pnpm-dedup 2.1.0 → 2.2.2

package/src/helpers/pnpmWorkspaceYaml.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import {
   addOverrides,
   overrideKey,
@@ -94,7 +94,7 @@ describe("pnpmWorkspaceYaml", () => {
     );
   });
 
-  it("puts the comment above the first entry it adds, not above the block", () => {
+  it("appends to an existing block, leaving the user's comment in place", () => {
     strictEqual(
       addOverrides(
         'overrides:\n  # a decision taken elsewhere\n  "foo@": "1.0.0"\n',
@@ -102,14 +102,11 @@ describe("pnpmWorkspaceYaml", () => {
           ["leaf", "2.0.0"],
           ["other", "1.0.0"],
         ]),
-        { comment: "Added by pnpm-dedup.\nsee https://example.test/issues" },
       ),
       [
         "overrides:",
         "  # a decision taken elsewhere",
         '  "foo@": "1.0.0"',
-        "  # Added by pnpm-dedup.",
-        "  # see https://example.test/issues",
         '  "leaf@": "2.0.0"',
         '  "other@": "1.0.0"',
         "",

package/src/helpers/pnpmWorkspaceYaml.ts

@@ -12,14 +12,6 @@ export const overrideKey = (
   convergence: boolean,
 ): string => (convergence ? `${packageName}@` : packageName);
 
-// `yaml` writes `commentBefore` straight after the `#`, so the leading space
-// that makes it read as prose has to be part of every line.
-const spaced = (comment: string): string =>
-  comment
-    .split("\n")
-    .map((line) => (line.startsWith(" ") ? line : ` ${line}`))
-    .join("\n");
-
 const quoted = (value: string): Scalar<string> => {
   const scalar = new Scalar(value);
   scalar.type = Scalar.QUOTE_DOUBLE;
@@ -29,32 +21,25 @@ const quoted = (value: string): Scalar<string> => {
 export interface AddOverridesOptions {
   // false writes plain keys, which pnpm applies to every requester
   convergence?: boolean;
-  comment?: string;
 }
 
 /**
  * Add overrides to a `pnpm-workspace.yaml`, editing the document rather than
  * reserializing it: the user's comments, key order and formatting have to
  * survive. Pass `undefined` for a file that does not exist yet.
- *
- * `comment` is attached above the first entry added, not above the `overrides`
- * key, so an existing block and whatever the user wrote about it stay untouched.
  */
 export const addOverrides = (
   content: string | undefined,
   overrides: Map<string, string>,
-  { convergence = true, comment }: AddOverridesOptions = {},
+  { convergence = true }: AddOverridesOptions = {},
 ): string => {
   const doc = parseDocument(content ?? "");
-  let isFirst = true;
 
   for (const [packageName, version] of overrides) {
-    const key = quoted(overrideKey(packageName, convergence));
-    if (isFirst && comment !== undefined) {
-      key.commentBefore = spaced(comment);
-    }
-    doc.setIn(["overrides", key], quoted(version));
-    isFirst = false;
+    doc.setIn(
+      ["overrides", quoted(overrideKey(packageName, convergence))],
+      quoted(version),
+    );
   }
 
   return doc.toString();

package/src/helpers/readInstalledManifest.test.ts

@@ -1,8 +1,8 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, strictEqual } from "node:assert/strict";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { createManifestReaderWithStats } from "./readInstalledManifest.ts";
 

package/src/helpers/toLockstepGraph.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import type { PnpmLockFile } from "../pnpmLockTypes.ts";
 import { readPnpmLock } from "../readPnpmLock.ts";

package/src/identifyClusterFixes.test.ts

@@ -1,6 +1,6 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import { join } from "node:path";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import type { ClusterFix } from "pm-dedup-core";
 import { buildPnpmPackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
@@ -304,17 +304,29 @@ describe("identifyClusterFixes", () => {
     strictEqual(requesterNames.has("metro-config"), false);
   });
 
-  it("converges the family on the pinned version, without touching the pin", () => {
+  it("proposes the metro pin upgrade, since nothing moves react-native", () => {
     const fix = metroCluster();
 
-    // The root pins metro at 0.84.5 on purpose, so the pin is a constraint to
-    // resolve around, not something to upgrade: the family collapses onto
-    // 0.84.5 and `workspaceChanges` stays empty.
+    // react-native@0.87.0 and @react-native/metro-config@0.87.0 hold the 0.87.0
+    // metro subtree. Nothing pins them exactly — they arrive through `*` /
+    // `0.83 - 0.86` peer ranges — but a resolver keeps a locked version its
+    // requesters accept, so they stay, and their `^0.87.0` on metro keeps the
+    // family off 0.84.5. The root's pin is the only thing left to move: a last
+    // resort, proposed because nothing else deduplicates the family.
     strictEqual(fix.applicable, true);
-    strictEqual(fix.target, "0.84.5");
-    strictEqual(fix.direction, "down");
+    strictEqual(fix.target, "0.87.0");
+    strictEqual(fix.direction, "up");
     strictEqual(fix.convergentMembers.length, 15);
-    deepStrictEqual(fix.workspaceChanges, []);
+    deepStrictEqual(
+      fix.workspaceChanges.map(
+        (change) => `${change.packageName} ${change.range} -> ${change.to}`,
+      ),
+      ["metro 0.84.5 -> 0.87.0"],
+    );
+    strictEqual(fix.needsRoundTrip, true);
+    // react-native is only asked for through open ranges: it is never planned
+    // onto a version number that only metro carries
+    deepStrictEqual(fix.reResolutionSet, []);
 
     // metro is the only member a real range applies to (the pin): the 14
     // metro-* packages are requested through `*` or through metro's own exact
@@ -322,60 +334,17 @@ describe("identifyClusterFixes", () => {
     deepStrictEqual(fix.driverMembers, ["metro"]);
   });
 
-  it("leaves react-native's version to the resolver", () => {
+  it("leaves the wildcards alone once the pin they ignored moves to them", () => {
     const fix = metroCluster();
 
-    // react-native@0.87.0 and @react-native/metro-config@0.87.0 are what hold
-    // the 0.87.0 metro subtree, and nothing pins either of them there — both
-    // arrive through `*` / `0.83 - 0.86` peer ranges (0.87.0 does not even
-    // satisfy the latter). They have to move, but which version they land on is
-    // the resolver's call, so no version is asserted for them.
-    deepStrictEqual(fix.floatingMembers, [
-      "@react-native/metro-config",
-      "react-native",
-    ]);
-    deepStrictEqual(fix.reResolutionSet, []);
-    strictEqual(fix.needsRoundTrip, true);
-  });
-
-  it("repoints the wildcards that ignored the pinned version", () => {
-    const fix = metroCluster();
-
-    // What the fixture is actually about: `@tamagui/metro-plugin` declares
+    // What the fixture is about: `@tamagui/metro-plugin` declares
     // `metro-config: "*"` / `metro-transform-worker: "*"`, and pnpm resolved
-    // both to 0.87.0 although the pinned 0.84.5 was already in the tree and the
-    // range accepts it — so the plugin runs against a different metro than the
-    // app's.
+    // both to 0.87.0 beside the pinned 0.84.5 — the plugin runs against a
+    // different metro than the app's. The fix moves the pin to 0.87.0, which
+    // puts the app on the plugin's copy: sending the plugin back to 0.84.5
+    // would split the family again.
     strictEqual(fix.anchor, "0.84.5");
-    deepStrictEqual(
-      fix.reuseFixes.map(
-        (reuse) =>
-          `${reuse.requesterName}>${reuse.packageName} "${reuse.range}" ${reuse.from} -> ${reuse.to}`,
-      ),
-      [
-        '@tamagui/metro-plugin>metro-config "*" 0.87.0 -> 0.84.5',
-        '@tamagui/metro-plugin>metro-transform-worker "*" 0.87.0 -> 0.84.5',
-      ],
-    );
-  });
-
-  it("leaves alone the ranges that cannot accept the pinned version", () => {
-    const repointed = new Set(
-      metroCluster().reuseFixes.map((reuse) => reuse.packageName),
-    );
-
-    // `@react-native/metro-config` requires `metro-config: ^0.87.0`, and
-    // `react-native-web` requires `@react-native/normalize-colors: ^0.74.1`:
-    // neither accepts 0.84.5, so neither is repointed.
-    strictEqual(repointed.has("@react-native/normalize-colors"), false);
-    deepStrictEqual(
-      metroCluster()
-        .reuseFixes.filter(
-          (reuse) => reuse.requesterName === "@react-native/metro-config",
-        )
-        .map((reuse) => reuse.packageName),
-      [],
-    );
+    deepStrictEqual(fix.reuseFixes, []);
   });
 
   // `aliased-swapped-names`: the importer pins the real `typescript` at 7.0.2

package/src/identifyResolutionFixes.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, it } from "bun:test";
+import { deepStrictEqual } from "node:assert/strict";
 import fs from "node:fs";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { identifyResolutionFixes } from "pm-dedup-core";
 import type { PackageResolution } from "./helpers/buildPnpmPackagesMap.ts";
@@ -11,7 +12,7 @@ const loadResolutionsFixture = (fileName: string): PackageResolution[] => {
       fileURLToPath(
         new URL(`../test/fixtures/resolutions/${fileName}`, import.meta.url),
       ),
-      // eslint-disable-next-line unicorn/prefer-json-parse-buffer
+      // oxlint-disable-next-line unicorn-js/prefer-json-parse-buffer
       "utf8",
     ),
   );
@@ -25,7 +26,7 @@ const loadDependentsFixture = (
       fileURLToPath(
         new URL(`../test/fixtures/dependents/${fileName}`, import.meta.url),
       ),
-      // eslint-disable-next-line unicorn/prefer-json-parse-buffer
+      // oxlint-disable-next-line unicorn-js/prefer-json-parse-buffer
       "utf8",
     ),
   );
@@ -39,14 +40,14 @@ describe("identifyResolutionFixes", () => {
     const resolutions: PackageResolution[] = [];
 
     const fixes = identifyResolutionFixes(resolutions, objetToMap({}));
-    expect(fixes).toEqual([]);
+    deepStrictEqual(fixes, []);
   });
 
   it("should return an empty array when there is only one resolution", () => {
     const resolutions = loadResolutionsFixture("semver-7.7.3.json");
     const dependents = loadDependentsFixture("semver-7.7.3.json");
     const fixes = identifyResolutionFixes(resolutions, objetToMap(dependents));
-    expect(fixes).toEqual([]);
+    deepStrictEqual(fixes, []);
   });
 
   it("should not identify fixes when dependencies are not compatible", () => {
@@ -57,7 +58,7 @@ describe("identifyResolutionFixes", () => {
       "babel-code-frame-7.26.2-7.27.1.json",
     );
     const fixes = identifyResolutionFixes(resolutions, objetToMap(dependents));
-    expect(fixes).toEqual([]);
+    deepStrictEqual(fixes, []);
   });
 
   it("should identify resolution fixes when dependencies are compatible", () => {
@@ -69,7 +70,7 @@ describe("identifyResolutionFixes", () => {
     );
 
     const fixes = identifyResolutionFixes(resolutions, objetToMap(dependents));
-    expect(fixes).toEqual([
+    deepStrictEqual(fixes, [
       {
         mergeableResolutions: [
           "printable-shell-command@5.0.7",

package/src/pnpmLockTypes.ts

@@ -13,6 +13,7 @@ export interface ProjectSnapshot {
   dependencies?: Record<string, PnpmImporterDependency>;
   devDependencies?: Record<string, PnpmImporterDependency>;
   optionalDependencies?: Record<string, PnpmImporterDependency>;
+  packageManagerDependencies?: Record<string, PnpmImporterDependency>;
 }
 
 export interface PackageMeta {

package/src/readPnpmLock.test.ts

@@ -0,0 +1,65 @@
+import { deepStrictEqual, ok, throws } from "node:assert/strict";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { createTempProjects } from "./helpers/tempProjects.ts";
+import { readPnpmLock } from "./readPnpmLock.ts";
+
+const fixtureLock = (scenario: string): string =>
+  fileURLToPath(
+    new URL(`../test/fixtures/${scenario}/pnpm-lock.yaml`, import.meta.url),
+  );
+
+const projects = createTempProjects("pnpm-dedup-read-lock-");
+
+afterEach(projects.cleanup);
+
+const writeLock = (content: string): string => {
+  const path = join(projects.create(), "pnpm-lock.yaml");
+  writeFileSync(path, content);
+  return path;
+};
+
+describe("readPnpmLock", () => {
+  it("returns the project document of a lockfile that also resolves the package manager", () => {
+    const lock = readPnpmLock(fixtureLock("package-manager-document"));
+
+    deepStrictEqual(Object.keys(lock.importers?.["."] ?? {}), ["dependencies"]);
+    const packageIds = Object.keys(lock.packages ?? {});
+    ok(packageIds.includes("printable-shell-command@5.0.7"));
+    ok(!packageIds.some((id) => id.startsWith("@pnpm/exe")));
+  });
+
+  it("reads the same project as the single-document lockfile", () => {
+    deepStrictEqual(
+      readPnpmLock(fixtureLock("package-manager-document")),
+      readPnpmLock(fixtureLock("duplicated-printable-shell-command")),
+    );
+  });
+
+  it("throws on malformed yaml", () => {
+    throws(
+      () => readPnpmLock(writeLock("lockfileVersion: '9.0'\nimporters: [\n")),
+      { name: "YAMLParseError" },
+    );
+  });
+
+  it("throws when only the package-manager document is present", () => {
+    const path = writeLock(
+      "lockfileVersion: '9.0'\n\nimporters:\n\n  .:\n    packageManagerDependencies:\n      pnpm:\n        specifier: ^12.0.0\n        version: 12.10.1\n",
+    );
+
+    throws(() => readPnpmLock(path), {
+      message: `No project lockfile document found in ${path}`,
+    });
+  });
+
+  it("throws on an empty file", () => {
+    const path = writeLock("");
+
+    throws(() => readPnpmLock(path), {
+      message: `No project lockfile document found in ${path}`,
+    });
+  });
+});

package/src/readPnpmLock.ts

@@ -1,7 +1,31 @@
 import { readFileSync } from "node:fs";
-import { parse } from "yaml";
+import { parseAllDocuments } from "yaml";
 import type { PnpmLockFile } from "./pnpmLockTypes.ts";
 
+const isPackageManagerDocument = (lock: PnpmLockFile): boolean =>
+  Object.values(lock.importers ?? {}).some(
+    (importer) => importer.packageManagerDependencies !== undefined,
+  );
+
+/**
+ * A project declaring `devEngines.packageManager` gets a lockfile of two YAML
+ * documents from pnpm 12: the first resolves pnpm itself
+ * (`packageManagerDependencies`, `@pnpm/exe.*`), the second is the project's.
+ * Only the project document is returned — the other one would report pnpm as a
+ * dependency of the project.
+ */
 export const readPnpmLock = (filepath: string): PnpmLockFile => {
-  return parse(readFileSync(filepath, "utf8")) as PnpmLockFile;
+  const documents = parseAllDocuments(readFileSync(filepath, "utf8"));
+  const locks = documents.map((document) => {
+    const [error] = document.errors;
+    if (error) throw error;
+    return document.toJS() as PnpmLockFile | null;
+  });
+  const projectLock = locks.findLast(
+    (lock) => lock !== null && !isPackageManagerDocument(lock),
+  );
+  if (!projectLock) {
+    throw new Error(`No project lockfile document found in ${filepath}`);
+  }
+  return projectLock;
 };