
     } = parent || options
@@ -56,6 +57,7 @@ class PlaceDep {
       auditReport,
       legacyBundling,
       strictPeerDeps,
+      installLinks,
       legacyPeerDeps,
       globalStyle,
     })
@@ -293,6 +295,7 @@ class PlaceDep {
       pkg: dep.package,
       resolved: dep.resolved,
       integrity: dep.integrity,
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       error: dep.errors[0],
       ...(dep.overrides ? { overrides: dep.overrides } : {}),

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@npmcli/arborist",
-  "version": "5.0.5",
+  "version": "5.1.1",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/installed-package-contents": "^1.0.7",
-    "@npmcli/map-workspaces": "^2.0.0",
+    "@npmcli/map-workspaces": "^2.0.3",
     "@npmcli/metavuln-calculator": "^3.0.1",
     "@npmcli/move-file": "^2.0.0",
     "@npmcli/name-from-folder": "^1.0.1",
@@ -13,7 +13,7 @@
     "@npmcli/package-json": "^2.0.0",
     "@npmcli/run-script": "^3.0.0",
     "bin-links": "^3.0.0",
-    "cacache": "^16.0.0",
+    "cacache": "^16.0.6",
     "common-ancestor-path": "^1.0.1",
     "json-parse-even-better-errors": "^2.3.1",
     "json-stringify-nice": "^1.1.4",
@@ -24,7 +24,7 @@
     "npm-package-arg": "^9.0.0",
     "npm-pick-manifest": "^7.0.0",
     "npm-registry-fetch": "^13.0.0",
-    "npmlog": "^6.0.1",
+    "npmlog": "^6.0.2",
     "pacote": "^13.0.5",
     "parse-conflict-json": "^2.0.1",
     "proc-log": "^2.0.0",
@@ -33,14 +33,14 @@
     "read-package-json-fast": "^2.0.2",
     "readdir-scoped-modules": "^1.1.0",
     "rimraf": "^3.0.2",
-    "semver": "^7.3.5",
+    "semver": "^7.3.7",
     "ssri": "^9.0.0",
     "treeverse": "^2.0.0",
     "walk-up-path": "^1.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.3.2",
+    "@npmcli/template-oss": "3.4.2",
     "benchmark": "^2.1.4",
     "chalk": "^4.1.0",
     "minify-registry-metadata": "^2.1.0",
@@ -101,6 +101,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.3.2"
+    "version": "3.4.2"
   }
 }