eslint-plugin-sonarjs 4.0.2 → 4.1.0

package/cjs/helpers/assertions.js

@@ -0,0 +1,285 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractTestAssertion = extractTestAssertion;
+const ast_js_1 = require("./ast.js");
+const assertions_chai_js_1 = require("./assertions-chai.js");
+const assertions_cypress_js_1 = require("./assertions-cypress.js");
+const module_js_1 = require("./module.js");
+const JEST_LIKE_MODULES = ['vitest', 'bun:test', '@jest/globals'];
+// Jest-like test runners which expose global methods that can be used in assertions
+const JEST_LIKE_GLOBAL_MODULES = ['jest'];
+const JASMINE_MODULES = ['jasmine'];
+const JASMINE_GLOBAL_MODULES = ['jasmine', 'jasmine-core', 'jasmine-node', 'karma-jasmine'];
+const PLAYWRIGHT_MODULES = ['@playwright/test'];
+const CHAI_LIKE_GLOBAL_MODULES = [
+    'chai',
+    'chai/register-assert',
+    'chai/register-expect',
+    'chai/register-should',
+    'cypress',
+];
+const NODE_ASSERT_MODULES = ['assert', 'node:assert', 'assert/strict', 'node:assert/strict'];
+/**
+ * Maps common Jest matcher names to their corresponding assertion predicates.
+ * Also covers Jest-compatible assertion libraries like Vitest, Bun's test runner, etc.
+ * https://jestjs.io/docs/expect
+ */
+const JEST_PREDICATES_MAPPING = {
+    toBeTruthy: 'truthy',
+    toBeFalsy: 'falsy',
+    toBeDefined: 'defined',
+    toBeUndefined: 'undefined',
+    toBeNull: 'null',
+};
+function extractTestAssertion(context, node) {
+    // covers Jest-like assertion libraries
+    if ((0, module_js_1.importsOrDependsOnModule)(context, JEST_LIKE_MODULES, JEST_LIKE_GLOBAL_MODULES)) {
+        const assertion = extractExpectAssertion(node, 'jest-like');
+        if (assertion) {
+            return assertion;
+        }
+    }
+    // covers Jasmine's Jest-like assertion shape
+    if ((0, module_js_1.importsOrDependsOnModule)(context, JASMINE_MODULES, JASMINE_GLOBAL_MODULES)) {
+        const assertion = extractExpectAssertion(node, 'jasmine');
+        if (assertion) {
+            return assertion;
+        }
+    }
+    // covers Playwright's generic `expect(...).toBe()/toEqual()` shape
+    if ((0, module_js_1.importsOrDependsOnModule)(context, PLAYWRIGHT_MODULES, PLAYWRIGHT_MODULES)) {
+        const assertion = extractExpectAssertion(node, 'playwright');
+        if (assertion) {
+            return assertion;
+        }
+    }
+    // covers Chai-like assertion libraries (including Cypress expect/assert and cy.wrap().should() chains)
+    if ((0, module_js_1.importsOrDependsOnModule)(context, CHAI_LIKE_GLOBAL_MODULES, CHAI_LIKE_GLOBAL_MODULES)) {
+        const assertion = (0, assertions_chai_js_1.extractChaiAssertion)(context, node, true) ?? (0, assertions_cypress_js_1.extractCypressChainAssertion)(node);
+        if (assertion) {
+            return assertion;
+        }
+    }
+    // covers Node.js assert
+    if (node.type === 'CallExpression' && (0, module_js_1.importsModule)(context, NODE_ASSERT_MODULES)) {
+        return extractNodeJSAssertion(context, node);
+    }
+    return null;
+}
+function extractExpectAssertion(expectCall, style) {
+    if (expectCall.type !== 'CallExpression') {
+        return null;
+    }
+    if (!(0, ast_js_1.isMethodCall)(expectCall)) {
+        return null;
+    }
+    const matcher = expectCall.callee.property;
+    const chain = extractExpectChain(expectCall.callee.object);
+    if (!chain) {
+        return null;
+    }
+    const actual = getArgumentAtIndex(chain.expectCall, 0);
+    if (!actual) {
+        return null;
+    }
+    const predicate = JEST_PREDICATES_MAPPING[matcher.name];
+    if (predicate !== undefined && expectCall.arguments.length === 0) {
+        return {
+            style,
+            kind: 'predicate',
+            predicate,
+            actual,
+            negated: chain.negated,
+            node: expectCall,
+            reportNode: actual,
+        };
+    }
+    const comparison = getJestComparison(matcher.name);
+    if (comparison && expectCall.arguments.length === 1) {
+        const expected = getArgumentAtIndex(expectCall, 0);
+        if (!expected) {
+            return null;
+        }
+        return {
+            style,
+            kind: 'comparison',
+            comparison,
+            actual,
+            expected,
+            negated: chain.negated,
+            node: expectCall,
+            reportNode: matcher,
+        };
+    }
+    return null;
+}
+function getJestComparison(name) {
+    switch (name) {
+        case 'toBe':
+            return 'strict';
+        case 'toEqual':
+        case 'toStrictEqual':
+            return 'deep';
+        default:
+            return null;
+    }
+}
+function extractExpectChain(node) {
+    let current = node;
+    let negated = false;
+    while (current.type === 'MemberExpression' && !current.computed) {
+        // covers cases like `expect(value).not.toBeTruthy()` where the presence of `.not` negates the assertion
+        // also guards against invalid chains like `expect(value).toBeTruthy.not`
+        if (negated || !(0, ast_js_1.isIdentifier)(current.property, 'not')) {
+            return null;
+        }
+        negated = true;
+        current = current.object;
+    }
+    // guards against invalid expect chains
+    // like `expect(value).toBeTruthy` (missing call)
+    if (current.type !== 'CallExpression' ||
+        current.arguments.length !== 1 ||
+        !(0, ast_js_1.isIdentifier)(current.callee, 'expect')) {
+        return null;
+    }
+    return { expectCall: current, negated };
+}
+function extractNodeJSAssertion(context, node) {
+    const assertCall = getNodeJSAssertCall(context, node);
+    if (!assertCall) {
+        return null;
+    }
+    if (assertCall.method === 'assert' || assertCall.method === 'ok') {
+        const actual = getArgumentAtIndex(node, 0);
+        if (!actual) {
+            return null;
+        }
+        return {
+            style: 'node-assert',
+            kind: 'predicate',
+            predicate: 'truthy',
+            actual,
+            negated: false,
+            node,
+            reportNode: actual,
+        };
+    }
+    const actual = getArgumentAtIndex(node, 0);
+    const expected = getArgumentAtIndex(node, 1);
+    if (!actual || !expected) {
+        return null;
+    }
+    return {
+        style: 'node-assert',
+        kind: 'comparison',
+        comparison: getNodeJSComparison(assertCall.method),
+        actual,
+        expected,
+        negated: assertCall.method.startsWith('not'),
+        node,
+        reportNode: assertCall.reportNode,
+    };
+}
+function getNodeJSComparison(method) {
+    switch (method) {
+        case 'deepStrictEqual':
+        case 'notDeepStrictEqual':
+        case 'deepEqual':
+        case 'notDeepEqual':
+            return 'deep';
+        case 'looseDeepEqual':
+        case 'looseNotDeepEqual':
+            return 'loose';
+        default:
+            return 'strict';
+    }
+}
+function getNodeJSAssertCall(context, node) {
+    // fully qualified assert method like `assert.strictEqual()`
+    const fqn = (0, module_js_1.getFullyQualifiedName)(context, node.callee);
+    const fqnMethod = getNodeJSAssertMethodFromFqn(fqn);
+    if (fqnMethod) {
+        return {
+            method: normalizeNodeJSAssertMethod(fqnMethod, isStrictNodeJSAssertFqn(fqn)),
+            reportNode: node.callee,
+        };
+    }
+    // assert method from destructured import like `const { strictEqual } = require('assert');`
+    if ((0, ast_js_1.isMethodCall)(node) && (0, ast_js_1.isIdentifier)(node.callee.object, 'assert')) {
+        const method = getNodeJSAssertMethodFromName(node.callee.property.name);
+        if (method) {
+            return {
+                method: normalizeNodeJSAssertMethod(method, false),
+                reportNode: node.callee.property,
+            };
+        }
+    }
+    return null;
+}
+function normalizeNodeJSAssertMethod(method, isStrictAssert) {
+    if (method === 'deepEqual') {
+        return isStrictAssert ? method : 'looseDeepEqual';
+    }
+    if (method === 'notDeepEqual') {
+        return isStrictAssert ? method : 'looseNotDeepEqual';
+    }
+    return method;
+}
+function isStrictNodeJSAssertFqn(fqn) {
+    return fqn?.startsWith('assert.strict.') ?? false;
+}
+function getNodeJSAssertMethodFromFqn(fqn) {
+    switch (fqn) {
+        case 'assert':
+        case 'assert.strict':
+            return 'assert';
+        case 'assert.ok':
+        case 'assert.strict.ok':
+            return 'ok';
+        case 'assert.deepEqual':
+        case 'assert.strict.deepEqual':
+            return 'deepEqual';
+        case 'assert.notDeepEqual':
+        case 'assert.strict.notDeepEqual':
+            return 'notDeepEqual';
+        case 'assert.strictEqual':
+        case 'assert.strict.strictEqual':
+            return 'strictEqual';
+        case 'assert.notStrictEqual':
+        case 'assert.strict.notStrictEqual':
+            return 'notStrictEqual';
+        case 'assert.deepStrictEqual':
+        case 'assert.strict.deepStrictEqual':
+            return 'deepStrictEqual';
+        case 'assert.notDeepStrictEqual':
+        case 'assert.strict.notDeepStrictEqual':
+            return 'notDeepStrictEqual';
+        default:
+            return null;
+    }
+}
+/**
+ * covers cases like `const { strictEqual } = require('assert'); strictEqual(...)` or `import { strictEqual } from 'assert'; strictEqual(...)`
+ */
+function getNodeJSAssertMethodFromName(name) {
+    switch (name) {
+        case 'ok':
+        case 'deepEqual':
+        case 'notDeepEqual':
+        case 'strictEqual':
+        case 'notStrictEqual':
+        case 'deepStrictEqual':
+        case 'notDeepStrictEqual':
+            return name;
+        default:
+            return null;
+    }
+}
+function getArgumentAtIndex(node, index) {
+    const argument = node.arguments[index];
+    if (!argument || argument.type === 'SpreadElement') {
+        return null;
+    }
+    return argument;
+}

package/cjs/helpers/ast.js

@@ -21,6 +21,7 @@ exports.isMethodCall = isMethodCall;
 exports.isCallingMethod = isCallingMethod;
 exports.isModuleExports = isModuleExports;
 exports.isFunctionNode = isFunctionNode;
+exports.isOnEnclosingTemplateDelimiterLine = isOnEnclosingTemplateDelimiterLine;
 exports.isLiteral = isLiteral;
 exports.isNullLiteral = isNullLiteral;
 exports.isFalseLiteral = isFalseLiteral;
@@ -29,6 +30,7 @@ exports.isElementWrite = isElementWrite;
 exports.isReferenceTo = isReferenceTo;
 exports.getUniqueWriteUsage = getUniqueWriteUsage;
 exports.getUniqueWriteReference = getUniqueWriteReference;
+exports.collectReferences = collectReferences;
 exports.getUniqueWriteUsageOrNode = getUniqueWriteUsageOrNode;
 exports.getValueOfExpression = getValueOfExpression;
 exports.getLhsVariable = getLhsVariable;
@@ -42,6 +44,7 @@ exports.resolveFromFunctionReference = resolveFromFunctionReference;
 exports.resolveFunction = resolveFunction;
 exports.checkSensitiveCall = checkSensitiveCall;
 exports.isStringLiteral = isStringLiteral;
+exports.hasStringFirstArgument = hasStringFirstArgument;
 exports.isBooleanLiteral = isBooleanLiteral;
 exports.isNumberLiteral = isNumberLiteral;
 exports.isRegexLiteral = isRegexLiteral;
@@ -166,6 +169,18 @@ function isModuleExports(node) {
 function isFunctionNode(node) {
     return exports.FUNCTION_NODES.includes(node.type);
 }
+/**
+ * Returns whether a node shares its start or end line with an enclosing
+ * template literal.
+ */
+function isOnEnclosingTemplateDelimiterLine(node) {
+    if (!node.loc) {
+        return false;
+    }
+    const enclosingTemplate = (0, ancestor_js_1.findFirstMatchingAncestor)(node, ancestor => ancestor.type === 'TemplateLiteral');
+    return (node.loc.start.line === enclosingTemplate?.loc?.start.line ||
+        node.loc.end.line === enclosingTemplate?.loc?.end.line);
+}
 // we have similar function in eslint-plugin-sonarjs, however this one accepts null
 // eventually we should update eslint-plugin-sonarjs
 function isLiteral(n) {
@@ -188,7 +203,7 @@ function isUndefined(node) {
  *  myObj.prop1 += 3;
  */
 function isElementWrite(statement, ref, recursive = true) {
-    if (statement.expression.type === 'AssignmentExpression') {
+    if (statement.expression?.type === 'AssignmentExpression') {
         const assignmentExpression = statement.expression;
         const lhs = assignmentExpression.left;
         return isMemberExpressionReference(lhs, ref, recursive);
@@ -216,6 +231,15 @@ function getUniqueWriteReference(variable) {
     }
     return undefined;
 }
+/**
+ * Returns all read references reachable from `scope`, including nested scopes.
+ */
+function collectReferences(scope) {
+    return [
+        ...scope.references.filter(reference => reference.isRead()),
+        ...scope.childScopes.flatMap(collectReferences),
+    ];
+}
 function getUniqueWriteUsageOrNode(context, node, recursive = false) {
     if (node.type === 'Identifier') {
         const usage = getUniqueWriteUsage(context, node.name, node);
@@ -448,6 +472,12 @@ function checkSensitiveCall(context, callExpression, sensitiveArgumentIndex, sen
 function isStringLiteral(node) {
     return isLiteral(node) && typeof node.value === 'string';
 }
+// checks if a call expression has a string literal as first argument
+function hasStringFirstArgument(node) {
+    const firstArgument = node.arguments[0];
+    return (firstArgument !== undefined &&
+        (isStringLiteral(firstArgument) || firstArgument.type === 'TemplateLiteral'));
+}
 function isBooleanLiteral(node) {
     return isLiteral(node) && typeof node.value === 'boolean';
 }

package/cjs/helpers/cache.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ComputedCache = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/chai.js

@@ -11,7 +11,7 @@ const module_ts_js_1 = require("./module-ts.js");
 const ast_js_1 = require("./ast.js");
 const typescript_1 = __importDefault(require("typescript"));
 function isImported(context) {
-    return ((0, module_js_1.getRequireCalls)(context).some(r => r.arguments[0].type === 'Literal' && r.arguments[0].value === 'chai') || (0, module_js_1.getImportDeclarations)(context).some(i => i.source.value === 'chai'));
+    return (0, module_js_1.importsModule)(context, ['chai']);
 }
 function isTSAssertion(services, node) {
     if (node.kind !== typescript_1.default.SyntaxKind.CallExpression) {

package/cjs/helpers/collection.js

@@ -5,11 +5,11 @@ exports.flatMap = flatMap;
 exports.last = last;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/configs.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defaultOptions = defaultOptions;
-exports.applyTransformations = applyTransformations;
+exports.materializeRuleOptions = materializeRuleOptions;
+exports.mergeRuleOptions = mergeRuleOptions;
+exports.isObjectLike = isObjectLike;
 function defaultOptions(configuration) {
     return configuration?.map(element => {
         if (Array.isArray(element)) {
@@ -12,6 +14,40 @@ function defaultOptions(configuration) {
         }
     });
 }
+function materializeRuleOptions(ruleMeta, ruleModule, configurations = []) {
+    const mergedOptions = mergeRuleOptions(ruleModule?.meta?.defaultOptions, ruleMeta?.fields ? defaultOptions(ruleMeta.fields) : undefined, configurations);
+    return ruleMeta?.fields ? applyTransformations(ruleMeta.fields, mergedOptions) : mergedOptions;
+}
+function mergeRuleOptions(...optionSets) {
+    const mergedOptions = [];
+    for (const optionSet of optionSets) {
+        optionSet?.forEach((option, index) => {
+            if (option !== undefined) {
+                mergedOptions[index] = mergeRuleOptionValue(mergedOptions[index], option);
+            }
+        });
+    }
+    return mergedOptions;
+}
+function mergeRuleOptionValue(base, override) {
+    if (Array.isArray(override)) {
+        return override;
+    }
+    if (isObjectLike(base) && isObjectLike(override)) {
+        const mergedEntries = Object.entries(override).map(([key, value]) => [
+            key,
+            mergeRuleOptionValue(base[key], value),
+        ]);
+        return {
+            ...base,
+            ...Object.fromEntries(mergedEntries),
+        };
+    }
+    return override;
+}
+function isObjectLike(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /**
  * Applies `customForConfiguration` transformations to merged configuration values.
  *
@@ -93,8 +129,8 @@ function applyTransformations(fields, mergedValues) {
             // fieldDefinition is a single property: { default, customForConfiguration, ... }
             // mergedConfigEntry is a scalar value (string, number, boolean)
             //
-            // Example — S1441 fieldDefinition = { default: 'single', customDefault: true, customForConfiguration: (v) => v ? 'single' : 'double' }
-            // mergedConfigEntry = true (boolean from SQ)
+            // Example — S1441 fieldDefinition = { default: 'single', customForConfiguration: (v) => ... }
+            // mergedConfigEntry = 'true' (string from SQ)
             // After transform: 'single' (string expected by ESLint quotes rule)
             return fieldDefinition.customForConfiguration(mergedConfigEntry);
         }

package/cjs/helpers/cypress.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAssertion = isAssertion;
+exports.isTSAssertion = isTSAssertion;
+exports.chainStartsWithCy = chainStartsWithCy;
+const ast_js_1 = require("./ast.js");
+const typescript_1 = __importDefault(require("typescript"));
+const ASSERTION_METHODS = ['should', 'and'];
+/**
+ * Detects Cypress assertion calls on the global `cy` chain, e.g.:
+ *   cy.get('selector').should('be.visible')
+ *   cy.contains('text').and('have.attr', 'href')
+ *   cy.intercept(...).as(...); cy.wait('@alias').its('foo').should(...)
+ */
+function isAssertion(node) {
+    if (node.type !== 'CallExpression') {
+        return false;
+    }
+    if (node.callee.type !== 'MemberExpression' || node.callee.computed) {
+        return false;
+    }
+    if (!(0, ast_js_1.isIdentifier)(node.callee.property, ...ASSERTION_METHODS)) {
+        return false;
+    }
+    return chainStartsWithCy(node.callee.object);
+}
+function isTSAssertion(node) {
+    if (node.kind !== typescript_1.default.SyntaxKind.CallExpression) {
+        return false;
+    }
+    const call = node;
+    if (call.expression.kind !== typescript_1.default.SyntaxKind.PropertyAccessExpression) {
+        return false;
+    }
+    const member = call.expression;
+    if (!ASSERTION_METHODS.includes(member.name.text)) {
+        return false;
+    }
+    return tsChainStartsWithCy(member.expression);
+}
+function chainStartsWithCy(node) {
+    if ((0, ast_js_1.isIdentifier)(node, 'cy')) {
+        return true;
+    }
+    if (node.type === 'MemberExpression') {
+        return chainStartsWithCy(node.object);
+    }
+    if (node.type === 'CallExpression') {
+        return chainStartsWithCy(node.callee);
+    }
+    if (node.type === 'ChainExpression') {
+        return chainStartsWithCy(node.expression);
+    }
+    return false;
+}
+function tsChainStartsWithCy(node) {
+    if (node.kind === typescript_1.default.SyntaxKind.Identifier) {
+        return node.text === 'cy';
+    }
+    if (node.kind === typescript_1.default.SyntaxKind.PropertyAccessExpression) {
+        return tsChainStartsWithCy(node.expression);
+    }
+    if (node.kind === typescript_1.default.SyntaxKind.CallExpression) {
+        return tsChainStartsWithCy(node.expression);
+    }
+    if (node.kind === typescript_1.default.SyntaxKind.NonNullExpression) {
+        return tsChainStartsWithCy(node.expression);
+    }
+    return false;
+}

package/cjs/helpers/dependency-manifests/all-in-parent-dirs.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDependencyManifests = exports.getPackageJsonManifestsSanitizePaths = exports.getPackageJsonManifests = void 0;
+const files_js_1 = require("../files.js");
+const index_js_1 = require("./index.js");
+const all_in_parent_dirs_js_1 = require("../find-up/all-in-parent-dirs.js");
+const deno_js_1 = require("./resolvers/deno.js");
+const parsed_dependency_files_js_1 = require("./parsed-dependency-files.js");
+const package_json_js_1 = require("./resolvers/package-json.js");
+/**
+ * Returns the project manifests that are used to resolve the dependencies imported by
+ * the module named `filename`, up to the passed working directory.
+ */
+const getPackageJsonManifests = (dir, topDir, fileSystem) => {
+    const files = all_in_parent_dirs_js_1.patternInParentsCache
+        .get(index_js_1.PACKAGE_JSON, fileSystem)
+        .get(topDir ?? (0, files_js_1.getPathRoot)(dir))
+        .get(dir);
+    return files.map(file => (0, parsed_dependency_files_js_1.parsePackageJson)(file) ?? {});
+};
+exports.getPackageJsonManifests = getPackageJsonManifests;
+const getPackageJsonManifestsSanitizePaths = (context, fileSystem) => {
+    return (0, exports.getPackageJsonManifests)((0, files_js_1.dirnamePath)((0, files_js_1.normalizeToAbsolutePath)(context.filename)), (0, files_js_1.normalizeToAbsolutePath)(context.cwd), fileSystem);
+};
+exports.getPackageJsonManifestsSanitizePaths = getPackageJsonManifestsSanitizePaths;
+/**
+ * Registry of manifest resolvers. Add a new entry here to support a new package manager
+ * or manifest format (e.g., Bun).
+ */
+const MANIFEST_RESOLVERS = [deno_js_1.denoManifestResolver, package_json_js_1.packageJsonManifestResolver];
+/**
+ * Returns dependency manifest files from closest-to-file and then up to root.
+ *
+ * For each directory, at most one Deno manifest is selected (`deno.json` > `deno.jsonc`)
+ * and `package.json` is always included when present.
+ */
+const getDependencyManifests = (dir, topDir, fileSystem) => {
+    const rootDir = topDir ?? (0, files_js_1.getPathRoot)(dir);
+    const manifests = [];
+    let currentDir = dir;
+    do {
+        const manifestsInDir = MANIFEST_RESOLVERS.flatMap(manifestResolver => manifestResolver.resolve(currentDir, rootDir, fileSystem));
+        logDuplicateDependenciesInManifests(manifestsInDir);
+        manifests.push(...manifestsInDir);
+        if (currentDir === rootDir || (0, files_js_1.isRoot)(currentDir)) {
+            break;
+        }
+        currentDir = (0, files_js_1.dirnamePath)(currentDir);
+    } while (true);
+    return manifests;
+};
+exports.getDependencyManifests = getDependencyManifests;
+/**
+ * Checks for duplicate dependencies across manifests and logs them.
+ */
+function logDuplicateDependenciesInManifests(manifests) {
+    const dependencyDefinitions = new Map();
+    for (const { dependencies, type: manifestType } of manifests) {
+        const dependenciesByNameInManifest = new Map();
+        for (const [name, version] of dependencies) {
+            if (typeof name !== 'string') {
+                continue;
+            }
+            dependenciesByNameInManifest.set(name, version);
+        }
+        for (const [dependencyName, version] of dependenciesByNameInManifest) {
+            const firstDefinition = dependencyDefinitions.get(dependencyName);
+            if (firstDefinition) {
+                logDuplicateDependencyDefinition(dependencyName, firstDefinition, {
+                    manifestType,
+                    version,
+                });
+                continue;
+            }
+            dependencyDefinitions.set(dependencyName, { manifestType, version });
+        }
+    }
+}
+function logDuplicateDependencyDefinition(dependencyName, firstDefinition, secondDefinition) {
+    if (firstDefinition.version === secondDefinition.version) {
+        console.debug(`Dependency "${dependencyName}" is defined in multiple manifests ` +
+            `(${firstDefinition.manifestType}, ${secondDefinition.manifestType}).`);
+    }
+    else {
+        console.debug(`Dependency "${dependencyName}" is defined in multiple manifests with different versions ` +
+            `(${firstDefinition.manifestType}: ${formatVersion(firstDefinition.version)}, ` +
+            `${secondDefinition.manifestType}: ${formatVersion(secondDefinition.version)}).`);
+    }
+}
+function formatVersion(version) {
+    return version ?? '<unspecified>';
+}

package/cjs/helpers/dependency-manifests/closest.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClosestDependencyManifestDir = getClosestDependencyManifestDir;
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+const files_js_1 = require("../files.js");
+const index_js_1 = require("./index.js");
+const closest_js_1 = require("../find-up/closest.js");
+/**
+ * Finds the closest directory containing at least one dependency manifest.
+ */
+function getClosestDependencyManifestDir(dir, topDir) {
+    let closestManifestPath;
+    for (const manifestName of index_js_1.DEPENDENCY_MANIFESTS) {
+        const manifestPath = closest_js_1.closestPatternCache
+            .get(manifestName)
+            .get(topDir ?? (0, files_js_1.getPathRoot)(dir))
+            .get(dir)?.filePath;
+        // All candidates are on the same ancestor chain of `dir`, so the longest path is the closest.
+        if (manifestPath &&
+            (!closestManifestPath || manifestPath.length > closestManifestPath.length)) {
+            closestManifestPath = manifestPath;
+        }
+    }
+    return closestManifestPath ? (0, files_js_1.dirnamePath)(closestManifestPath) : undefined;
+}