nx 23.1.0 → 23.1.2

package/dist/src/plugins/js/lock-file/npm-parser.js

@@ -133,6 +133,22 @@ function findV3Version(snapshot, packageName) {
 }
 function getDependencies(data, keyMap, ctx) {
     const dependencies = [];
+    // Memoizes semver `satisfies(version, range)` for this dependency walk. The
+    // same (version, range) pairs recur across many edges, so the range parse
+    // happens once per distinct pair instead of once per edge. Scoped to the walk
+    // (not module-global) so V8 collects it when dependency creation finishes
+    // rather than retaining it for the daemon's lifetime.
+    const versionSatisfiesCache = new Map();
+    const cachedSatisfies = (version, range) => {
+        const key = `${version}\n${range}`;
+        const cached = versionSatisfiesCache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const result = (0, semver_1.satisfies)(version, range);
+        versionSatisfiesCache.set(key, result);
+        return result;
+    };
     if (data.lockfileVersion > 1) {
         Object.entries(data.packages).forEach(([path, snapshot]) => {
             // we are skipping workspaces packages
@@ -147,7 +163,7 @@ function getDependencies(data, keyMap, ctx) {
             ].forEach((section) => {
                 if (section) {
                     Object.entries(section).forEach(([name, versionRange]) => {
-                        const target = findTarget(path, keyMap, name, versionRange);
+                        const target = findTarget(path, keyMap, name, versionRange, cachedSatisfies);
                         if (target) {
                             const dep = {
                                 source: sourceName,
@@ -164,12 +180,12 @@ function getDependencies(data, keyMap, ctx) {
     }
     else {
         Object.entries(data.dependencies).forEach(([packageName, snapshot]) => {
-            addV1NodeDependencies(`node_modules/${packageName}`, snapshot, dependencies, keyMap, ctx);
+            addV1NodeDependencies(`node_modules/${packageName}`, snapshot, dependencies, keyMap, ctx, cachedSatisfies);
         });
     }
     return dependencies;
 }
-function findTarget(sourcePath, keyMap, targetName, versionRange, 
+function findTarget(sourcePath, keyMap, targetName, versionRange, cachedSatisfies, 
 // When a package is found at a path but its version doesn't satisfy the
 // range (e.g. due to npm overrides), we keep it as a fallback. npm already
 // resolved this dependency to that location, so it is the correct target
@@ -186,12 +202,13 @@ fallback) {
             versionRange.startsWith('npm:')) {
             const nodeVersion = child.data.version.slice(child.data.version.indexOf('@', 5) + 1);
             const depVersion = versionRange.slice(versionRange.indexOf('@', 5) + 1);
-            if (nodeVersion === depVersion || (0, semver_1.satisfies)(nodeVersion, depVersion)) {
+            if (nodeVersion === depVersion ||
+                cachedSatisfies(nodeVersion, depVersion)) {
                 return child;
             }
         }
         else if (child.data.version === versionRange ||
-            (0, semver_1.satisfies)(child.data.version, versionRange)) {
+            cachedSatisfies(child.data.version, versionRange)) {
             return child;
         }
         // Version mismatch — save as fallback (could be an npm override)
@@ -203,13 +220,17 @@ fallback) {
     if (!sourcePath) {
         return fallback;
     }
-    return findTarget(sourcePath.split('node_modules/').slice(0, -1).join('node_modules/'), keyMap, targetName, versionRange, fallback);
+    // Walk one level up the nesting chain by dropping the trailing
+    // `node_modules/<pkg>` segment. Slash-index arithmetic avoids the
+    // split/slice/join array allocation on every hop.
+    const lastNodeModules = sourcePath.lastIndexOf('node_modules/');
+    return findTarget(lastNodeModules === -1 ? '' : sourcePath.substring(0, lastNodeModules), keyMap, targetName, versionRange, cachedSatisfies, fallback);
 }
-function addV1NodeDependencies(path, snapshot, dependencies, keyMap, ctx) {
+function addV1NodeDependencies(path, snapshot, dependencies, keyMap, ctx, cachedSatisfies) {
     if (keyMap.has(path) && snapshot.requires) {
         const source = keyMap.get(path).name;
         Object.entries(snapshot.requires).forEach(([name, versionRange]) => {
-            const target = findTarget(path, keyMap, name, versionRange);
+            const target = findTarget(path, keyMap, name, versionRange, cachedSatisfies);
             if (target) {
                 const dep = {
                     source: source,
@@ -223,14 +244,14 @@ function addV1NodeDependencies(path, snapshot, dependencies, keyMap, ctx) {
     }
     if (snapshot.dependencies) {
         Object.entries(snapshot.dependencies).forEach(([depName, depSnapshot]) => {
-            addV1NodeDependencies(`${path}/node_modules/${depName}`, depSnapshot, dependencies, keyMap, ctx);
+            addV1NodeDependencies(`${path}/node_modules/${depName}`, depSnapshot, dependencies, keyMap, ctx, cachedSatisfies);
         });
     }
     const { peerDependencies } = getPeerDependencies(path);
     if (peerDependencies) {
         const node = keyMap.get(path);
         Object.entries(peerDependencies).forEach(([depName, depSpec]) => {
-            const target = findTarget(path, keyMap, depName, depSpec);
+            const target = findTarget(path, keyMap, depName, depSpec, cachedSatisfies);
             if (target) {
                 const dep = {
                     source: node.name,
@@ -358,10 +379,11 @@ function mapSnapshots(rootLockFile, graph) {
     const nestedNodes = new Set();
     const visitedNodes = new Map();
     const remappedPackages = new Map();
+    const packageIndex = buildV3Index(rootLockFile.packages);
     // add first level children
     Object.values(graph.externalNodes).forEach((node) => {
         if (node.name === `npm:${node.data.packageName}`) {
-            const mappedPackage = mapPackage(rootLockFile, node.data.packageName, node.data.version);
+            const mappedPackage = mapPackage(rootLockFile, packageIndex, node.data.packageName, node.data.version);
             remappedPackages.set(mappedPackage.path, mappedPackage);
             visitedNodes.set(node, {
                 packagePaths: new Set([mappedPackage.path]),
@@ -375,7 +397,7 @@ function mapSnapshots(rootLockFile, graph) {
     let remappedPackagesArray;
     if (nestedNodes.size) {
         const invertedGraph = (0, operators_1.reverse)(graph);
-        nestMappedPackages(invertedGraph, remappedPackages, nestedNodes, visitedNodes, rootLockFile);
+        nestMappedPackages(invertedGraph, remappedPackages, nestedNodes, visitedNodes, rootLockFile, packageIndex);
         // initially we naively map package paths to topParent/../parent/child
         // but some of those should be nested higher up the tree
         remappedPackagesArray = elevateNestedPaths(remappedPackages);
@@ -385,14 +407,14 @@ function mapSnapshots(rootLockFile, graph) {
     }
     return remappedPackagesArray.sort((a, b) => a.path.localeCompare(b.path));
 }
-function mapPackage(rootLockFile, packageName, version, parentPath = '') {
+function mapPackage(rootLockFile, packageIndex, packageName, version, parentPath = '') {
     const lockfileVersion = rootLockFile.lockfileVersion;
     let valueV3, valueV1;
     if (lockfileVersion < 3) {
         valueV1 = findMatchingPackageV1(rootLockFile.dependencies, packageName, version);
     }
     if (lockfileVersion > 1) {
-        valueV3 = findMatchingPackageV3(rootLockFile.packages, packageName, version);
+        valueV3 = findMatchingPackageV3(packageIndex, packageName, version);
     }
     return {
         path: parentPath + `node_modules/${packageName}`,
@@ -401,7 +423,7 @@ function mapPackage(rootLockFile, packageName, version, parentPath = '') {
         valueV3,
     };
 }
-function nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, rootLockFile) {
+function nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, rootLockFile, packageIndex) {
     const initialSize = nestedNodes.size;
     if (!initialSize) {
         return;
@@ -421,7 +443,7 @@ function nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, ro
             if (visitedNodes.has(targetNode) &&
                 !visitedNodes.get(targetNode).unresolvedParents.size) {
                 visitedNodes.get(targetNode).packagePaths.forEach((path) => {
-                    const mappedPackage = mapPackage(rootLockFile, node.data.packageName, node.data.version, path + '/');
+                    const mappedPackage = mapPackage(rootLockFile, packageIndex, node.data.packageName, node.data.version, path + '/');
                     result.set(mappedPackage.path, mappedPackage);
                     visitedNodes.get(node).packagePaths.add(mappedPackage.path);
                     visitedNodes.get(node).unresolvedParents.delete(target);
@@ -439,7 +461,7 @@ function nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, ro
         ].join('\n'));
     }
     else {
-        nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, rootLockFile);
+        nestMappedPackages(invertedGraph, result, nestedNodes, visitedNodes, rootLockFile, packageIndex);
     }
 }
 // sort paths by number of segments and then alphabetically
@@ -495,16 +517,38 @@ function elevateNestedPaths(remappedPackages) {
     });
     return Array.from(result.values());
 }
-function findMatchingPackageV3(packages, name, version) {
-    for (const [key, { dev, peer, ...snapshot }] of Object.entries(packages)) {
-        if (key.endsWith(`node_modules/${name}`)) {
-            if ([
-                snapshot.version,
-                snapshot.resolved,
-                `npm:${snapshot.name}@${snapshot.version}`,
-            ].includes(version)) {
-                return snapshot;
-            }
+// Bucket packages by their trailing "node_modules/<name>" segment so a lookup
+// scans only that name's copies instead of every package (was O(nodes *
+// allPackages)). Mirrors the old `key.endsWith(node_modules/<name>)` match:
+// the name is whatever follows the last "node_modules/" in the key.
+function buildV3Index(packages) {
+    const index = new Map();
+    if (!packages)
+        return index;
+    const marker = 'node_modules/';
+    for (const key of Object.keys(packages)) {
+        const i = key.lastIndexOf(marker);
+        if (i === -1)
+            continue; // root "" / workspace paths never matched endsWith
+        const name = key.slice(i + marker.length);
+        let bucket = index.get(name);
+        if (!bucket)
+            index.set(name, (bucket = []));
+        bucket.push(packages[key]);
+    }
+    return index;
+}
+function findMatchingPackageV3(packageIndex, name, version) {
+    const bucket = packageIndex.get(name);
+    if (!bucket)
+        return undefined;
+    for (const { dev, peer, ...snapshot } of bucket) {
+        if ([
+            snapshot.version,
+            snapshot.resolved,
+            `npm:${snapshot.name}@${snapshot.version}`,
+        ].includes(version)) {
+            return snapshot;
         }
     }
 }

package/dist/src/plugins/js/lock-file/pnpm-parser.js

@@ -12,6 +12,7 @@ const file_hasher_1 = require("../../../hasher/file-hasher");
 const catalog_1 = require("../../../utils/catalog");
 const project_graph_pruning_1 = require("./project-graph-pruning");
 const path_1 = require("path");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const get_workspace_packages_from_graph_1 = require("../utils/get-workspace-packages-from-graph");
 const semver_1 = require("semver");
 const WORKSPACE_DEP_TYPES = [
@@ -133,6 +134,17 @@ function findPatchHash(patchEntriesByPackage, packageName, version) {
     const nameOnlyMatch = entries.find((entry) => entry.versionSpecifier === null);
     return nameOnlyMatch?.hash;
 }
+// Segment-aware: `..` and `../x` escape, a directory literally named `..cache`
+// does not. Absolute targets are resolved against the workspace root.
+function linkTargetEscapesWorkspace(importerPath, depVersion) {
+    const rawTarget = depVersion.slice('link:'.length);
+    if (path_1.posix.isAbsolute(rawTarget) || (0, path_1.isAbsolute)(rawTarget)) {
+        const rel = (0, path_1.relative)(workspace_root_1.workspaceRoot, rawTarget);
+        return rel === '..' || rel.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(rel);
+    }
+    const combined = path_1.posix.normalize(path_1.posix.join(importerPath === '.' ? '' : importerPath, rawTarget));
+    return combined === '..' || combined.startsWith('../');
+}
 function getNodes(data, isV5) {
     cachedInvertedRecords.clear();
     const keyMap = new Map();
@@ -142,7 +154,12 @@ function getNodes(data, isV5) {
     if (data.patchedDependencies) {
         for (const specifier of Object.keys(data.patchedDependencies)) {
             const patchInfo = data.patchedDependencies[specifier];
-            if (patchInfo && typeof patchInfo === 'object' && 'hash' in patchInfo) {
+            const patchHash = typeof patchInfo === 'string'
+                ? patchInfo
+                : patchInfo && typeof patchInfo === 'object' && 'hash' in patchInfo
+                    ? patchInfo.hash
+                    : undefined;
+            if (patchHash) {
                 const packageName = extractNameFromKey(specifier, false);
                 const versionSpecifier = getVersion(specifier, packageName) || null;
                 if (!patchEntriesByPackage.has(packageName)) {
@@ -150,7 +167,7 @@ function getNodes(data, isV5) {
                 }
                 patchEntriesByPackage.get(packageName).push({
                     versionSpecifier,
-                    hash: patchInfo.hash,
+                    hash: patchHash,
                 });
             }
         }
@@ -178,7 +195,8 @@ function getNodes(data, isV5) {
         }
     }
     const packageNames = new Set();
-    for (const [key, snapshot] of Object.entries(data.packages)) {
+    // pnpm omits the packages block for workspace-only lockfiles (no external deps)
+    for (const [key, snapshot] of Object.entries(data.packages ?? {})) {
         let packageNameObj;
         const originalPackageName = extractNameFromKey(key, isV5);
         if (!originalPackageName) {
@@ -339,6 +357,54 @@ function getNodes(data, isV5) {
             results[node.name] = node;
         });
     }
+    // `link:` dependencies pointing outside the workspace never appear in the
+    // packages section, so nothing above minted a node for them — and a task
+    // input naming one via `externalDependencies` fails hashing with "could not
+    // be found". Mint a node under the bare `npm:<name>`, hashed on the link
+    // path: the hash changes only when the path does, not when the linked
+    // content does, which is how linked dependencies behave everywhere else in
+    // Nx. Links that resolve inside the workspace are workspace projects, not
+    // externals, and are skipped.
+    //
+    // One node per package name, chosen deterministically by visiting importers
+    // root-first, then lexicographically. An `externalDependencies` input names
+    // a package, not a link target, so it could not distinguish two linked
+    // targets anyway.
+    const importerPaths = Object.keys(data.importers ?? {}).sort((a, b) => a === '.' ? -1 : b === '.' ? 1 : a.localeCompare(b));
+    for (const importerPath of importerPaths) {
+        const importer = data.importers[importerPath];
+        for (const depType of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+        ]) {
+            const deps = importer[depType];
+            if (!deps) {
+                continue;
+            }
+            for (const [depName, depVersion] of Object.entries(deps)) {
+                if (typeof depVersion !== 'string' || !depVersion.startsWith('link:')) {
+                    continue;
+                }
+                if (!linkTargetEscapesWorkspace(importerPath, depVersion)) {
+                    continue; // inside the workspace -> a workspace project
+                }
+                const bareName = `npm:${depName}`;
+                if (results[bareName]) {
+                    continue; // a hoisted registry version or an earlier link wins
+                }
+                results[bareName] = {
+                    type: 'npm',
+                    name: bareName,
+                    data: {
+                        version: depVersion,
+                        packageName: depName,
+                        hash: (0, file_hasher_1.hashArray)([depName, depVersion]),
+                    },
+                };
+            }
+        }
+    }
     return { nodes: results, keyMap };
 }
 function getHoistedVersion(packageName, isV5, hoistedKeysByPackage) {
@@ -359,7 +425,8 @@ function getHoistedVersion(packageName, isV5, hoistedKeysByPackage) {
 }
 function getDependencies(data, keyMap, isV5, ctx) {
     const results = [];
-    Object.keys(data.packages).forEach((key) => {
+    // pnpm omits the packages block for workspace-only lockfiles (no external deps)
+    Object.keys(data.packages ?? {}).forEach((key) => {
         const snapshot = data.packages[key];
         const nodes = keyMap.get(key);
         nodes.forEach((node) => {
@@ -391,9 +458,12 @@ function parseBaseVersion(rawVersion, isV5) {
 }
 function stringifyPnpmLockfile(graph, rootLockFileContent, packageJson, workspaceRoot) {
     const data = (0, pnpm_normalizer_1.parseAndNormalizePnpmLockfile)(rootLockFileContent);
-    const { lockfileVersion, packages, importers } = data;
-    const { snapshot: rootSnapshot, importers: requiredImporters } = mapRootSnapshot(packageJson, importers, packages, graph, +lockfileVersion, workspaceRoot);
-    const snapshots = mapSnapshots(data.packages, graph.externalNodes, +lockfileVersion);
+    const { lockfileVersion, importers } = data;
+    // pnpm omits the packages block for workspace-only lockfiles (no external deps)
+    const packages = data.packages ?? {};
+    const packageIndex = indexPackagesByName(packages, +lockfileVersion);
+    const { snapshot: rootSnapshot, importers: requiredImporters } = mapRootSnapshot(packageJson, importers, packages, packageIndex, graph, +lockfileVersion, workspaceRoot);
+    const snapshots = mapSnapshots(packages, packageIndex, graph.externalNodes, +lockfileVersion);
     const workspaceModules = (0, get_workspace_packages_from_graph_1.getWorkspacePackagesFromGraph)(graph);
     // Walk transitive workspace deps so every package copy-workspace-modules
     // writes to disk has a matching importer block. Without this, pnpm errors
@@ -455,12 +525,10 @@ function stringifyPnpmLockfile(graph, rootLockFileContent, packageJson, workspac
     };
     return (0, pnpm_normalizer_1.stringifyToPnpmYaml)(output);
 }
-function mapSnapshots(packages, nodes, lockfileVersion) {
+function mapSnapshots(packages, packageIndex, nodes, lockfileVersion) {
     const result = {};
     Object.values(nodes).forEach((node) => {
-        const matchedKeys = findOriginalKeys(packages, node, lockfileVersion, {
-            returnFullKey: true,
-        });
+        const matchedKeys = findOriginalKeys(packages, packageIndex, node, lockfileVersion, { returnFullKey: true });
         // the package manager doesn't check for types of dependencies
         // so we can safely set all to prod
         matchedKeys.forEach(([key, snapshot]) => {
@@ -500,10 +568,35 @@ function remapDependencies(snapshot) {
         }
     });
 }
-function findOriginalKeys(packages, { data: { packageName, version } }, lockfileVersion, { returnFullKey } = {}) {
-    const matchedKeys = [];
+// Bucket package keys by their package name so a node only scans its own name's
+// versions instead of every key (was O(nodes * allPackages)). v5 is excluded
+// below and keeps the full scan: its standard keys use a "/" separator while
+// tarball keys use "@", so a single name index would misfile v5 tarballs.
+function indexPackagesByName(packages, lockfileVersion) {
+    const isV5 = lockfileVersion < 6;
+    const index = new Map();
     for (const key of Object.keys(packages)) {
-        const snapshot = packages[key];
+        const name = extractNameFromKey(key, isV5);
+        let bucket = index.get(name);
+        if (!bucket)
+            index.set(name, (bucket = []));
+        bucket.push([key, packages[key]]);
+    }
+    return index;
+}
+// npm alias version is "npm:<name>@<ver>"; extract <name> the same way
+// versionIsAlias does so the index lookup matches the alias branch below.
+function aliasTargetName(version) {
+    return version.slice('npm:'.length, version.indexOf('@', 'npm:'.length + 1));
+}
+const NO_CANDIDATES = [];
+function findOriginalKeys(packages, packageIndex, node, lockfileVersion, { returnFullKey } = {}) {
+    const { data: { packageName, version }, } = node;
+    const candidates = lockfileVersion >= 6
+        ? (packageIndex.get(version.startsWith('npm:') ? aliasTargetName(version) : packageName) ?? NO_CANDIDATES)
+        : Object.entries(packages);
+    const matchedKeys = [];
+    for (const [key, snapshot] of candidates) {
         // tarball package
         if (key.startsWith(`${packageName}@${version}`) &&
             snapshot.resolution?.['tarball']) {
@@ -562,10 +655,11 @@ function versionIsAlias(key, versionExpr, lockfileVersion) {
         ? key.startsWith(`${packageName}/${version}`)
         : key.startsWith(`${packageName}@${version}`);
 }
-function mapRootSnapshot(packageJson, rootImporters, packages, graph, lockfileVersion, workspaceRoot) {
+function mapRootSnapshot(packageJson, rootImporters, packages, packageIndex, graph, lockfileVersion, workspaceRoot) {
     const workspaceModules = (0, get_workspace_packages_from_graph_1.getWorkspacePackagesFromGraph)(graph);
     const snapshot = { specifiers: {} };
     const importers = {};
+    const manager = (0, catalog_1.getCatalogManager)(workspaceRoot);
     [
         'dependencies',
         'optionalDependencies',
@@ -575,7 +669,6 @@ function mapRootSnapshot(packageJson, rootImporters, packages, graph, lockfileVe
         if (packageJson[depType]) {
             Object.keys(packageJson[depType]).forEach((packageName) => {
                 let version = packageJson[depType][packageName];
-                const manager = (0, catalog_1.getCatalogManager)(workspaceRoot);
                 if (manager?.isCatalogReference(version)) {
                     version = manager.resolveCatalogReference(workspaceRoot, packageName, version);
                     if (!version) {
@@ -612,7 +705,7 @@ function mapRootSnapshot(packageJson, rootImporters, packages, graph, lockfileVe
                     // peer dependencies are mapped to dependencies
                     let section = depType === 'peerDependencies' ? 'dependencies' : depType;
                     snapshot[section] = snapshot[section] || {};
-                    snapshot[section][packageName] = findOriginalKeys(packages, node, lockfileVersion)[0][0];
+                    snapshot[section][packageName] = findOriginalKeys(packages, packageIndex, node, lockfileVersion)[0][0];
                 }
             });
         }

package/dist/src/plugins/js/lock-file/project-graph-pruning.js

@@ -38,9 +38,9 @@ function normalizeDependencies(packageJson, graph, workspacePackages, workspaceR
         ...optionalDependencies,
         ...peerDependencies,
     };
+    const manager = (0, catalog_1.getCatalogManager)(workspaceRootPath);
     Object.entries(combinedDependencies).forEach(([packageName, versionRange]) => {
         let resolvedVersionRange = versionRange;
-        const manager = (0, catalog_1.getCatalogManager)(workspaceRootPath);
         if (manager?.isCatalogReference(versionRange)) {
             resolvedVersionRange = manager.resolveCatalogReference(workspaceRootPath, packageName, versionRange);
             if (!resolvedVersionRange) {
@@ -177,17 +177,23 @@ function switchNodeToHoisted(node, builder, invBuilder) {
     const sources = Object.keys(builder.graph.dependencies).filter((name) => builder.graph.dependencies[name].some((d) => d.target === previousName));
     builder.removeNode(node.name);
     invBuilder.removeNode(node.name);
-    // modify the node and re-add it
-    node.name = `npm:${node.data.packageName}`;
-    builder.addExternalNode(node);
-    invBuilder.addExternalNode(node);
+    // Re-add under the hoisted name as a new object. The node is shared by
+    // reference with the caller's graph, so renaming it in place would leave that
+    // graph with a node keyed `npm:<pkg>@<version>` but named `npm:<pkg>`, and
+    // every later prune of the same graph would fail to resolve the edge.
+    const hoistedNode = {
+        ...node,
+        name: `npm:${node.data.packageName}`,
+    };
+    builder.addExternalNode(hoistedNode);
+    invBuilder.addExternalNode(hoistedNode);
     targets.forEach((target) => {
-        builder.addStaticDependency(node.name, target);
-        invBuilder.addStaticDependency(target, node.name);
+        builder.addStaticDependency(hoistedNode.name, target);
+        invBuilder.addStaticDependency(target, hoistedNode.name);
     });
     sources.forEach((source) => {
-        builder.addStaticDependency(source, node.name);
-        invBuilder.addStaticDependency(node.name, source);
+        builder.addStaticDependency(source, hoistedNode.name);
+        invBuilder.addStaticDependency(hoistedNode.name, source);
     });
 }
 // BFS to find the shortest path to a dependency specified in package.json

package/dist/src/plugins/js/lock-file/utils/pnpm-normalizer.js

@@ -54,6 +54,9 @@ const YAML_DOCUMENT_SEPARATOR = '\n---\n';
 // always read the workspace document.
 // https://github.com/pnpm/pnpm/blob/main/lockfile/fs/src/yamlDocuments.ts
 function extractMainLockfileDocument(content) {
+    // Lockfiles written on Windows may use CRLF line endings, which would never
+    // match the LF-only document markers.
+    content = content.replace(/\r\n/g, '\n');
     if (!content.startsWith(YAML_DOCUMENT_START)) {
         return content;
     }

package/dist/src/plugins/js/lock-file/yarn-parser.js

@@ -314,9 +314,10 @@ function mapSnapshots(rootDependencies, nodes, packageJson, workspaceModules, is
     };
     // yarn classic splits keys when parsing so we need to stich them back together
     const groupedDependencies = groupDependencies(rootDependencies, isBerry);
+    const keyIndex = buildYarnKeyIndex(groupedDependencies);
     // collect snapshots and their matching keys
     Object.values(nodes).forEach((node) => {
-        const foundOriginalKeys = findOriginalKeys(groupedDependencies, node, workspaceModules);
+        const foundOriginalKeys = findOriginalKeys(groupedDependencies, keyIndex, node, workspaceModules);
         if (!foundOriginalKeys) {
             throw new Error(`Original key(s) not found for "${node.data.packageName}@${node.data.version}" while pruning yarn.lock.`);
         }
@@ -349,7 +350,7 @@ function mapSnapshots(rootDependencies, nodes, packageJson, workspaceModules, is
         }
         if (isBerry) {
             // look for patched versions
-            const patch = findPatchedKeys(groupedDependencies, node, resolutions[node.data.packageName]);
+            const patch = findPatchedKeys(groupedDependencies, keyIndex, node, resolutions[node.data.packageName]);
             if (patch) {
                 const [matchedKeys, snapshot] = patch;
                 snapshotMap.set(snapshot, new Set(matchedKeys));
@@ -424,8 +425,34 @@ function isClassicAlias(node, keys) {
     return (node.data.version.startsWith('npm:') &&
         keys.some((k) => k === `${node.data.packageName}@${node.data.version}`));
 }
-function findOriginalKeys(dependencies, node, workspaceModules) {
+// Bucket grouped-dependency key expressions by the package names they contain
+// so a node scans only its own name's entries (was O(nodes * allEntries)). A
+// key like "foo@npm:1.0" indexes under "foo"; the inner match checks below are
+// unchanged, so candidates are exactly the entries the old full scan would not
+// have skipped and the result is identical.
+function extractYarnKeyName(key) {
+    const at = key.indexOf('@', 1);
+    return at === -1 ? key : key.slice(0, at);
+}
+function buildYarnKeyIndex(dependencies) {
+    const index = new Map();
     for (const keyExpr of Object.keys(dependencies)) {
+        const seen = new Set();
+        for (const k of keyExpr.split(', ')) {
+            const name = extractYarnKeyName(k);
+            if (seen.has(name))
+                continue;
+            seen.add(name);
+            let bucket = index.get(name);
+            if (!bucket)
+                index.set(name, (bucket = []));
+            bucket.push(keyExpr);
+        }
+    }
+    return index;
+}
+function findOriginalKeys(dependencies, keyIndex, node, workspaceModules) {
+    for (const keyExpr of keyIndex.get(node.data.packageName) ?? []) {
         const snapshot = dependencies[keyExpr];
         const keys = keyExpr.split(', ');
         if (!keys.some((k) => k.startsWith(`${node.data.packageName}@`))) {
@@ -450,8 +477,8 @@ function findOriginalKeys(dependencies, node, workspaceModules) {
         }
     }
 }
-function findPatchedKeys(dependencies, node, resolutionVersion) {
-    for (const keyExpr of Object.keys(dependencies)) {
+function findPatchedKeys(dependencies, keyIndex, node, resolutionVersion) {
+    for (const keyExpr of keyIndex.get(node.data.packageName) ?? []) {
         const snapshot = dependencies[keyExpr];
         const keys = keyExpr.split(', ');
         if (!keys[0].startsWith(`${node.data.packageName}@patch:`)) {

package/dist/src/plugins/js/project-graph/affected/npm-packages.js

@@ -13,6 +13,7 @@ const getTouchedNpmPackages = (touchedFiles, _, nxJson, packageJson, projectGrap
     let touched = [];
     const changes = packageJsonChange.getChanges();
     const npmPackages = Object.values(projectGraph.externalNodes);
+    let packagesByName;
     const missingTouchedNpmPackages = [];
     for (const c of changes) {
         if ((0, json_diff_1.isJsonChange)(c) &&
@@ -53,26 +54,20 @@ const getTouchedNpmPackages = (touchedFiles, _, nxJson, packageJson, projectGrap
             (c.path[0] === 'overrides' ||
                 c.path[0] === 'resolutions' ||
                 (c.path[0] === 'pnpm' && c.path[1] === 'overrides'))) {
-            // Changes to overrides, resolutions, or pnpm.overrides
-            // Find which package was changed and mark projects that depend on it as affected
-            const packageName = c.path[0] === 'pnpm' ? c.path[2] : c.path[1];
-            if (packageName) {
-                // Look for the npm package in external nodes
-                let npmPackage = npmPackages.find((pkg) => pkg.data.packageName === packageName);
-                if (npmPackage) {
-                    touched.push(npmPackage.name);
-                    // If it's a global package, all projects are affected
-                    if ('packageName' in npmPackage.data &&
-                        globalPackages.has(npmPackage.data.packageName)) {
-                        return Object.keys(projectGraph.nodes);
-                    }
-                }
-                else {
-                    // If the package isn't found in external nodes, it might affect all projects
-                    // since overrides can affect transitive dependencies
-                    return Object.keys(projectGraph.nodes);
-                }
+            const packageSelector = getPackageSelector(c);
+            if (!packageSelector)
+                continue;
+            packagesByName ??= groupPackagesByName(npmPackages);
+            const matchingNpmPackages = findPackagesForSelector(packageSelector, packagesByName, c.path[0] === 'pnpm');
+            // An unresolved selector can still target a transitive dependency,
+            // so fall back to marking every project affected.
+            if (!matchingNpmPackages.length) {
+                return Object.keys(projectGraph.nodes);
             }
+            if (matchingNpmPackages.some((pkg) => globalPackages.has(pkg.data.packageName))) {
+                return Object.keys(projectGraph.nodes);
+            }
+            touched.push(...matchingNpmPackages.map((pkg) => pkg.name));
         }
         else if ((0, file_utils_1.isWholeFileChange)(c)) {
             // Whole file was touched, so all npm packages are touched.
@@ -83,9 +78,45 @@ const getTouchedNpmPackages = (touchedFiles, _, nxJson, packageJson, projectGrap
     if (missingTouchedNpmPackages.length) {
         logger_1.logger.warn(`The affected projects might have not been identified properly. The package(s) ${missingTouchedNpmPackages.join(', ')} were not found. Please open an issue in GitHub including the package.json file.`);
     }
-    return touched;
+    return [...new Set(touched)];
 };
 exports.getTouchedNpmPackages = getTouchedNpmPackages;
+function getPackageSelector(change) {
+    if (typeof change.value.lhs !== 'string' &&
+        typeof change.value.rhs !== 'string') {
+        return;
+    }
+    const selectorIndex = change.path[0] === 'pnpm' ? 2 : change.path.length - 1;
+    const selector = change.path[selectorIndex];
+    return selector === '.' ? change.path[selectorIndex - 1] : selector;
+}
+function groupPackagesByName(npmPackages) {
+    const packagesByName = new Map();
+    for (const pkg of npmPackages) {
+        const packageName = pkg.data.packageName;
+        if (!packageName)
+            continue;
+        const packages = packagesByName.get(packageName);
+        if (packages) {
+            packages.push(pkg);
+        }
+        else {
+            packagesByName.set(packageName, [pkg]);
+        }
+    }
+    return packagesByName;
+}
+function findPackagesForSelector(selector, packagesByName, isPnpmOverride) {
+    if (isPnpmOverride) {
+        // Pnpm does not treat `>` as a parent delimiter when it starts a range.
+        const parentDelimiterIndex = selector.search(/[^ |@]>/);
+        if (parentDelimiterIndex !== -1) {
+            selector = selector.slice(parentDelimiterIndex + 2);
+        }
+    }
+    const packageName = selector.match(/(?:^|\/)(@[^/@>\s]+\/[^/@>\s]+|[^/@>\s]+)(?:@[^/]*)?$/)?.[1];
+    return packageName ? (packagesByName.get(packageName) ?? []) : [];
+}
 function getGlobalPackages(plugins) {
     return (plugins ?? [])
         .map((p) => (0, get_package_name_from_import_path_1.getPackageNameFromImportPath)(typeof p === 'string' ? p : p.plugin))