snyk 1.1046.0 → 1.1047.0

package/dist/cli/263.index.js

@@ -140312,7 +140312,7 @@ function groupFilesByDirectory(filePathToContent) {
 
 /***/ }),
 
-/***/ 91379:
+/***/ 95710:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -144345,7 +144345,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.appendLatestTagIfMissing = exports.scan = exports.mergeEnvVarsIntoCredentials = void 0;
 const fs = __webpack_require__(35747);
 const path = __webpack_require__(85622);
-const image_inspector_1 = __webpack_require__(91379);
+const image_inspector_1 = __webpack_require__(95710);
 const dockerfile_1 = __webpack_require__(79652);
 const image_save_path_1 = __webpack_require__(89313);
 const image_type_1 = __webpack_require__(38932);
@@ -165511,9 +165511,16 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.extractCorrectIdentifierBySemver = exports.extractNameAndIdentifier = void 0;
 const semver = __webpack_require__(50460);
 const extractNameAndIdentifier = (candidate) => {
-    const index = candidate.indexOf('@', 1);
-    const name = candidate.slice(0, index);
-    const identifier = candidate.slice(index + 1);
+    let name, identifier;
+    if (candidate.includes('@')) {
+        const index = candidate.indexOf('@', 1);
+        name = candidate.slice(0, index);
+        identifier = candidate.slice(index + 1);
+    }
+    else {
+        name = candidate;
+        identifier = 'unknown';
+    }
     return { name, identifier };
 };
 exports.extractNameAndIdentifier = extractNameAndIdentifier;
@@ -165522,7 +165529,7 @@ exports.extractNameAndIdentifier = extractNameAndIdentifier;
 // will result in debug@2.2.6 - This is required as yarn list does not have the resolved semver
 // in dependencies.
 const extractCorrectIdentifierBySemver = (possibleMatches, versionToMatch) => {
-    const { name: nameToMatch, identifier: identifierToMatch, } = exports.extractNameAndIdentifier(versionToMatch);
+    const { name: nameToMatch, identifier: identifierToMatch } = (0, exports.extractNameAndIdentifier)(versionToMatch);
     const hasQualifiers = isNaN(parseInt(identifierToMatch[0]));
     if (!hasQualifiers) {
         return versionToMatch;
@@ -165530,10 +165537,10 @@ const extractCorrectIdentifierBySemver = (possibleMatches, versionToMatch) => {
     // Check for matching name, if only one found shortcircuit
     const match = possibleMatches
         .filter((name) => name.startsWith(nameToMatch))
-        .filter((name) => semver.satisfies(exports.extractNameAndIdentifier(name).identifier, identifierToMatch))
+        .filter((name) => semver.satisfies((0, exports.extractNameAndIdentifier)(name).identifier, identifierToMatch))
         .map((name) => ({
         name,
-        identifier: exports.extractNameAndIdentifier(name).identifier,
+        identifier: (0, exports.extractNameAndIdentifier)(name).identifier,
     }))
         .reduce((acc, item) => semver.gt(item.identifier, acc.identifier) ? item : acc);
     return match.name;
@@ -165550,7 +165557,7 @@ exports.extractCorrectIdentifierBySemver = extractCorrectIdentifierBySemver;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildDepGraphFromCliOutput = void 0;
-const dep_graph_1 = __webpack_require__(71479);
+const dep_graph_1 = __webpack_require__(53789);
 const __1 = __webpack_require__(423);
 const parsers_1 = __webpack_require__(75873);
 const cli_parser_utils_1 = __webpack_require__(80333);
@@ -165558,13 +165565,13 @@ const yarn_info_parser_1 = __webpack_require__(79326);
 const yarn_list_parser_1 = __webpack_require__(97016);
 const buildDepGraphFromCliOutput = (rawCliOutput, lockfileContent, manifestFileContent) => {
     const manifestDependencies = JSON.parse(manifestFileContent).dependencies || {};
-    const lockfileType = __1.getYarnLockfileType(lockfileContent);
+    const lockfileType = (0, __1.getYarnLockfileType)(lockfileContent);
     const { name: rootName, version: rootVersion } = JSON.parse(manifestFileContent);
     const pkgManagerVersion = lockfileType === parsers_1.LockfileType.yarn ? '1' : '2';
     // Build depMap object from the cli output
     const formattedCliOutput = pkgManagerVersion === '1'
-        ? yarn_list_parser_1.parseYarnListOutput(rawCliOutput, manifestDependencies)
-        : yarn_info_parser_1.parseYarnInfoOutput(rawCliOutput);
+        ? (0, yarn_list_parser_1.parseYarnListOutput)(rawCliOutput, manifestDependencies)
+        : (0, yarn_info_parser_1.parseYarnInfoOutput)(rawCliOutput);
     const rootPkgInfo = rootName
         ? Object.assign({ name: rootName }, (rootVersion && { version: rootVersion })) : undefined;
     const pkgManager = {
@@ -165575,7 +165582,7 @@ const buildDepGraphFromCliOutput = (rawCliOutput, lockfileContent, manifestFileC
     const { topLevelDeps, dependencies: depMap } = formattedCliOutput;
     // Add all nodes
     [...depMap.keys()].forEach((name) => {
-        const { name: pkgName, identifier: pkgVersion } = cli_parser_utils_1.extractNameAndIdentifier(name);
+        const { name: pkgName, identifier: pkgVersion } = (0, cli_parser_utils_1.extractNameAndIdentifier)(name);
         builder.addPkgNode({ name: pkgName, version: pkgVersion.split(':').pop() }, name);
     });
     // Deal with root special case first
@@ -165631,12 +165638,11 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.parseYarnListOutput = void 0;
 const cli_parser_utils_1 = __webpack_require__(80333);
 const parseYarnListOutput = (rawYarnListOutput, manifestDependencies) => {
-    const formattedYarnList = JSON.parse(rawYarnListOutput).data
-        .trees;
+    const formattedYarnList = JSON.parse(rawYarnListOutput).data.trees;
     // Reference to all (resolved) dep names to help cleanup in next step
     const names = formattedYarnList.map((tree) => tree.name);
     const formattedListOutput = formattedYarnList.reduce((result, tree) => {
-        const dependencies = tree.children.map((child) => cli_parser_utils_1.extractCorrectIdentifierBySemver(names, child.name));
+        const dependencies = tree.children.map((child) => (0, cli_parser_utils_1.extractCorrectIdentifierBySemver)(names, child.name));
         return result.set(tree.name, dependencies);
     }, new Map());
     const topLevelDeps = getTopLevelDependencies(formattedListOutput, manifestDependencies);
@@ -165647,7 +165653,7 @@ const getTopLevelDependencies = (formattedListOutput, topLevelDeps) => {
     // This logic is to construct an item for the rootPkg because
     // we are dealing with a flat map so far so can't tell
     const names = [...formattedListOutput.keys()];
-    return Object.entries(topLevelDeps).map(([name, version]) => cli_parser_utils_1.extractCorrectIdentifierBySemver(names, `${name}@${version}`));
+    return Object.entries(topLevelDeps).map(([name, version]) => (0, cli_parser_utils_1.extractCorrectIdentifierBySemver)(names, `${name}@${version}`));
 };
 //# sourceMappingURL=yarn-list-parser.js.map
 
@@ -165661,11 +165667,496 @@ const getTopLevelDependencies = (formattedListOutput, topLevelDeps) => {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.config = void 0;
 const snyk_config_1 = __webpack_require__(8658);
-exports.config = snyk_config_1.loadConfig(__dirname + '../..');
+exports.config = (0, snyk_config_1.loadConfig)(__dirname + '../..');
 //# sourceMappingURL=config.js.map
 
 /***/ }),
 
+/***/ 61311:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.extractPkgsFromYarnLockV1 = exports.parseYarnLockV1WorkspaceProject = exports.buildDepGraphYarnLockV1WorkspaceCyclesPruned = exports.buildDepGraphYarnLockV1Simple = exports.buildDepGraphYarnLockV1SimpleCyclesPruned = exports.buildDepGraphYarnLockV1Workspace = exports.parseYarnLockV1Project = void 0;
+const yarn_lock_v1_1 = __webpack_require__(33248);
+Object.defineProperty(exports, "parseYarnLockV1Project", ({ enumerable: true, get: function () { return yarn_lock_v1_1.parseYarnLockV1Project; } }));
+Object.defineProperty(exports, "parseYarnLockV1WorkspaceProject", ({ enumerable: true, get: function () { return yarn_lock_v1_1.parseYarnLockV1WorkspaceProject; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1SimpleCyclesPruned", ({ enumerable: true, get: function () { return yarn_lock_v1_1.buildDepGraphYarnLockV1SimpleCyclesPruned; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Simple", ({ enumerable: true, get: function () { return yarn_lock_v1_1.buildDepGraphYarnLockV1Simple; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1WorkspaceCyclesPruned", ({ enumerable: true, get: function () { return yarn_lock_v1_1.buildDepGraphYarnLockV1WorkspaceCyclesPruned; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Workspace", ({ enumerable: true, get: function () { return yarn_lock_v1_1.buildDepGraphYarnLockV1Workspace; } }));
+Object.defineProperty(exports, "extractPkgsFromYarnLockV1", ({ enumerable: true, get: function () { return yarn_lock_v1_1.extractPkgsFromYarnLockV1; } }));
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 46200:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getChildNodeWorkspace = exports.getChildNode = exports.parsePkgJson = exports.getGraphDependencies = exports.getTopLevelDeps = exports.addPkgNodeToGraph = void 0;
+const errors_1 = __webpack_require__(1706);
+const errors_2 = __webpack_require__(1706);
+const parsers_1 = __webpack_require__(75873);
+const addPkgNodeToGraph = (depGraphBuilder, node, options) => {
+    return depGraphBuilder.addPkgNode({ name: node.name, version: node.version }, node.id, {
+        labels: Object.assign(Object.assign(Object.assign({ scope: node.isDev ? 'dev' : 'prod' }, (options.isCyclic && { pruned: 'cyclic' })), (options.isWorkspacePkg && { pruned: 'true' })), (node.missingLockFileEntry && { missingLockFileEntry: 'true' })),
+    });
+};
+exports.addPkgNodeToGraph = addPkgNodeToGraph;
+/**
+ * Get top level dependencies from the given package json object which is parsed from a package.json file.
+ * This includes both prod dependencies and dev dependencies supposing includeDevDeps is supported.
+ */
+const getTopLevelDeps = (pkgJson, options) => {
+    const prodDeps = (0, exports.getGraphDependencies)(pkgJson.dependencies || {}, false);
+    const devDeps = options.includeDevDeps
+        ? (0, exports.getGraphDependencies)(pkgJson.devDependencies || {}, true)
+        : {};
+    return Object.assign(Object.assign({}, prodDeps), devDeps);
+};
+exports.getTopLevelDeps = getTopLevelDeps;
+/**
+ * Converts dependencies parsed from the a lock file to a dependencies object required by the graph.
+ * For example, { 'mime-db': '~1.12.0' } will be converted to { 'mime-db': { version: '~1.12.0', isDev: true/false } }.
+ */
+const getGraphDependencies = (dependencies, isDev) => {
+    return Object.entries(dependencies).reduce((acc, [name, semver]) => {
+        acc[name] = { version: semver, isDev: isDev };
+        return acc;
+    }, {});
+};
+exports.getGraphDependencies = getGraphDependencies;
+function parsePkgJson(pkgJsonContent) {
+    try {
+        const parsedPkgJson = JSON.parse(pkgJsonContent);
+        if (!parsedPkgJson.name) {
+            parsedPkgJson.name = 'package.json';
+        }
+        return parsedPkgJson;
+    }
+    catch (e) {
+        throw new errors_1.InvalidUserInputError('package.json parsing failed with error ' + e.message);
+    }
+}
+exports.parsePkgJson = parsePkgJson;
+const getChildNode = (name, depInfo, pkgs, strictOutOfSync, includeOptionalDeps) => {
+    const childNodeKey = `${name}@${depInfo.version}`;
+    let childNode;
+    if (!pkgs[childNodeKey]) {
+        if (strictOutOfSync && !/^file:/.test(depInfo.version)) {
+            throw new errors_2.OutOfSyncError(childNodeKey, parsers_1.LockfileType.yarn);
+        }
+        else {
+            childNode = {
+                id: childNodeKey,
+                name: name,
+                version: depInfo.version,
+                dependencies: {},
+                isDev: depInfo.isDev,
+                missingLockFileEntry: true,
+            };
+        }
+    }
+    else {
+        const depData = pkgs[childNodeKey];
+        const dependencies = (0, exports.getGraphDependencies)(depData.dependencies || {}, depInfo.isDev);
+        const optionalDependencies = includeOptionalDeps
+            ? (0, exports.getGraphDependencies)(depData.optionalDependencies || {}, depInfo.isDev)
+            : {};
+        childNode = {
+            id: `${name}@${depData.version}`,
+            name: name,
+            version: depData.version,
+            dependencies: Object.assign(Object.assign({}, dependencies), optionalDependencies),
+            isDev: depInfo.isDev,
+        };
+    }
+    return childNode;
+};
+exports.getChildNode = getChildNode;
+const getChildNodeWorkspace = (name, depInfo, workspacePkgNameToVersion, pkgs, strictOutOfSync, includeOptionalDeps) => {
+    let childNode;
+    if (workspacePkgNameToVersion[name]) {
+        const version = workspacePkgNameToVersion[name];
+        // This is just to mimic old behavior where when StrictOutOfSync is turned on,
+        // any cross referencing between workspace packages will lead to a throw
+        if (strictOutOfSync) {
+            throw new errors_2.OutOfSyncError(`${name}@${version}`, parsers_1.LockfileType.yarn);
+        }
+        childNode = {
+            id: `${name}@${version}`,
+            name: name,
+            version: version,
+            dependencies: {},
+            isDev: depInfo.isDev,
+        };
+    }
+    else {
+        childNode = (0, exports.getChildNode)(name, depInfo, pkgs, strictOutOfSync, includeOptionalDeps);
+    }
+    return childNode;
+};
+exports.getChildNodeWorkspace = getChildNodeWorkspace;
+//# sourceMappingURL=util.js.map
+
+/***/ }),
+
+/***/ 6431:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.buildDepGraphYarnLockV1SimpleCyclesPruned = void 0;
+const dep_graph_1 = __webpack_require__(53789);
+const util_1 = __webpack_require__(46200);
+var Color;
+(function (Color) {
+    Color[Color["GRAY"] = 0] = "GRAY";
+    Color[Color["BLACK"] = 1] = "BLACK";
+})(Color || (Color = {}));
+const buildDepGraphYarnLockV1SimpleCyclesPruned = (extractedYarnLockV1Pkgs, pkgJson, options) => {
+    const { includeDevDeps, strictOutOfSync, includeOptionalDeps } = options;
+    const depGraphBuilder = new dep_graph_1.DepGraphBuilder({ name: 'yarn' }, { name: pkgJson.name, version: pkgJson.version });
+    const colorMap = {};
+    const topLevelDeps = (0, util_1.getTopLevelDeps)(pkgJson, { includeDevDeps });
+    const rootNode = {
+        id: 'root-node',
+        name: pkgJson.name,
+        version: pkgJson.version,
+        dependencies: topLevelDeps,
+        isDev: false,
+    };
+    dfsVisit(depGraphBuilder, rootNode, colorMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+    return depGraphBuilder.build();
+};
+exports.buildDepGraphYarnLockV1SimpleCyclesPruned = buildDepGraphYarnLockV1SimpleCyclesPruned;
+/**
+ * Use DFS to add all nodes and edges to the depGraphBuilder and prune cyclic nodes.
+ * The colorMap keep track of the state of node during traversal.
+ *  - If a node doesn't exist in the map, it means it hasn't been visited.
+ *  - If a node is GRAY, it means it has already been discovered but its subtree hasn't been fully traversed.
+ *  - If a node is BLACK, it means its subtree has already been fully traversed.
+ *  - When first exploring an edge, if it points to a GRAY node, a cycle is found and the GRAY node is pruned.
+ *     - A pruned node has id `${originalId}|1`
+ */
+const dfsVisit = (depGraphBuilder, node, colorMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps) => {
+    colorMap[node.id] = Color.GRAY;
+    for (const [name, depInfo] of Object.entries(node.dependencies || {})) {
+        const childNode = (0, util_1.getChildNode)(name, depInfo, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        if (!colorMap.hasOwnProperty(childNode.id)) {
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, {});
+            dfsVisit(depGraphBuilder, childNode, colorMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        }
+        else if (colorMap[childNode.id] === Color.GRAY) {
+            // cycle detected
+            childNode.id = `${childNode.id}|1`;
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, { isCyclic: true });
+        }
+        depGraphBuilder.connectDep(node.id, childNode.id);
+    }
+    colorMap[node.id] = Color.BLACK;
+};
+//# sourceMappingURL=build-depgraph-simple-pruned.js.map
+
+/***/ }),
+
+/***/ 91379:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.buildDepGraphYarnLockV1Simple = void 0;
+const dep_graph_1 = __webpack_require__(53789);
+const util_1 = __webpack_require__(46200);
+const buildDepGraphYarnLockV1Simple = (extractedYarnLockV1Pkgs, pkgJson, options) => {
+    const { includeDevDeps, strictOutOfSync, includeOptionalDeps } = options;
+    const depGraphBuilder = new dep_graph_1.DepGraphBuilder({ name: 'yarn' }, { name: pkgJson.name, version: pkgJson.version });
+    const visitedMap = new Set();
+    const topLevelDeps = (0, util_1.getTopLevelDeps)(pkgJson, { includeDevDeps });
+    const rootNode = {
+        id: 'root-node',
+        name: pkgJson.name,
+        version: pkgJson.version,
+        dependencies: topLevelDeps,
+        isDev: false,
+    };
+    dfsVisit(depGraphBuilder, rootNode, visitedMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+    return depGraphBuilder.build();
+};
+exports.buildDepGraphYarnLockV1Simple = buildDepGraphYarnLockV1Simple;
+/**
+ * Use DFS to add all nodes and edges to the depGraphBuilder and prune cyclic nodes.
+ * The visitedMap keep track of which nodes have already been discovered during traversal.
+ *  - If a node doesn't exist in the map, it means it hasn't been visited.
+ *  - If a node is already visited, simply connect the new node with this node.
+ */
+const dfsVisit = (depGraphBuilder, node, visitedMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps) => {
+    visitedMap.add(node.id);
+    for (const [name, depInfo] of Object.entries(node.dependencies || {})) {
+        const childNode = (0, util_1.getChildNode)(name, depInfo, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        if (!visitedMap.has(childNode.id)) {
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, {});
+            dfsVisit(depGraphBuilder, childNode, visitedMap, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        }
+        depGraphBuilder.connectDep(node.id, childNode.id);
+    }
+};
+//# sourceMappingURL=build-depgraph-simple.js.map
+
+/***/ }),
+
+/***/ 92602:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.buildDepGraphYarnLockV1WorkspaceCyclesPruned = void 0;
+const dep_graph_1 = __webpack_require__(53789);
+const util_1 = __webpack_require__(46200);
+var Color;
+(function (Color) {
+    Color[Color["GRAY"] = 0] = "GRAY";
+    Color[Color["BLACK"] = 1] = "BLACK";
+})(Color || (Color = {}));
+// Parse a single workspace package using yarn.lock v1
+// workspaces feature
+const buildDepGraphYarnLockV1WorkspaceCyclesPruned = (extractedYarnLockV1Pkgs, pkgJson, workspacePkgNameToVersion, options) => {
+    const { includeDevDeps, strictOutOfSync, includeOptionalDeps } = options;
+    const depGraphBuilder = new dep_graph_1.DepGraphBuilder({ name: 'yarn' }, { name: pkgJson.name, version: pkgJson.version });
+    const colorMap = {};
+    const topLevelDeps = (0, util_1.getTopLevelDeps)(pkgJson, { includeDevDeps });
+    const rootNode = {
+        id: 'root-node',
+        name: pkgJson.name,
+        version: pkgJson.version,
+        dependencies: topLevelDeps,
+        isDev: false,
+    };
+    dfsVisit(depGraphBuilder, rootNode, colorMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps);
+    return depGraphBuilder.build();
+};
+exports.buildDepGraphYarnLockV1WorkspaceCyclesPruned = buildDepGraphYarnLockV1WorkspaceCyclesPruned;
+/**
+ * Use DFS to add all nodes and edges to the depGraphBuilder and prune cyclic nodes.
+ * The colorMap keep track of the state of node during traversal.
+ *  - If a node doesn't exist in the map, it means it hasn't been visited.
+ *  - If a node is GRAY, it means it has already been discovered but its subtree hasn't been fully traversed.
+ *  - If a node is BLACK, it means its subtree has already been fully traversed.
+ *  - When first exploring an edge, if it points to a GRAY node, a cycle is found and the GRAY node is pruned.
+ *     - A pruned node has id `${originalId}|1`
+ * When coming across another workspace package as child node, simply add the node and edge to the graph and mark it as BLACK.
+ */
+const dfsVisit = (depGraphBuilder, node, colorMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps) => {
+    colorMap[node.id] = Color.GRAY;
+    for (const [name, depInfo] of Object.entries(node.dependencies || {})) {
+        const isWorkspacePkg = !!workspacePkgNameToVersion[name];
+        const childNode = (0, util_1.getChildNodeWorkspace)(name, depInfo, workspacePkgNameToVersion, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        if (!colorMap.hasOwnProperty(childNode.id)) {
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, {
+                isCyclic: false,
+                isWorkspacePkg,
+            });
+            if (!isWorkspacePkg) {
+                dfsVisit(depGraphBuilder, childNode, colorMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps);
+            }
+            else {
+                colorMap[childNode.id] = Color.BLACK;
+            }
+        }
+        else if (colorMap[childNode.id] === Color.GRAY) {
+            // cycle detected
+            childNode.id = `${childNode.id}|1`;
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, {
+                isCyclic: true,
+                isWorkspacePkg,
+            });
+        }
+        depGraphBuilder.connectDep(node.id, childNode.id);
+    }
+    colorMap[node.id] = Color.BLACK;
+};
+//# sourceMappingURL=build-depgraph-workspace-package-pruned.js.map
+
+/***/ }),
+
+/***/ 10860:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.buildDepGraphYarnLockV1Workspace = void 0;
+const dep_graph_1 = __webpack_require__(53789);
+const util_1 = __webpack_require__(46200);
+const buildDepGraphYarnLockV1Workspace = (extractedYarnLockV1Pkgs, pkgJson, workspacePkgNameToVersion, options) => {
+    const { includeDevDeps, strictOutOfSync, includeOptionalDeps } = options;
+    const depGraphBuilder = new dep_graph_1.DepGraphBuilder({ name: 'yarn' }, { name: pkgJson.name, version: pkgJson.version });
+    const visitedMap = new Set();
+    const topLevelDeps = (0, util_1.getTopLevelDeps)(pkgJson, { includeDevDeps });
+    const rootNode = {
+        id: 'root-node',
+        name: pkgJson.name,
+        version: pkgJson.version,
+        dependencies: topLevelDeps,
+        isDev: false,
+    };
+    dfsVisit(depGraphBuilder, rootNode, visitedMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps);
+    return depGraphBuilder.build();
+};
+exports.buildDepGraphYarnLockV1Workspace = buildDepGraphYarnLockV1Workspace;
+/**
+ * Use DFS to add all nodes and edges to the depGraphBuilder and prune cyclic nodes.
+ * The colorMap keep track of the state of node during traversal.
+ *  - If a node doesn't exist in the map, it means it hasn't been visited.
+ *  - If a node is GRAY, it means it has already been discovered but its subtree hasn't been fully traversed.
+ *  - If a node is BLACK, it means its subtree has already been fully traversed.
+ *  - When first exploring an edge, if it points to a GRAY node, a cycle is found and the GRAY node is pruned.
+ *     - A pruned node has id `${originalId}|1`
+ * When coming across another workspace package as child node, simply add the node and edge to the graph and mark it as BLACK.
+ */
+const dfsVisit = (depGraphBuilder, node, visitedMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps) => {
+    visitedMap.add(node.id);
+    for (const [name, depInfo] of Object.entries(node.dependencies || {})) {
+        const isWorkspacePkg = !!workspacePkgNameToVersion[name];
+        const childNode = (0, util_1.getChildNodeWorkspace)(name, depInfo, workspacePkgNameToVersion, extractedYarnLockV1Pkgs, strictOutOfSync, includeOptionalDeps);
+        if (!visitedMap.has(childNode.id)) {
+            (0, util_1.addPkgNodeToGraph)(depGraphBuilder, childNode, {
+                isCyclic: false,
+                isWorkspacePkg,
+            });
+            if (!isWorkspacePkg) {
+                dfsVisit(depGraphBuilder, childNode, visitedMap, extractedYarnLockV1Pkgs, workspacePkgNameToVersion, strictOutOfSync, includeOptionalDeps);
+            }
+        }
+        depGraphBuilder.connectDep(node.id, childNode.id);
+    }
+};
+//# sourceMappingURL=build-depgraph-workspace-package.js.map
+
+/***/ }),
+
+/***/ 86631:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.extractPkgsFromYarnLockV1 = void 0;
+const yarnLockfileParser = __webpack_require__(7615);
+const extractPkgsFromYarnLockV1 = (yarnLockContent) => {
+    return yarnLockfileParser.parse(yarnLockContent).object;
+};
+exports.extractPkgsFromYarnLockV1 = extractPkgsFromYarnLockV1;
+//# sourceMappingURL=extract-yarnlock-v1-pkgs.js.map
+
+/***/ }),
+
+/***/ 33248:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.buildDepGraphYarnLockV1Simple = exports.buildDepGraphYarnLockV1SimpleCyclesPruned = exports.buildDepGraphYarnLockV1Workspace = exports.buildDepGraphYarnLockV1WorkspaceCyclesPruned = exports.extractPkgsFromYarnLockV1 = exports.parseYarnLockV1Project = exports.parseYarnLockV1WorkspaceProject = void 0;
+const build_depgraph_simple_pruned_1 = __webpack_require__(6431);
+Object.defineProperty(exports, "buildDepGraphYarnLockV1SimpleCyclesPruned", ({ enumerable: true, get: function () { return build_depgraph_simple_pruned_1.buildDepGraphYarnLockV1SimpleCyclesPruned; } }));
+const build_depgraph_simple_1 = __webpack_require__(91379);
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Simple", ({ enumerable: true, get: function () { return build_depgraph_simple_1.buildDepGraphYarnLockV1Simple; } }));
+const build_depgraph_workspace_package_pruned_1 = __webpack_require__(92602);
+Object.defineProperty(exports, "buildDepGraphYarnLockV1WorkspaceCyclesPruned", ({ enumerable: true, get: function () { return build_depgraph_workspace_package_pruned_1.buildDepGraphYarnLockV1WorkspaceCyclesPruned; } }));
+const build_depgraph_workspace_package_1 = __webpack_require__(10860);
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Workspace", ({ enumerable: true, get: function () { return build_depgraph_workspace_package_1.buildDepGraphYarnLockV1Workspace; } }));
+const extract_yarnlock_v1_pkgs_1 = __webpack_require__(86631);
+Object.defineProperty(exports, "extractPkgsFromYarnLockV1", ({ enumerable: true, get: function () { return extract_yarnlock_v1_pkgs_1.extractPkgsFromYarnLockV1; } }));
+const simple_1 = __webpack_require__(98216);
+Object.defineProperty(exports, "parseYarnLockV1Project", ({ enumerable: true, get: function () { return simple_1.parseYarnLockV1Project; } }));
+const workspaces_1 = __webpack_require__(53483);
+Object.defineProperty(exports, "parseYarnLockV1WorkspaceProject", ({ enumerable: true, get: function () { return workspaces_1.parseYarnLockV1WorkspaceProject; } }));
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 98216:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseYarnLockV1Project = void 0;
+const _1 = __webpack_require__(33248);
+const util_1 = __webpack_require__(46200);
+const build_depgraph_simple_pruned_1 = __webpack_require__(6431);
+const extract_yarnlock_v1_pkgs_1 = __webpack_require__(86631);
+const parseYarnLockV1Project = async (pkgJsonContent, yarnLockContent, options) => {
+    const { includeDevDeps, includeOptionalDeps, pruneCycles, strictOutOfSync } = options;
+    const pkgs = (0, extract_yarnlock_v1_pkgs_1.extractPkgsFromYarnLockV1)(yarnLockContent);
+    const pkgJson = (0, util_1.parsePkgJson)(pkgJsonContent);
+    const depGraph = pruneCycles
+        ? (0, build_depgraph_simple_pruned_1.buildDepGraphYarnLockV1SimpleCyclesPruned)(pkgs, pkgJson, {
+            includeDevDeps,
+            strictOutOfSync,
+            includeOptionalDeps,
+        })
+        : (0, _1.buildDepGraphYarnLockV1Simple)(pkgs, pkgJson, {
+            includeDevDeps,
+            strictOutOfSync,
+            includeOptionalDeps,
+        });
+    return depGraph;
+};
+exports.parseYarnLockV1Project = parseYarnLockV1Project;
+//# sourceMappingURL=simple.js.map
+
+/***/ }),
+
+/***/ 53483:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseYarnLockV1WorkspaceProject = void 0;
+const build_depgraph_workspace_package_pruned_1 = __webpack_require__(92602);
+const build_depgraph_workspace_package_1 = __webpack_require__(10860);
+const extract_yarnlock_v1_pkgs_1 = __webpack_require__(86631);
+const util_1 = __webpack_require__(46200);
+const parseYarnLockV1WorkspaceProject = async (yarnLockContent, workspacePackagesPkgJsons, options) => {
+    const { includeDevDeps, includeOptionalDeps, pruneCycles, strictOutOfSync } = options;
+    const extractedYarnLockV1Pkgs = (0, extract_yarnlock_v1_pkgs_1.extractPkgsFromYarnLockV1)(yarnLockContent);
+    // Parse all package.json files and also extract names cross referencing later
+    const workspacePkgNameToVersion = {};
+    const parsedWorkspacePkgJsons = workspacePackagesPkgJsons.map((wsPkgJsonContent) => {
+        const parsedPkgJson = (0, util_1.parsePkgJson)(wsPkgJsonContent);
+        workspacePkgNameToVersion[parsedPkgJson.name] = parsedPkgJson.version;
+        return parsedPkgJson;
+    });
+    const depGraphs = parsedWorkspacePkgJsons.map((parsedPkgJson) => {
+        return pruneCycles
+            ? (0, build_depgraph_workspace_package_pruned_1.buildDepGraphYarnLockV1WorkspaceCyclesPruned)(extractedYarnLockV1Pkgs, parsedPkgJson, workspacePkgNameToVersion, {
+                includeDevDeps,
+                strictOutOfSync,
+                includeOptionalDeps,
+            })
+            : (0, build_depgraph_workspace_package_1.buildDepGraphYarnLockV1Workspace)(extractedYarnLockV1Pkgs, parsedPkgJson, workspacePkgNameToVersion, {
+                includeDevDeps,
+                strictOutOfSync,
+                includeOptionalDeps,
+            });
+    });
+    return depGraphs;
+};
+exports.parseYarnLockV1WorkspaceProject = parseYarnLockV1WorkspaceProject;
+//# sourceMappingURL=workspaces.js.map
+
+/***/ }),
+
 /***/ 1706:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
@@ -165810,7 +166301,7 @@ exports.UnsupportedRuntimeError = UnsupportedRuntimeError;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getYarnLockfileType = exports.OutOfSyncError = exports.InvalidUserInputError = exports.UnsupportedRuntimeError = exports.LockfileType = exports.Scope = exports.getYarnWorkspaces = exports.getYarnWorkspacesFromFiles = exports.buildDepGraphFromCliOutput = exports.buildDepTreeFromFiles = exports.buildDepTree = void 0;
+exports.getYarnLockfileType = exports.buildDepGraphYarnLockV1Workspace = exports.buildDepGraphYarnLockV1WorkspaceCyclesPruned = exports.buildDepGraphYarnLockV1Simple = exports.buildDepGraphYarnLockV1SimpleCyclesPruned = exports.parseYarnLockV1WorkspaceProject = exports.parseYarnLockV1Project = exports.extractPkgsFromYarnLockV1 = exports.OutOfSyncError = exports.InvalidUserInputError = exports.UnsupportedRuntimeError = exports.LockfileType = exports.Scope = exports.getYarnWorkspaces = exports.getYarnWorkspacesFromFiles = exports.buildDepGraphFromCliOutput = exports.buildDepTreeFromFiles = exports.buildDepTree = void 0;
 const fs = __webpack_require__(35747);
 const path = __webpack_require__(85622);
 const parsers_1 = __webpack_require__(75873);
@@ -165826,6 +166317,17 @@ Object.defineProperty(exports, "InvalidUserInputError", ({ enumerable: true, get
 Object.defineProperty(exports, "OutOfSyncError", ({ enumerable: true, get: function () { return errors_1.OutOfSyncError; } }));
 const cli_parsers_1 = __webpack_require__(27819);
 Object.defineProperty(exports, "buildDepGraphFromCliOutput", ({ enumerable: true, get: function () { return cli_parsers_1.buildDepGraphFromCliOutput; } }));
+// New Parser Functions *************
+// **********************************
+const dep_graph_builders_1 = __webpack_require__(61311);
+Object.defineProperty(exports, "extractPkgsFromYarnLockV1", ({ enumerable: true, get: function () { return dep_graph_builders_1.extractPkgsFromYarnLockV1; } }));
+Object.defineProperty(exports, "parseYarnLockV1Project", ({ enumerable: true, get: function () { return dep_graph_builders_1.parseYarnLockV1Project; } }));
+Object.defineProperty(exports, "parseYarnLockV1WorkspaceProject", ({ enumerable: true, get: function () { return dep_graph_builders_1.parseYarnLockV1WorkspaceProject; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1SimpleCyclesPruned", ({ enumerable: true, get: function () { return dep_graph_builders_1.buildDepGraphYarnLockV1SimpleCyclesPruned; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Simple", ({ enumerable: true, get: function () { return dep_graph_builders_1.buildDepGraphYarnLockV1Simple; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1WorkspaceCyclesPruned", ({ enumerable: true, get: function () { return dep_graph_builders_1.buildDepGraphYarnLockV1WorkspaceCyclesPruned; } }));
+Object.defineProperty(exports, "buildDepGraphYarnLockV1Workspace", ({ enumerable: true, get: function () { return dep_graph_builders_1.buildDepGraphYarnLockV1Workspace; } }));
+// **********************************
 async function buildDepTree(manifestFileContents, lockFileContents, includeDev = false, lockfileType, strictOutOfSync = true, defaultManifestFileName = 'package.json') {
     if (!lockfileType) {
         lockfileType = parsers_1.LockfileType.npm;
@@ -165849,7 +166351,7 @@ async function buildDepTree(manifestFileContents, lockFileContents, includeDev =
                 `${lockfileType} provided. Only 'npm' or 'yarn' is currently ` +
                 'supported.');
     }
-    const manifestFile = parsers_1.parseManifestFile(manifestFileContents);
+    const manifestFile = (0, parsers_1.parseManifestFile)(manifestFileContents);
     if (!manifestFile.name) {
         manifestFile.name = path.isAbsolute(defaultManifestFileName)
             ? path.basename(defaultManifestFileName)
@@ -165898,7 +166400,7 @@ function getYarnWorkspacesFromFiles(root, manifestFilePath) {
             `location: ${manifestFileFullPath}`);
     }
     const manifestFileContents = fs.readFileSync(manifestFileFullPath, 'utf-8');
-    return parsers_1.getYarnWorkspaces(manifestFileContents);
+    return (0, parsers_1.getYarnWorkspaces)(manifestFileContents);
 }
 exports.getYarnWorkspacesFromFiles = getYarnWorkspacesFromFiles;
 function getYarnLockfileType(lockFileContents, root, lockFilePath) {
@@ -165994,10 +166496,13 @@ function getYarnWorkspaces(targetFile) {
     try {
         const packageJson = parseManifestFile(targetFile);
         if (!!packageJson.workspaces && !!packageJson.private) {
-            const workspacesPackages = packageJson.workspaces;
-            const workspacesAlternateConfigPackages = packageJson.workspaces
-                .packages;
-            return [...(workspacesAlternateConfigPackages || workspacesPackages)];
+            if (Array.isArray(packageJson.workspaces)) {
+                return packageJson.workspaces;
+            }
+            if ('packages' in packageJson.workspaces &&
+                Array.isArray(packageJson.workspaces.packages)) {
+                return packageJson.workspaces.packages;
+            }
         }
         return false;
     }
@@ -166024,6 +166529,7 @@ const graphlib = __webpack_require__(39322);
 const uuid_1 = __webpack_require__(42277);
 const event_loop_spinner_1 = __webpack_require__(77158);
 const baseDebug = __webpack_require__(15158);
+const cli_parser_utils_1 = __webpack_require__(80333);
 const _1 = __webpack_require__(75873);
 const errors_1 = __webpack_require__(1706);
 const debug = baseDebug('snyk-nodejs-parser');
@@ -166080,7 +166586,7 @@ class LockParserBase {
         // Only include peerDependencies if using npm and npm is at least
         // version 7 as npm v7 automatically installs peerDependencies
         // get trees for dependencies from manifest file
-        const topLevelDeps = _1.getTopLevelDeps({
+        const topLevelDeps = (0, _1.getTopLevelDeps)({
             targetFile: manifestFile,
             includeDev,
             includePeerDeps: lockfile.type === _1.LockfileType.npm7,
@@ -166107,7 +166613,7 @@ class LockParserBase {
                 }
             }
             else if (/^file:/.test(dep.version)) {
-                depTree.dependencies[dep.name] = _1.createDepTreeDepFromDep(dep);
+                depTree.dependencies[dep.name] = (0, _1.createDepTreeDepFromDep)(dep);
                 treeSize++;
             }
             else {
@@ -166116,7 +166622,7 @@ class LockParserBase {
                 if (strictOutOfSync) {
                     throw new errors_1.OutOfSyncError(dep.name, this.type);
                 }
-                depTree.dependencies[dep.name] = _1.createDepTreeDepFromDep(dep);
+                depTree.dependencies[dep.name] = (0, _1.createDepTreeDepFromDep)(dep);
                 if (!depTree.dependencies[dep.name].labels) {
                     depTree.dependencies[dep.name].labels = {};
                 }
@@ -166131,9 +166637,7 @@ class LockParserBase {
         for (const [name, subTree] of _toPairs(pkgTree.dependencies)) {
             pkgTree.dependencies[name] = this.setDevDepRec(subTree);
         }
-        pkgTree.labels = {
-            scope: _1.Scope.dev,
-        };
+        pkgTree.labels = Object.assign(Object.assign({}, pkgTree.labels), { scope: _1.Scope.dev });
         return pkgTree;
     }
     /* Algorithm for cycle removal:
@@ -166225,7 +166729,7 @@ class LockParserBase {
         }
     }
     cloneNodeWithoutEdges(node, depMap, depGraph) {
-        const newNode = node + uuid_1.v4();
+        const newNode = node + (0, uuid_1.v4)();
         // update depMap with new node
         depMap[newNode] = _cloneDeep(depMap[node]);
         // add new node to the graph
@@ -166268,6 +166772,7 @@ class LockParserBase {
     // Algorithm is based on dynamic programming technique and tries to build
     // "more simple" trees and compose them into bigger ones.
     async createDepTrees(depMap, depGraph) {
+        var _a;
         // Graph has to be acyclic
         if (!graphlib.alg.isAcyclic(depGraph)) {
             throw new Error('Cycles were not removed from graph.');
@@ -166295,16 +166800,12 @@ class LockParserBase {
                 }
                 if (!subDep) {
                     debug(`Missing entry for ${subDepPath}`);
-                    const index = subDepPath.indexOf('@', 1);
-                    const name = subDepPath.slice(0, index);
-                    const identifier = subDepPath.slice(index + 1);
+                    const { name, identifier } = (0, cli_parser_utils_1.extractNameAndIdentifier)(subDepPath);
                     subDep = {
                         name: name,
                         version: identifier,
                         dependencies: {},
-                        labels: {
-                            missingLockFileEntry: 'true',
-                        },
+                        labels: Object.assign({ missingLockFileEntry: 'true' }, (((_a = dep.labels) === null || _a === void 0 ? void 0 : _a.scope) && { scope: dep.labels.scope })),
                     };
                     treeSize += 1;
                 }
@@ -166371,7 +166872,8 @@ class PackageLockParser extends lock_parser_base_1.LockParserBase {
             return packageLock;
         }
         catch (e) {
-            throw new errors_1.InvalidUserInputError('package-lock.json parsing failed with ' + `error ${e.message}`);
+            throw new errors_1.InvalidUserInputError('package-lock.json parsing failed with ' +
+                `error ${e.message}`);
         }
     }
     async getDependencyTree(manifestFile, lockfile, includeDev = false, strictOutOfSync = true) {
@@ -166577,7 +167079,7 @@ class Yarn2LockParser extends lock_parser_base_1.LockParserBase {
     }
     parseLockFile(lockFileContents) {
         try {
-            const rawYarnLock = js_yaml_1.load(lockFileContents, {
+            const rawYarnLock = (0, js_yaml_1.load)(lockFileContents, {
                 json: true,
                 schema: js_yaml_1.FAILSAFE_SCHEMA,
             });
@@ -166586,7 +167088,7 @@ class Yarn2LockParser extends lock_parser_base_1.LockParserBase {
             const structUtils = yarnCore.structUtils;
             const parseDescriptor = structUtils.parseDescriptor;
             const parseRange = structUtils.parseRange;
-            const keyNormalizer = yarn_utils_1.yarnLockFileKeyNormalizer(parseDescriptor, parseRange);
+            const keyNormalizer = (0, yarn_utils_1.yarnLockFileKeyNormalizer)(parseDescriptor, parseRange);
             Object.entries(rawYarnLock).forEach(([fullDescriptor, versionData]) => {
                 keyNormalizer(fullDescriptor).forEach((descriptor) => {
                     dependencies[descriptor] = versionData;
@@ -166663,6 +167165,1524 @@ function findResolutions(dependencies, depName, subDepKey, resolutions) {
 
 /***/ }),
 
+/***/ 20922:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DepGraphBuilder = void 0;
+const graphlib = __webpack_require__(82107);
+const dep_graph_1 = __webpack_require__(44912);
+class DepGraphBuilder {
+    constructor(pkgManager, rootPkg) {
+        this._pkgs = {};
+        this._pkgNodes = {};
+        const graph = new graphlib.Graph({
+            directed: true,
+            multigraph: false,
+            compound: false,
+        });
+        if (!rootPkg) {
+            rootPkg = {
+                name: '_root',
+                version: '0.0.0',
+            };
+        }
+        this._rootNodeId = 'root-node';
+        this._rootPkgId = DepGraphBuilder._getPkgId(rootPkg);
+        this._pkgs[this._rootPkgId] = rootPkg;
+        graph.setNode(this._rootNodeId, { pkgId: this._rootPkgId });
+        this._pkgNodes[this._rootPkgId] = new Set([this._rootNodeId]);
+        this._graph = graph;
+        this._pkgManager = pkgManager;
+    }
+    get rootNodeId() {
+        return this._rootNodeId;
+    }
+    static _getPkgId(pkg) {
+        return `${pkg.name}@${pkg.version || ''}`;
+    }
+    getPkgs() {
+        return Object.values(this._pkgs);
+    }
+    // TODO: this can create disconnected nodes
+    addPkgNode(pkgInfo, nodeId, nodeInfo) {
+        if (nodeId === this._rootNodeId) {
+            throw new Error('DepGraphBuilder.addPkgNode() cant override root node');
+        }
+        const pkgId = DepGraphBuilder._getPkgId(pkgInfo);
+        this._pkgs[pkgId] = pkgInfo;
+        this._pkgNodes[pkgId] = this._pkgNodes[pkgId] || new Set();
+        this._pkgNodes[pkgId].add(nodeId);
+        this._graph.setNode(nodeId, { pkgId, info: nodeInfo });
+        return this;
+    }
+    // TODO: this can create cycles
+    connectDep(parentNodeId, depNodeId) {
+        if (!this._graph.hasNode(parentNodeId)) {
+            throw new Error('parentNodeId does not exist');
+        }
+        if (!this._graph.hasNode(depNodeId)) {
+            throw new Error('depNodeId does not exist');
+        }
+        this._graph.setEdge(parentNodeId, depNodeId);
+        return this;
+    }
+    build() {
+        return new dep_graph_1.DepGraphImpl(this._graph, this._rootNodeId, this._pkgs, this._pkgNodes, this._pkgManager);
+    }
+}
+exports.DepGraphBuilder = DepGraphBuilder;
+//# sourceMappingURL=builder.js.map
+
+/***/ }),
+
+/***/ 28391:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.createFromJSON = exports.SUPPORTED_SCHEMA_RANGE = void 0;
+const semver = __webpack_require__(50460);
+const graphlib = __webpack_require__(82107);
+const errors_1 = __webpack_require__(50481);
+const validate_graph_1 = __webpack_require__(5141);
+const dep_graph_1 = __webpack_require__(44912);
+exports.SUPPORTED_SCHEMA_RANGE = '^1.0.0';
+/**
+ * Create a DepGraph instance from a JSON representation of a dep graph. This
+ * is typically used after passing the graph over the wire as `DepGraphData`.
+ */
+function createFromJSON(depGraphData) {
+    validateDepGraphData(depGraphData);
+    const graph = new graphlib.Graph({
+        directed: true,
+        multigraph: false,
+        compound: false,
+    });
+    const pkgs = {};
+    const pkgNodes = {};
+    for (const { id, info } of depGraphData.pkgs) {
+        pkgs[id] = info.version ? info : { ...info, version: undefined };
+    }
+    for (const node of depGraphData.graph.nodes) {
+        const pkgId = node.pkgId;
+        if (!pkgNodes[pkgId]) {
+            pkgNodes[pkgId] = new Set();
+        }
+        pkgNodes[pkgId].add(node.nodeId);
+        graph.setNode(node.nodeId, { pkgId, info: node.info });
+    }
+    for (const node of depGraphData.graph.nodes) {
+        for (const depNodeId of node.deps) {
+            graph.setEdge(node.nodeId, depNodeId.nodeId);
+        }
+    }
+    (0, validate_graph_1.validateGraph)(graph, depGraphData.graph.rootNodeId, pkgs, pkgNodes);
+    return new dep_graph_1.DepGraphImpl(graph, depGraphData.graph.rootNodeId, pkgs, pkgNodes, depGraphData.pkgManager);
+}
+exports.createFromJSON = createFromJSON;
+function assert(condition, msg) {
+    if (!condition) {
+        throw new errors_1.ValidationError(msg);
+    }
+}
+function validateDepGraphData(depGraphData) {
+    assert(!!semver.valid(depGraphData.schemaVersion) &&
+        semver.satisfies(depGraphData.schemaVersion, exports.SUPPORTED_SCHEMA_RANGE), `dep-graph schemaVersion not in "${exports.SUPPORTED_SCHEMA_RANGE}"`);
+    assert(depGraphData.pkgManager && !!depGraphData.pkgManager.name, '.pkgManager.name is missing');
+    const pkgsMap = depGraphData.pkgs.reduce((acc, cur) => {
+        assert(!(cur.id in acc), 'more than one pkg with same id');
+        assert(!!cur.info, '.pkgs item missing .info');
+        acc[cur.id] = cur.info;
+        return acc;
+    }, {});
+    const nodesMap = depGraphData.graph.nodes.reduce((acc, cur) => {
+        assert(!(cur.nodeId in acc), 'more than on node with same id');
+        acc[cur.nodeId] = cur;
+        return acc;
+    }, {});
+    const rootNodeId = depGraphData.graph.rootNodeId;
+    const rootNode = nodesMap[rootNodeId];
+    assert(rootNodeId in nodesMap, `.${rootNodeId} root graph node is missing`);
+    const rootPkgId = rootNode.pkgId;
+    assert(rootPkgId in pkgsMap, `.${rootPkgId} root pkg missing`);
+    assert(nodesMap[rootNodeId].pkgId === rootPkgId, `the root node .pkgId should be "${rootPkgId}"`);
+    const pkgIds = Object.keys(pkgsMap);
+    // NOTE: this name@version check is very strict,
+    // we can relax it later, it just makes things easier now
+    assert(pkgIds.filter((pkgId) => pkgId !== dep_graph_1.DepGraphImpl.getPkgId(pkgsMap[pkgId]))
+        .length === 0, 'pkgs ids should be name@version');
+    assert(Object.values(nodesMap).filter((node) => !(node.pkgId in pkgsMap))
+        .length === 0, 'some instance nodes belong to non-existing pkgIds');
+    assert(Object.values(pkgsMap).filter((pkg) => !pkg.name)
+        .length === 0, 'some .pkgs elements have no .name field');
+}
+//# sourceMappingURL=create-from-json.js.map
+
+/***/ }),
+
+/***/ 44912:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DepGraphImpl = void 0;
+const _isEqual = __webpack_require__(72307);
+const graphlib = __webpack_require__(82107);
+const create_from_json_1 = __webpack_require__(28391);
+class DepGraphImpl {
+    constructor(_graph, _rootNodeId, _pkgs, _pkgNodes, _pkgManager) {
+        this._graph = _graph;
+        this._rootNodeId = _rootNodeId;
+        this._pkgs = _pkgs;
+        this._pkgNodes = _pkgNodes;
+        this._pkgManager = _pkgManager;
+        this._countNodePathsToRootCache = new Map();
+        this._rootPkgId = _graph.node(_rootNodeId).pkgId;
+        this._pkgList = Object.values(_pkgs);
+        this._depPkgsList = this._pkgList.filter((pkg) => pkg !== this.rootPkg);
+    }
+    static getPkgId(pkg) {
+        return `${pkg.name}@${pkg.version || ''}`;
+    }
+    get pkgManager() {
+        return this._pkgManager;
+    }
+    get rootPkg() {
+        return this._pkgs[this._rootPkgId];
+    }
+    get rootNodeId() {
+        return this._rootNodeId;
+    }
+    /**
+     * Get all unique packages in the graph (including the root package)
+     */
+    getPkgs() {
+        return this._pkgList;
+    }
+    /**
+     * Get all unique packages in the graph (excluding the root package)
+     */
+    getDepPkgs() {
+        return this._depPkgsList;
+    }
+    getPkgNodes(pkg) {
+        const pkgId = DepGraphImpl.getPkgId(pkg);
+        const nodes = [];
+        for (const nodeId of Array.from(this._pkgNodes[pkgId])) {
+            const graphNode = this.getGraphNode(nodeId);
+            nodes.push({
+                info: graphNode.info || {},
+            });
+        }
+        return nodes;
+    }
+    getNode(nodeId) {
+        return this.getGraphNode(nodeId).info || {};
+    }
+    getNodePkg(nodeId) {
+        return this._pkgs[this.getGraphNode(nodeId).pkgId];
+    }
+    getPkgNodeIds(pkg) {
+        const pkgId = DepGraphImpl.getPkgId(pkg);
+        if (!this._pkgs[pkgId]) {
+            throw new Error(`no such pkg: ${pkgId}`);
+        }
+        return Array.from(this._pkgNodes[pkgId]);
+    }
+    getNodeDepsNodeIds(nodeId) {
+        const deps = this._graph.successors(nodeId);
+        if (!deps) {
+            throw new Error(`no such node: ${nodeId}`);
+        }
+        return deps;
+    }
+    getNodeParentsNodeIds(nodeId) {
+        const parents = this._graph.predecessors(nodeId);
+        if (!parents) {
+            throw new Error(`no such node: ${nodeId}`);
+        }
+        return parents;
+    }
+    hasCycles() {
+        // `isAcyclic` is expensive, so memoize
+        if (this._hasCycles === undefined) {
+            this._hasCycles = !graphlib.alg.isAcyclic(this._graph);
+        }
+        return this._hasCycles;
+    }
+    pkgPathsToRoot(pkg, opts) {
+        const pathsToRoot = [];
+        const limit = opts === null || opts === void 0 ? void 0 : opts.limit;
+        for (const nodeId of this.getPkgNodeIds(pkg)) {
+            const pathsFromNodeToRoot = this.pathsFromNodeToRoot(nodeId, [], {
+                limit,
+            });
+            for (const path of pathsFromNodeToRoot) {
+                pathsToRoot.push(path);
+            }
+            if (limit && pathsToRoot.length >= limit) {
+                break;
+            }
+        }
+        // note: sorting to get shorter paths first -
+        //  it's nicer - and better resembles older behaviour
+        return pathsToRoot.sort((a, b) => a.length - b.length);
+    }
+    countPathsToRoot(pkg) {
+        let count = 0;
+        for (const nodeId of this.getPkgNodeIds(pkg)) {
+            count += this.countNodePathsToRoot(nodeId);
+        }
+        return count;
+    }
+    isTransitive(pkg) {
+        const checking = new Set(this.getPkgNodeIds(pkg));
+        for (const directDep of this.getNodeDepsNodeIds(this.rootNodeId)) {
+            if (checking.has(directDep))
+                return false;
+        }
+        return true;
+    }
+    equals(other, { compareRoot = true } = {}) {
+        let otherDepGraph;
+        if (other instanceof DepGraphImpl) {
+            otherDepGraph = other;
+        }
+        else {
+            // At runtime theoretically we can have multiple versions of
+            // @snyk/dep-graph. If "other" is not an instance of the same class it is
+            // safer to rebuild it from JSON.
+            otherDepGraph = (0, create_from_json_1.createFromJSON)(other.toJSON());
+        }
+        // In theory, for the graphs created by standard means, `_.isEquals(this._data, otherDepGraph._data)`
+        // should suffice, since node IDs will be generated in a predictable way.
+        // However, there might be different versions of graph and inconsistencies
+        // in the ordering of the arrays, so we perform a deep comparison.
+        return this.nodeEquals(this, this.rootNodeId, otherDepGraph, otherDepGraph.rootNodeId, compareRoot);
+    }
+    directDepsLeadingTo(pkg) {
+        const pkgNodes = this.getPkgNodeIds(pkg);
+        const directDeps = this.getNodeDepsNodeIds(this.rootNodeId);
+        const nodes = directDeps.filter((directDep) => {
+            const reachableNodes = graphlib.alg.postorder(this._graph, [directDep]);
+            return reachableNodes.filter((node) => pkgNodes.includes(node)).length;
+        });
+        return nodes.map((node) => this.getNodePkg(node));
+    }
+    /**
+     * Create a JSON representation of a dep graph. This is typically used to
+     * send the dep graph over the wire
+     */
+    toJSON() {
+        const nodeIds = this._graph.nodes();
+        const nodes = nodeIds.reduce((acc, nodeId) => {
+            const deps = (this._graph.successors(nodeId) || []).map((depNodeId) => ({
+                nodeId: depNodeId,
+            }));
+            const node = this._graph.node(nodeId);
+            const elem = {
+                nodeId,
+                pkgId: node.pkgId,
+                deps,
+            };
+            if (node.info && Object.keys(node.info).length > 0) {
+                elem.info = node.info;
+            }
+            acc.push(elem);
+            return acc;
+        }, []);
+        const pkgs = Object.keys(this._pkgs).map((pkgId) => ({
+            id: pkgId,
+            info: this._pkgs[pkgId],
+        }));
+        return {
+            schemaVersion: DepGraphImpl.SCHEMA_VERSION,
+            pkgManager: this._pkgManager,
+            pkgs,
+            graph: {
+                rootNodeId: this._rootNodeId,
+                nodes,
+            },
+        };
+    }
+    nodeEquals(graphA, nodeIdA, graphB, nodeIdB, compareRoot, traversedPairs = new Set()) {
+        // Skip root nodes comparision if needed.
+        if (compareRoot ||
+            (nodeIdA !== graphA.rootNodeId && nodeIdB !== graphB.rootNodeId)) {
+            const pkgA = graphA.getNodePkg(nodeIdA);
+            const pkgB = graphB.getNodePkg(nodeIdB);
+            // Compare PkgInfo (name and version).
+            if (!_isEqual(pkgA, pkgB)) {
+                return false;
+            }
+            const infoA = graphA.getNode(nodeIdA);
+            const infoB = graphB.getNode(nodeIdB);
+            // Compare NodeInfo (VersionProvenance and labels).
+            if (!_isEqual(infoA, infoB)) {
+                return false;
+            }
+        }
+        let depsA = graphA.getNodeDepsNodeIds(nodeIdA);
+        let depsB = graphB.getNodeDepsNodeIds(nodeIdB);
+        // Number of dependencies should be the same.
+        if (depsA.length !== depsB.length) {
+            return false;
+        }
+        // Sort dependencies by name@version string.
+        const sortFn = (graph) => (idA, idB) => {
+            const pkgA = graph.getNodePkg(idA);
+            const pkgB = graph.getNodePkg(idB);
+            return DepGraphImpl.getPkgId(pkgA).localeCompare(DepGraphImpl.getPkgId(pkgB));
+        };
+        depsA = depsA.sort(sortFn(graphA));
+        depsB = depsB.sort(sortFn(graphB));
+        // Compare Each dependency recursively.
+        for (let i = 0; i < depsA.length; i++) {
+            const pairKey = `${depsA[i]}_${depsB[i]}`;
+            // Prevent cycles.
+            if (traversedPairs.has(pairKey)) {
+                continue;
+            }
+            traversedPairs.add(pairKey);
+            if (!this.nodeEquals(graphA, depsA[i], graphB, depsB[i], compareRoot, traversedPairs)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    getGraphNode(nodeId) {
+        const node = this._graph.node(nodeId);
+        if (!node) {
+            throw new Error(`no such node: ${nodeId}`);
+        }
+        return node;
+    }
+    pathsFromNodeToRoot(nodeId, ancestors = [], opts) {
+        const parentNodesIds = this.getNodeParentsNodeIds(nodeId);
+        const pkgInfo = this.getNodePkg(nodeId);
+        if (parentNodesIds.length === 0) {
+            return [[pkgInfo]];
+        }
+        const allPaths = [];
+        ancestors = ancestors.concat(nodeId);
+        const limit = opts.limit;
+        for (const id of parentNodesIds) {
+            if (ancestors.includes(id))
+                continue;
+            const pathsFromNodeToRoot = this.pathsFromNodeToRoot(id, ancestors, opts);
+            for (const path of pathsFromNodeToRoot) {
+                allPaths.push([pkgInfo].concat(path));
+            }
+            if (limit && allPaths.length >= limit) {
+                break;
+            }
+        }
+        return allPaths;
+    }
+    countNodePathsToRoot(nodeId, ancestors = []) {
+        if (ancestors.includes(nodeId)) {
+            return 0;
+        }
+        if (this._countNodePathsToRootCache.has(nodeId)) {
+            return this._countNodePathsToRootCache.get(nodeId) || 0;
+        }
+        const parentNodesIds = this.getNodeParentsNodeIds(nodeId);
+        if (parentNodesIds.length === 0) {
+            this._countNodePathsToRootCache.set(nodeId, 1);
+            return 1;
+        }
+        ancestors = ancestors.concat(nodeId);
+        const count = parentNodesIds.reduce((acc, parentNodeId) => {
+            return acc + this.countNodePathsToRoot(parentNodeId, ancestors);
+        }, 0);
+        this._countNodePathsToRootCache.set(nodeId, count);
+        return count;
+    }
+}
+exports.DepGraphImpl = DepGraphImpl;
+DepGraphImpl.SCHEMA_VERSION = '1.2.0';
+//# sourceMappingURL=dep-graph.js.map
+
+/***/ }),
+
+/***/ 44493:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CustomError = void 0;
+class CustomError extends Error {
+    constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, CustomError.prototype);
+        Error.captureStackTrace(this, this.constructor);
+        this.name = this.constructor.name;
+    }
+}
+exports.CustomError = CustomError;
+//# sourceMappingURL=custom-error.js.map
+
+/***/ }),
+
+/***/ 50481:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ValidationError = void 0;
+const validation_error_1 = __webpack_require__(83709);
+Object.defineProperty(exports, "ValidationError", ({ enumerable: true, get: function () { return validation_error_1.ValidationError; } }));
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 83709:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ValidationError = void 0;
+const custom_error_1 = __webpack_require__(44493);
+class ValidationError extends custom_error_1.CustomError {
+    constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, ValidationError.prototype);
+    }
+}
+exports.ValidationError = ValidationError;
+//# sourceMappingURL=validation-error.js.map
+
+/***/ }),
+
+/***/ 5141:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.validateGraph = void 0;
+const graphlib = __webpack_require__(82107);
+const errors_1 = __webpack_require__(50481);
+function assert(condition, msg) {
+    if (!condition) {
+        throw new errors_1.ValidationError(msg);
+    }
+}
+function validateGraph(graph, rootNodeId, pkgs, pkgNodes) {
+    assert((graph.predecessors(rootNodeId) || []).length === 0, `"${rootNodeId}" is not really the root`);
+    const reachableFromRoot = graphlib.alg.postorder(graph, [rootNodeId]);
+    const nodeIds = graph.nodes();
+    assert(JSON.stringify(nodeIds.sort()) === JSON.stringify(reachableFromRoot.sort()), 'not all graph nodes are reachable from root');
+    const pkgIds = Object.keys(pkgs);
+    const pkgsWithoutInstances = pkgIds.filter((pkgId) => !pkgNodes[pkgId] || pkgNodes[pkgId].size === 0);
+    assert(pkgsWithoutInstances.length === 0, 'not all pkgs have instance nodes');
+}
+exports.validateGraph = validateGraph;
+//# sourceMappingURL=validate-graph.js.map
+
+/***/ }),
+
+/***/ 44529:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.dfs = void 0;
+const each = __webpack_require__(43590);
+/*
+ * A helper that preforms a pre- or post-order traversal on the input graph
+ * and returns the nodes in the order they were visited. If the graph is
+ * undirected then this algorithm will navigate using neighbors. If the graph
+ * is directed then this algorithm will navigate using successors.
+ *
+ * Order must be one of "pre" or "post".
+ */
+function dfs(g, vs, order) {
+    if (!Array.isArray(vs)) {
+        vs = [vs];
+    }
+    const navigation = (g.isDirected() ? g.successors : g.neighbors).bind(g);
+    const acc = [];
+    const visited = {};
+    each(vs, (v) => {
+        if (!g.hasNode(v)) {
+            throw new Error('Graph does not have node: ' + v);
+        }
+        doDfs(g, v, order === 'post', visited, navigation, acc);
+    });
+    return acc;
+}
+exports.dfs = dfs;
+function doDfs(g, v, postorder, visited, navigation, acc) {
+    if (!(v in visited)) {
+        visited[v] = true;
+        if (!postorder) {
+            acc.push(v);
+        }
+        each(navigation(v), function (w) {
+            doDfs(g, w, postorder, visited, navigation, acc);
+        });
+        if (postorder) {
+            acc.push(v);
+        }
+    }
+}
+//# sourceMappingURL=dfs.js.map
+
+/***/ }),
+
+/***/ 65608:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isAcyclic = void 0;
+const topsort_1 = __webpack_require__(45706);
+function isAcyclic(g) {
+    try {
+        (0, topsort_1.topsort)(g);
+    }
+    catch (e) {
+        if (e instanceof topsort_1.CycleException) {
+            return false;
+        }
+        throw e;
+    }
+    return true;
+}
+exports.isAcyclic = isAcyclic;
+//# sourceMappingURL=is-acyclic.js.map
+
+/***/ }),
+
+/***/ 96835:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.postorder = void 0;
+const dfs_1 = __webpack_require__(44529);
+function postorder(g, vs) {
+    return (0, dfs_1.dfs)(g, vs, 'post');
+}
+exports.postorder = postorder;
+//# sourceMappingURL=postorder.js.map
+
+/***/ }),
+
+/***/ 45706:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CycleException = exports.topsort = void 0;
+const each = __webpack_require__(43590);
+const size = __webpack_require__(27946);
+function topsort(g) {
+    const visited = {};
+    const stack = {};
+    const results = [];
+    function visit(node) {
+        if (node in stack) {
+            throw new CycleException();
+        }
+        if (!(node in visited)) {
+            stack[node] = true;
+            visited[node] = true;
+            each(g.predecessors(node), visit);
+            delete stack[node];
+            results.push(node);
+        }
+    }
+    each(g.sinks(), visit);
+    if (size(visited) !== g.nodeCount()) {
+        throw new CycleException();
+    }
+    return results;
+}
+exports.topsort = topsort;
+class CycleException extends Error {
+}
+exports.CycleException = CycleException;
+//# sourceMappingURL=topsort.js.map
+
+/***/ }),
+
+/***/ 8529:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.Graph = void 0;
+/* eslint-disable prefer-rest-params */
+/* eslint-disable @typescript-eslint/no-this-alias */
+const constant = __webpack_require__(4254);
+const each = __webpack_require__(43590);
+const _filter = __webpack_require__(43590);
+const isEmpty = __webpack_require__(99245);
+const isFunction = __webpack_require__(98423);
+const isUndefined = __webpack_require__(28801);
+const reduce = __webpack_require__(34766);
+const union = __webpack_require__(96744);
+const values = __webpack_require__(17720);
+const DEFAULT_EDGE_NAME = '\x00';
+const GRAPH_NODE = '\x00';
+const EDGE_KEY_DELIM = '\x01';
+// Implementation notes:
+//
+//  * Node id query functions should return string ids for the nodes
+//  * Edge id query functions should return an "edgeObj", edge object, that is
+//    composed of enough information to uniquely identify an edge: {v, w, name}.
+//  * Internally we use an "edgeId", a stringified form of the edgeObj, to
+//    reference edges. This is because we need a performant way to look these
+//    edges up and, object properties, which have string keys, are the closest
+//    we're going to get to a performant hashtable in JavaScript.
+class Graph {
+    constructor(opts) {
+        var _a, _b, _c;
+        /* Number of nodes in the graph. Should only be changed by the implementation. */
+        this._nodeCount = 0;
+        /* Number of edges in the graph. Should only be changed by the implementation. */
+        this._edgeCount = 0;
+        this._isDirected = (_a = opts === null || opts === void 0 ? void 0 : opts.directed) !== null && _a !== void 0 ? _a : true;
+        this._isMultigraph = (_b = opts === null || opts === void 0 ? void 0 : opts.multigraph) !== null && _b !== void 0 ? _b : false;
+        this._isCompound = (_c = opts === null || opts === void 0 ? void 0 : opts.compound) !== null && _c !== void 0 ? _c : false;
+        // Label for the graph itself
+        this._label = undefined;
+        // Defaults to be set when creating a new node
+        this._defaultNodeLabelFn = constant(undefined);
+        // Defaults to be set when creating a new edge
+        this._defaultEdgeLabelFn = constant(undefined);
+        // v -> label
+        this._nodes = {};
+        if (this._isCompound) {
+            // v -> parent
+            this._parent = {};
+            // v -> children
+            this._children = {};
+            this._children[GRAPH_NODE] = {};
+        }
+        // v -> edgeObj
+        this._in = {};
+        // u -> v -> Number
+        this._preds = {};
+        // v -> edgeObj
+        this._out = {};
+        // v -> w -> Number
+        this._sucs = {};
+        // e -> edgeObj
+        this._edgeObjs = {};
+        // e -> label
+        this._edgeLabels = {};
+    }
+    /* === Graph functions ========= */
+    isDirected() {
+        return this._isDirected;
+    }
+    isMultigraph() {
+        return this._isMultigraph;
+    }
+    isCompound() {
+        return this._isCompound;
+    }
+    setGraph(label) {
+        this._label = label;
+        return this;
+    }
+    graph() {
+        return this._label;
+    }
+    /* === Node functions ========== */
+    setDefaultNodeLabel(newDefault) {
+        if (!isFunction(newDefault)) {
+            newDefault = constant(newDefault);
+        }
+        this._defaultNodeLabelFn = newDefault;
+        return this;
+    }
+    nodeCount() {
+        return this._nodeCount;
+    }
+    nodes() {
+        return Object.keys(this._nodes);
+    }
+    sources() {
+        const self = this;
+        return _filter(this.nodes(), function (v) {
+            return isEmpty(self._in[v]);
+        });
+    }
+    sinks() {
+        const self = this;
+        return _filter(this.nodes(), function (v) {
+            return isEmpty(self._out[v]);
+        });
+    }
+    setNodes(vs, value) {
+        const args = arguments;
+        const self = this;
+        each(vs, function (v) {
+            if (args.length > 1) {
+                self.setNode(v, value);
+            }
+            else {
+                self.setNode(v);
+            }
+        });
+        return this;
+    }
+    setNode(v, value) {
+        if (v in this._nodes) {
+            if (arguments.length > 1) {
+                this._nodes[v] = value;
+            }
+            return this;
+        }
+        this._nodes[v] = arguments.length > 1 ? value : this._defaultNodeLabelFn(v);
+        if (this._isCompound) {
+            this._parent[v] = GRAPH_NODE;
+            this._children[v] = {};
+            this._children[GRAPH_NODE][v] = true;
+        }
+        this._in[v] = {};
+        this._preds[v] = {};
+        this._out[v] = {};
+        this._sucs[v] = {};
+        ++this._nodeCount;
+        return this;
+    }
+    node(v) {
+        return this._nodes[v];
+    }
+    hasNode(v) {
+        return v in this._nodes;
+    }
+    removeNode(v) {
+        const self = this;
+        if (v in this._nodes) {
+            const removeEdge = function (e) {
+                self.removeEdge(self._edgeObjs[e]);
+            };
+            delete this._nodes[v];
+            if (this._isCompound) {
+                this._removeFromParentsChildList(v);
+                delete this._parent[v];
+                each(this.children(v), function (child) {
+                    self.setParent(child);
+                });
+                delete this._children[v];
+            }
+            each(Object.keys(this._in[v]), removeEdge);
+            delete this._in[v];
+            delete this._preds[v];
+            each(Object.keys(this._out[v]), removeEdge);
+            delete this._out[v];
+            delete this._sucs[v];
+            --this._nodeCount;
+        }
+        return this;
+    }
+    setParent(v, parent) {
+        if (!this._isCompound) {
+            throw new Error('Cannot set parent in a non-compound graph');
+        }
+        if (isUndefined(parent)) {
+            parent = GRAPH_NODE;
+        }
+        else {
+            // Coerce parent to string
+            parent += '';
+            for (let ancestor = parent; !isUndefined(ancestor); ancestor = this.parent(ancestor)) {
+                if (ancestor === v) {
+                    throw new Error('Setting ' +
+                        parent +
+                        ' as parent of ' +
+                        v +
+                        ' would create a cycle');
+                }
+            }
+            this.setNode(parent);
+        }
+        this.setNode(v);
+        this._removeFromParentsChildList(v);
+        this._parent[v] = parent;
+        this._children[parent][v] = true;
+        return this;
+    }
+    _removeFromParentsChildList(v) {
+        delete this._children[this._parent[v]][v];
+    }
+    parent(v) {
+        if (this._isCompound) {
+            const parent = this._parent[v];
+            if (parent !== GRAPH_NODE) {
+                return parent;
+            }
+        }
+    }
+    children(v) {
+        if (isUndefined(v)) {
+            v = GRAPH_NODE;
+        }
+        if (this._isCompound) {
+            const children = this._children[v];
+            if (children) {
+                return Object.keys(children);
+            }
+        }
+        else if (v === GRAPH_NODE) {
+            return this.nodes();
+        }
+        else if (this.hasNode(v)) {
+            return [];
+        }
+    }
+    predecessors(v) {
+        const predsV = this._preds[v];
+        if (predsV) {
+            return Object.keys(predsV);
+        }
+    }
+    successors(v) {
+        const sucsV = this._sucs[v];
+        if (sucsV) {
+            return Object.keys(sucsV);
+        }
+    }
+    neighbors(v) {
+        const preds = this.predecessors(v);
+        if (preds) {
+            return union(preds, this.successors(v));
+        }
+    }
+    isLeaf(v) {
+        let neighbors;
+        if (this.isDirected()) {
+            neighbors = this.successors(v);
+        }
+        else {
+            neighbors = this.neighbors(v);
+        }
+        return neighbors.length === 0;
+    }
+    filterNodes(filter) {
+        const copy = new Graph({
+            directed: this._isDirected,
+            multigraph: this._isMultigraph,
+            compound: this._isCompound,
+        });
+        copy.setGraph(this.graph());
+        const self = this;
+        each(this._nodes, function (value, v) {
+            if (filter(v)) {
+                copy.setNode(v, value);
+            }
+        });
+        each(this._edgeObjs, function (e) {
+            if (copy.hasNode(e.v) && copy.hasNode(e.w)) {
+                copy.setEdge(e, self.edge(e));
+            }
+        });
+        const parents = {};
+        function findParent(v) {
+            const parent = self.parent(v);
+            if (parent === undefined || copy.hasNode(parent)) {
+                parents[v] = parent;
+                return parent;
+            }
+            else if (parent in parents) {
+                return parents[parent];
+            }
+            else {
+                return findParent(parent);
+            }
+        }
+        if (this._isCompound) {
+            each(copy.nodes(), function (v) {
+                copy.setParent(v, findParent(v));
+            });
+        }
+        return copy;
+    }
+    /* === Edge functions ========== */
+    setDefaultEdgeLabel(newDefault) {
+        if (!isFunction(newDefault)) {
+            newDefault = constant(newDefault);
+        }
+        this._defaultEdgeLabelFn = newDefault;
+        return this;
+    }
+    edgeCount() {
+        return this._edgeCount;
+    }
+    edges() {
+        return values(this._edgeObjs);
+    }
+    setPath(vs, value) {
+        const self = this;
+        const args = arguments;
+        reduce(vs, function (v, w) {
+            if (args.length > 1) {
+                self.setEdge(v, w, value);
+            }
+            else {
+                self.setEdge(v, w);
+            }
+            return w;
+        });
+        return this;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setEdge(...args) {
+        let v, w, name, value;
+        let valueSpecified = false;
+        const arg0 = arguments[0];
+        if (typeof arg0 === 'object' && arg0 !== null && 'v' in arg0) {
+            v = arg0.v;
+            w = arg0.w;
+            name = arg0.name;
+            if (arguments.length === 2) {
+                value = arguments[1];
+                valueSpecified = true;
+            }
+        }
+        else {
+            v = arg0;
+            w = arguments[1];
+            name = arguments[3];
+            if (arguments.length > 2) {
+                value = arguments[2];
+                valueSpecified = true;
+            }
+        }
+        v = '' + v;
+        w = '' + w;
+        if (!isUndefined(name)) {
+            name = '' + name;
+        }
+        const e = edgeArgsToId(this._isDirected, v, w, name);
+        if (e in this._edgeLabels) {
+            if (valueSpecified) {
+                this._edgeLabels[e] = value;
+            }
+            return this;
+        }
+        if (!isUndefined(name) && !this._isMultigraph) {
+            throw new Error('Cannot set a named edge when isMultigraph = false');
+        }
+        // It didn't exist, so we need to create it.
+        // First ensure the nodes exist.
+        this.setNode(v);
+        this.setNode(w);
+        this._edgeLabels[e] = valueSpecified
+            ? value
+            : this._defaultEdgeLabelFn(v, w, name);
+        const edgeObj = edgeArgsToObj(this._isDirected, v, w, name);
+        // Ensure we add undirected edges in a consistent way.
+        v = edgeObj.v;
+        w = edgeObj.w;
+        Object.freeze(edgeObj);
+        this._edgeObjs[e] = edgeObj;
+        incrementOrInitEntry(this._preds[w], v);
+        incrementOrInitEntry(this._sucs[v], w);
+        this._in[w][e] = edgeObj;
+        this._out[v][e] = edgeObj;
+        this._edgeCount++;
+        return this;
+    }
+    edge(v, w, name) {
+        const e = arguments.length === 1
+            ? edgeObjToId(this._isDirected, arguments[0])
+            : edgeArgsToId(this._isDirected, v, w, name);
+        return this._edgeLabels[e];
+    }
+    hasEdge(v, w, name) {
+        const e = arguments.length === 1
+            ? edgeObjToId(this._isDirected, arguments[0])
+            : edgeArgsToId(this._isDirected, v, w, name);
+        return e in this._edgeLabels;
+    }
+    removeEdge(v, w, name) {
+        const e = arguments.length === 1
+            ? edgeObjToId(this._isDirected, arguments[0])
+            : edgeArgsToId(this._isDirected, v, w, name);
+        const edge = this._edgeObjs[e];
+        if (edge) {
+            v = edge.v;
+            w = edge.w;
+            delete this._edgeLabels[e];
+            delete this._edgeObjs[e];
+            decrementOrRemoveEntry(this._preds[w], v);
+            decrementOrRemoveEntry(this._sucs[v], w);
+            delete this._in[w][e];
+            delete this._out[v][e];
+            this._edgeCount--;
+        }
+        return this;
+    }
+    inEdges(v, u) {
+        const inV = this._in[v];
+        if (inV) {
+            const edges = values(inV);
+            if (!u) {
+                return edges;
+            }
+            return _filter(edges, function (edge) {
+                return edge.v === u;
+            });
+        }
+    }
+    outEdges(v, w) {
+        const outV = this._out[v];
+        if (outV) {
+            const edges = values(outV);
+            if (!w) {
+                return edges;
+            }
+            return _filter(edges, function (edge) {
+                return edge.w === w;
+            });
+        }
+    }
+    nodeEdges(v, w) {
+        const inEdges = this.inEdges(v, w);
+        if (inEdges) {
+            return inEdges.concat(this.outEdges(v, w));
+        }
+    }
+}
+exports.Graph = Graph;
+function incrementOrInitEntry(map, k) {
+    if (map[k]) {
+        map[k]++;
+    }
+    else {
+        map[k] = 1;
+    }
+}
+function decrementOrRemoveEntry(map, k) {
+    if (!--map[k]) {
+        delete map[k];
+    }
+}
+function edgeArgsToId(isDirected, v_, w_, name) {
+    let v = '' + v_;
+    let w = '' + w_;
+    if (!isDirected && v > w) {
+        const tmp = v;
+        v = w;
+        w = tmp;
+    }
+    return (v +
+        EDGE_KEY_DELIM +
+        w +
+        EDGE_KEY_DELIM +
+        (isUndefined(name) ? DEFAULT_EDGE_NAME : name));
+}
+function edgeArgsToObj(isDirected, v_, w_, name) {
+    let v = '' + v_;
+    let w = '' + w_;
+    if (!isDirected && v > w) {
+        const tmp = v;
+        v = w;
+        w = tmp;
+    }
+    const edgeObj = { v: v, w: w };
+    if (name) {
+        edgeObj.name = name;
+    }
+    return edgeObj;
+}
+function edgeObjToId(isDirected, edgeObj) {
+    return edgeArgsToId(isDirected, edgeObj.v, edgeObj.w, edgeObj.name);
+}
+//# sourceMappingURL=graph.js.map
+
+/***/ }),
+
+/***/ 82107:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.alg = exports.Graph = void 0;
+var graph_1 = __webpack_require__(8529);
+Object.defineProperty(exports, "Graph", ({ enumerable: true, get: function () { return graph_1.Graph; } }));
+const is_acyclic_1 = __webpack_require__(65608);
+const postorder_1 = __webpack_require__(96835);
+exports.alg = {
+    isAcyclic: is_acyclic_1.isAcyclic,
+    postorder: postorder_1.postorder,
+};
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 53789:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.legacy = exports.Errors = exports.DepGraphBuilder = exports.createFromJSON = void 0;
+var create_from_json_1 = __webpack_require__(28391);
+Object.defineProperty(exports, "createFromJSON", ({ enumerable: true, get: function () { return create_from_json_1.createFromJSON; } }));
+var builder_1 = __webpack_require__(20922);
+Object.defineProperty(exports, "DepGraphBuilder", ({ enumerable: true, get: function () { return builder_1.DepGraphBuilder; } }));
+const Errors = __webpack_require__(50481);
+exports.Errors = Errors;
+const legacy = __webpack_require__(15195);
+exports.legacy = legacy;
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 37680:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.partitionCycles = exports.getCycle = void 0;
+function getCycle(ancestors, nodeId) {
+    if (!ancestors.includes(nodeId)) {
+        return null;
+    }
+    // first item is where the cycle starts and ends.
+    return ancestors.slice(ancestors.indexOf(nodeId));
+}
+exports.getCycle = getCycle;
+function partitionCycles(nodeId, allCyclesTheNodeIsPartOf) {
+    const cyclesStartWithThisNode = [];
+    const cyclesWithThisNode = [];
+    for (const cycle of allCyclesTheNodeIsPartOf) {
+        const nodeStartsCycle = cycle[0] === nodeId;
+        if (nodeStartsCycle) {
+            cyclesStartWithThisNode.push(cycle);
+        }
+        else {
+            cyclesWithThisNode.push(cycle);
+        }
+    }
+    return { cyclesStartWithThisNode, cyclesWithThisNode };
+}
+exports.partitionCycles = partitionCycles;
+//# sourceMappingURL=cycles.js.map
+
+/***/ }),
+
+/***/ 15195:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.graphToDepTree = exports.depTreeToGraph = void 0;
+const crypto = __webpack_require__(76417);
+const event_loop_spinner_1 = __webpack_require__(77158);
+const builder_1 = __webpack_require__(20922);
+const objectHash = __webpack_require__(37266);
+const cycles_1 = __webpack_require__(37680);
+const memiozation_1 = __webpack_require__(6720);
+function addLabel(dep, key, value) {
+    if (!dep.labels) {
+        dep.labels = {};
+    }
+    dep.labels[key] = value;
+}
+/**
+ * @deprecated Don't use dep trees as an intermediate step, because they are
+ * large structures, resulting in high memory usage and high CPU costs from
+ * serializing / deserializing. Instead, create a graph directly with
+ * {@link DepGraphBuilder}
+ */
+async function depTreeToGraph(depTree, pkgManagerName) {
+    const rootPkg = {
+        name: depTree.name,
+        version: depTree.version || undefined,
+    };
+    const pkgManagerInfo = {
+        name: pkgManagerName,
+    };
+    const targetOS = depTree.targetOS;
+    if (targetOS) {
+        pkgManagerInfo.repositories = [
+            {
+                alias: `${targetOS.name}:${targetOS.version}`,
+            },
+        ];
+    }
+    const builder = new builder_1.DepGraphBuilder(pkgManagerInfo, rootPkg);
+    await buildGraph(builder, depTree, depTree.name, true);
+    const depGraph = await builder.build();
+    return shortenNodeIds(depGraph);
+}
+exports.depTreeToGraph = depTreeToGraph;
+async function buildGraph(builder, depTree, pkgName, isRoot = false, memoizationMap = new Map()) {
+    if (memoizationMap.has(depTree)) {
+        return memoizationMap.get(depTree);
+    }
+    const getNodeId = (name, version, hashId) => `${name}@${version || ''}|${hashId}`;
+    const depNodesIds = [];
+    const hash = crypto.createHash('sha1');
+    if (depTree.versionProvenance) {
+        hash.update(objectHash(depTree.versionProvenance));
+    }
+    if (depTree.labels) {
+        hash.update(objectHash(depTree.labels));
+    }
+    const deps = depTree.dependencies || {};
+    // filter-out invalid null deps (shouldn't happen - but did...)
+    const depNames = Object.keys(deps).filter((d) => !!deps[d]);
+    for (const depName of depNames.sort()) {
+        const dep = deps[depName];
+        const subtreeHash = await buildGraph(builder, dep, depName, false, memoizationMap);
+        const depPkg = {
+            name: depName,
+            version: dep.version,
+        };
+        const depNodeId = getNodeId(depPkg.name, depPkg.version, subtreeHash);
+        depNodesIds.push(depNodeId);
+        const nodeInfo = {};
+        if (dep.versionProvenance) {
+            nodeInfo.versionProvenance = dep.versionProvenance;
+        }
+        if (dep.labels) {
+            nodeInfo.labels = dep.labels;
+        }
+        builder.addPkgNode(depPkg, depNodeId, nodeInfo);
+        hash.update(depNodeId);
+    }
+    const treeHash = hash.digest('hex');
+    let pkgNodeId;
+    if (isRoot) {
+        pkgNodeId = builder.rootNodeId;
+    }
+    else {
+        // we don't assume depTree has a .name to support output of `npm list --json`
+        const pkg = {
+            name: pkgName,
+            version: depTree.version,
+        };
+        pkgNodeId = getNodeId(pkg.name, pkg.version, treeHash);
+        const nodeInfo = {};
+        if (depTree.versionProvenance) {
+            nodeInfo.versionProvenance = depTree.versionProvenance;
+        }
+        if (depTree.labels) {
+            nodeInfo.labels = depTree.labels;
+        }
+        builder.addPkgNode(pkg, pkgNodeId, nodeInfo);
+    }
+    for (const depNodeId of depNodesIds) {
+        builder.connectDep(pkgNodeId, depNodeId);
+    }
+    if (depNodesIds.length > 0 && event_loop_spinner_1.eventLoopSpinner.isStarving()) {
+        await event_loop_spinner_1.eventLoopSpinner.spin();
+    }
+    memoizationMap.set(depTree, treeHash);
+    return treeHash;
+}
+async function shortenNodeIds(depGraph) {
+    const builder = new builder_1.DepGraphBuilder(depGraph.pkgManager, depGraph.rootPkg);
+    const nodesMap = {};
+    // create nodes with shorter ids
+    for (const pkg of depGraph.getPkgs()) {
+        const nodeIds = depGraph.getPkgNodeIds(pkg);
+        for (let i = 0; i < nodeIds.length; i++) {
+            const nodeId = nodeIds[i];
+            if (nodeId === depGraph.rootNodeId) {
+                continue;
+            }
+            const nodeInfo = depGraph.getNode(nodeId);
+            let newNodeId;
+            if (nodeIds.length === 1) {
+                newNodeId = `${trimAfterLastSep(nodeId, '|')}`;
+            }
+            else {
+                newNodeId = `${trimAfterLastSep(nodeId, '|')}|${i + 1}`;
+            }
+            nodesMap[nodeId] = newNodeId;
+            builder.addPkgNode(pkg, newNodeId, nodeInfo);
+        }
+        if (event_loop_spinner_1.eventLoopSpinner.isStarving()) {
+            await event_loop_spinner_1.eventLoopSpinner.spin();
+        }
+    }
+    // connect nodes
+    for (const pkg of depGraph.getPkgs()) {
+        for (const nodeId of depGraph.getPkgNodeIds(pkg)) {
+            for (const depNodeId of depGraph.getNodeDepsNodeIds(nodeId)) {
+                const parentNode = nodesMap[nodeId] || nodeId;
+                const childNode = nodesMap[depNodeId] || depNodeId;
+                builder.connectDep(parentNode, childNode);
+            }
+        }
+        if (event_loop_spinner_1.eventLoopSpinner.isStarving()) {
+            await event_loop_spinner_1.eventLoopSpinner.spin();
+        }
+    }
+    return builder.build();
+}
+/**
+ * @deprecated Don't use dep trees. You should adapt your code to use graphs,
+ * and enhance the dep-graph library if there is missing functionality from
+ * the graph structure
+ */
+async function graphToDepTree(depGraphInterface, pkgType, opts = { deduplicateWithinTopLevelDeps: false }) {
+    const depGraph = depGraphInterface;
+    const [depTree] = await buildSubtree(depGraph, depGraph.rootNodeId, opts.deduplicateWithinTopLevelDeps ? null : false);
+    depTree.type = depGraph.pkgManager.name;
+    depTree.packageFormatVersion = constructPackageFormatVersion(pkgType);
+    const targetOS = constructTargetOS(depGraph);
+    if (targetOS) {
+        depTree.targetOS = targetOS;
+    }
+    return depTree;
+}
+exports.graphToDepTree = graphToDepTree;
+function constructPackageFormatVersion(pkgType) {
+    if (pkgType === 'maven') {
+        pkgType = 'mvn';
+    }
+    return `${pkgType}:0.0.1`;
+}
+function constructTargetOS(depGraph) {
+    if (['apk', 'apt', 'deb', 'rpm', 'linux'].indexOf(depGraph.pkgManager.name) ===
+        -1) {
+        // .targetOS is undefined unless its a linux pkgManager
+        return;
+    }
+    if (!depGraph.pkgManager.repositories ||
+        !depGraph.pkgManager.repositories.length ||
+        !depGraph.pkgManager.repositories[0].alias) {
+        throw new Error('Incomplete .pkgManager, could not create .targetOS');
+    }
+    const [name, version] = depGraph.pkgManager.repositories[0].alias.split(':');
+    return { name, version };
+}
+async function buildSubtree(depGraph, nodeId, maybeDeduplicationSet = false, // false = disabled; null = not in deduplication scope yet
+ancestors = [], memoizationMap = new Map()) {
+    if (!maybeDeduplicationSet) {
+        const memoizedDepTree = (0, memiozation_1.getMemoizedDepTree)(nodeId, ancestors, memoizationMap);
+        if (memoizedDepTree) {
+            return [memoizedDepTree, undefined];
+        }
+    }
+    const isRoot = nodeId === depGraph.rootNodeId;
+    const nodePkg = depGraph.getNodePkg(nodeId);
+    const nodeInfo = depGraph.getNode(nodeId);
+    const depTree = {};
+    depTree.name = nodePkg.name;
+    depTree.version = nodePkg.version;
+    if (nodeInfo.versionProvenance) {
+        depTree.versionProvenance = nodeInfo.versionProvenance;
+    }
+    if (nodeInfo.labels) {
+        depTree.labels = { ...nodeInfo.labels };
+    }
+    const depInstanceIds = depGraph.getNodeDepsNodeIds(nodeId);
+    if (!depInstanceIds || depInstanceIds.length === 0) {
+        memoizationMap.set(nodeId, { depTree });
+        return [depTree, undefined];
+    }
+    const cycle = (0, cycles_1.getCycle)(ancestors, nodeId);
+    if (cycle) {
+        // This node starts a cycle and now it's the second visit.
+        addLabel(depTree, 'pruned', 'cyclic');
+        return [depTree, [cycle]];
+    }
+    if (maybeDeduplicationSet) {
+        if (maybeDeduplicationSet.has(nodeId)) {
+            if (depInstanceIds.length > 0) {
+                addLabel(depTree, 'pruned', 'true');
+            }
+            return [depTree, undefined];
+        }
+        maybeDeduplicationSet.add(nodeId);
+    }
+    const cycles = [];
+    for (const depInstId of depInstanceIds) {
+        // Deduplication of nodes occurs only within a scope of a top-level dependency.
+        // Therefore, every top-level dep gets an independent set to track duplicates.
+        if (isRoot && maybeDeduplicationSet !== false) {
+            maybeDeduplicationSet = new Set();
+        }
+        const [subtree, subtreeCycles] = await buildSubtree(depGraph, depInstId, maybeDeduplicationSet, ancestors.concat(nodeId), memoizationMap);
+        if (subtreeCycles) {
+            for (const cycle of subtreeCycles) {
+                cycles.push(cycle);
+            }
+        }
+        if (!subtree) {
+            continue;
+        }
+        if (!depTree.dependencies) {
+            depTree.dependencies = {};
+        }
+        depTree.dependencies[subtree.name] = subtree;
+    }
+    if (event_loop_spinner_1.eventLoopSpinner.isStarving()) {
+        await event_loop_spinner_1.eventLoopSpinner.spin();
+    }
+    const partitionedCycles = (0, cycles_1.partitionCycles)(nodeId, cycles);
+    (0, memiozation_1.memoize)(nodeId, memoizationMap, depTree, partitionedCycles);
+    return [depTree, partitionedCycles.cyclesWithThisNode];
+}
+function trimAfterLastSep(str, sep) {
+    return str.slice(0, str.lastIndexOf(sep));
+}
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 6720:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getMemoizedDepTree = exports.memoize = void 0;
+function memoize(nodeId, memoizationMap, depTree, partitionedCycles) {
+    const { cyclesStartWithThisNode, cyclesWithThisNode } = partitionedCycles;
+    if (cyclesStartWithThisNode.length > 0) {
+        const cycleNodeIds = new Set(...cyclesStartWithThisNode);
+        memoizationMap.set(nodeId, { depTree, cycleNodeIds });
+    }
+    else if (cyclesWithThisNode.length === 0) {
+        memoizationMap.set(nodeId, { depTree });
+    }
+    // Don't memoize nodes in cycles (cyclesWithThisNode.length > 0)
+}
+exports.memoize = memoize;
+function getMemoizedDepTree(nodeId, ancestors, memoizationMap) {
+    if (!memoizationMap.has(nodeId))
+        return null;
+    const { depTree, cycleNodeIds } = memoizationMap.get(nodeId);
+    if (!cycleNodeIds)
+        return depTree;
+    const ancestorsArePartOfTheCycle = ancestors.some((nodeId) => cycleNodeIds.has(nodeId));
+    return ancestorsArePartOfTheCycle ? null : depTree;
+}
+exports.getMemoizedDepTree = getMemoizedDepTree;
+//# sourceMappingURL=memiozation.js.map
+
+/***/ }),
+
 /***/ 59572:
 /***/ ((module, __unused_webpack_exports, __webpack_require__) => {
 
@@ -171111,6 +173131,467 @@ const forEachStep = (self, fn, node, thisp) => {
 module.exports = LRUCache
 
 
+/***/ }),
+
+/***/ 37266:
+/***/ ((module, exports, __webpack_require__) => {
+
+"use strict";
+
+
+var crypto = __webpack_require__(76417);
+
+/**
+ * Exported function
+ *
+ * Options:
+ *
+ *  - `algorithm` hash algo to be used by this instance: *'sha1', 'md5'
+ *  - `excludeValues` {true|*false} hash object keys, values ignored
+ *  - `encoding` hash encoding, supports 'buffer', '*hex', 'binary', 'base64'
+ *  - `ignoreUnknown` {true|*false} ignore unknown object types
+ *  - `replacer` optional function that replaces values before hashing
+ *  - `respectFunctionProperties` {*true|false} consider function properties when hashing
+ *  - `respectFunctionNames` {*true|false} consider 'name' property of functions for hashing
+ *  - `respectType` {*true|false} Respect special properties (prototype, constructor)
+ *    when hashing to distinguish between types
+ *  - `unorderedArrays` {true|*false} Sort all arrays before hashing
+ *  - `unorderedSets` {*true|false} Sort `Set` and `Map` instances before hashing
+ *  * = default
+ *
+ * @param {object} object value to hash
+ * @param {object} options hashing options
+ * @return {string} hash value
+ * @api public
+ */
+exports = module.exports = objectHash;
+
+function objectHash(object, options){
+  options = applyDefaults(object, options);
+
+  return hash(object, options);
+}
+
+/**
+ * Exported sugar methods
+ *
+ * @param {object} object value to hash
+ * @return {string} hash value
+ * @api public
+ */
+exports.sha1 = function(object){
+  return objectHash(object);
+};
+exports.keys = function(object){
+  return objectHash(object, {excludeValues: true, algorithm: 'sha1', encoding: 'hex'});
+};
+exports.MD5 = function(object){
+  return objectHash(object, {algorithm: 'md5', encoding: 'hex'});
+};
+exports.keysMD5 = function(object){
+  return objectHash(object, {algorithm: 'md5', encoding: 'hex', excludeValues: true});
+};
+
+// Internals
+var hashes = crypto.getHashes ? crypto.getHashes().slice() : ['sha1', 'md5'];
+hashes.push('passthrough');
+var encodings = ['buffer', 'hex', 'binary', 'base64'];
+
+function applyDefaults(object, sourceOptions){
+  sourceOptions = sourceOptions || {};
+
+  // create a copy rather than mutating
+  var options = {};
+  options.algorithm = sourceOptions.algorithm || 'sha1';
+  options.encoding = sourceOptions.encoding || 'hex';
+  options.excludeValues = sourceOptions.excludeValues ? true : false;
+  options.algorithm = options.algorithm.toLowerCase();
+  options.encoding = options.encoding.toLowerCase();
+  options.ignoreUnknown = sourceOptions.ignoreUnknown !== true ? false : true; // default to false
+  options.respectType = sourceOptions.respectType === false ? false : true; // default to true
+  options.respectFunctionNames = sourceOptions.respectFunctionNames === false ? false : true;
+  options.respectFunctionProperties = sourceOptions.respectFunctionProperties === false ? false : true;
+  options.unorderedArrays = sourceOptions.unorderedArrays !== true ? false : true; // default to false
+  options.unorderedSets = sourceOptions.unorderedSets === false ? false : true; // default to false
+  options.unorderedObjects = sourceOptions.unorderedObjects === false ? false : true; // default to true
+  options.replacer = sourceOptions.replacer || undefined;
+  options.excludeKeys = sourceOptions.excludeKeys || undefined;
+
+  if(typeof object === 'undefined') {
+    throw new Error('Object argument required.');
+  }
+
+  // if there is a case-insensitive match in the hashes list, accept it
+  // (i.e. SHA256 for sha256)
+  for (var i = 0; i < hashes.length; ++i) {
+    if (hashes[i].toLowerCase() === options.algorithm.toLowerCase()) {
+      options.algorithm = hashes[i];
+    }
+  }
+
+  if(hashes.indexOf(options.algorithm) === -1){
+    throw new Error('Algorithm "' + options.algorithm + '"  not supported. ' +
+      'supported values: ' + hashes.join(', '));
+  }
+
+  if(encodings.indexOf(options.encoding) === -1 &&
+     options.algorithm !== 'passthrough'){
+    throw new Error('Encoding "' + options.encoding + '"  not supported. ' +
+      'supported values: ' + encodings.join(', '));
+  }
+
+  return options;
+}
+
+/** Check if the given function is a native function */
+function isNativeFunction(f) {
+  if ((typeof f) !== 'function') {
+    return false;
+  }
+  var exp = /^function\s+\w*\s*\(\s*\)\s*{\s+\[native code\]\s+}$/i;
+  return exp.exec(Function.prototype.toString.call(f)) != null;
+}
+
+function hash(object, options) {
+  var hashingStream;
+
+  if (options.algorithm !== 'passthrough') {
+    hashingStream = crypto.createHash(options.algorithm);
+  } else {
+    hashingStream = new PassThrough();
+  }
+
+  if (typeof hashingStream.write === 'undefined') {
+    hashingStream.write = hashingStream.update;
+    hashingStream.end   = hashingStream.update;
+  }
+
+  var hasher = typeHasher(options, hashingStream);
+  hasher.dispatch(object);
+  if (!hashingStream.update) {
+    hashingStream.end('');
+  }
+
+  if (hashingStream.digest) {
+    return hashingStream.digest(options.encoding === 'buffer' ? undefined : options.encoding);
+  }
+
+  var buf = hashingStream.read();
+  if (options.encoding === 'buffer') {
+    return buf;
+  }
+
+  return buf.toString(options.encoding);
+}
+
+/**
+ * Expose streaming API
+ *
+ * @param {object} object  Value to serialize
+ * @param {object} options  Options, as for hash()
+ * @param {object} stream  A stream to write the serializiation to
+ * @api public
+ */
+exports.writeToStream = function(object, options, stream) {
+  if (typeof stream === 'undefined') {
+    stream = options;
+    options = {};
+  }
+
+  options = applyDefaults(object, options);
+
+  return typeHasher(options, stream).dispatch(object);
+};
+
+function typeHasher(options, writeTo, context){
+  context = context || [];
+  var write = function(str) {
+    if (writeTo.update) {
+      return writeTo.update(str, 'utf8');
+    } else {
+      return writeTo.write(str, 'utf8');
+    }
+  };
+
+  return {
+    dispatch: function(value){
+      if (options.replacer) {
+        value = options.replacer(value);
+      }
+
+      var type = typeof value;
+      if (value === null) {
+        type = 'null';
+      }
+
+      //console.log("[DEBUG] Dispatch: ", value, "->", type, " -> ", "_" + type);
+
+      return this['_' + type](value);
+    },
+    _object: function(object) {
+      var pattern = (/\[object (.*)\]/i);
+      var objString = Object.prototype.toString.call(object);
+      var objType = pattern.exec(objString);
+      if (!objType) { // object type did not match [object ...]
+        objType = 'unknown:[' + objString + ']';
+      } else {
+        objType = objType[1]; // take only the class name
+      }
+
+      objType = objType.toLowerCase();
+
+      var objectNumber = null;
+
+      if ((objectNumber = context.indexOf(object)) >= 0) {
+        return this.dispatch('[CIRCULAR:' + objectNumber + ']');
+      } else {
+        context.push(object);
+      }
+
+      if (typeof Buffer !== 'undefined' && Buffer.isBuffer && Buffer.isBuffer(object)) {
+        write('buffer:');
+        return write(object);
+      }
+
+      if(objType !== 'object' && objType !== 'function' && objType !== 'asyncfunction') {
+        if(this['_' + objType]) {
+          this['_' + objType](object);
+        } else if (options.ignoreUnknown) {
+          return write('[' + objType + ']');
+        } else {
+          throw new Error('Unknown object type "' + objType + '"');
+        }
+      }else{
+        var keys = Object.keys(object);
+        if (options.unorderedObjects) {
+          keys = keys.sort();
+        }
+        // Make sure to incorporate special properties, so
+        // Types with different prototypes will produce
+        // a different hash and objects derived from
+        // different functions (`new Foo`, `new Bar`) will
+        // produce different hashes.
+        // We never do this for native functions since some
+        // seem to break because of that.
+        if (options.respectType !== false && !isNativeFunction(object)) {
+          keys.splice(0, 0, 'prototype', '__proto__', 'constructor');
+        }
+
+        if (options.excludeKeys) {
+          keys = keys.filter(function(key) { return !options.excludeKeys(key); });
+        }
+
+        write('object:' + keys.length + ':');
+        var self = this;
+        return keys.forEach(function(key){
+          self.dispatch(key);
+          write(':');
+          if(!options.excludeValues) {
+            self.dispatch(object[key]);
+          }
+          write(',');
+        });
+      }
+    },
+    _array: function(arr, unordered){
+      unordered = typeof unordered !== 'undefined' ? unordered :
+        options.unorderedArrays !== false; // default to options.unorderedArrays
+
+      var self = this;
+      write('array:' + arr.length + ':');
+      if (!unordered || arr.length <= 1) {
+        return arr.forEach(function(entry) {
+          return self.dispatch(entry);
+        });
+      }
+
+      // the unordered case is a little more complicated:
+      // since there is no canonical ordering on objects,
+      // i.e. {a:1} < {a:2} and {a:1} > {a:2} are both false,
+      // we first serialize each entry using a PassThrough stream
+      // before sorting.
+      // also: we can’t use the same context array for all entries
+      // since the order of hashing should *not* matter. instead,
+      // we keep track of the additions to a copy of the context array
+      // and add all of them to the global context array when we’re done
+      var contextAdditions = [];
+      var entries = arr.map(function(entry) {
+        var strm = new PassThrough();
+        var localContext = context.slice(); // make copy
+        var hasher = typeHasher(options, strm, localContext);
+        hasher.dispatch(entry);
+        // take only what was added to localContext and append it to contextAdditions
+        contextAdditions = contextAdditions.concat(localContext.slice(context.length));
+        return strm.read().toString();
+      });
+      context = context.concat(contextAdditions);
+      entries.sort();
+      return this._array(entries, false);
+    },
+    _date: function(date){
+      return write('date:' + date.toJSON());
+    },
+    _symbol: function(sym){
+      return write('symbol:' + sym.toString());
+    },
+    _error: function(err){
+      return write('error:' + err.toString());
+    },
+    _boolean: function(bool){
+      return write('bool:' + bool.toString());
+    },
+    _string: function(string){
+      write('string:' + string.length + ':');
+      write(string.toString());
+    },
+    _function: function(fn){
+      write('fn:');
+      if (isNativeFunction(fn)) {
+        this.dispatch('[native]');
+      } else {
+        this.dispatch(fn.toString());
+      }
+
+      if (options.respectFunctionNames !== false) {
+        // Make sure we can still distinguish native functions
+        // by their name, otherwise String and Function will
+        // have the same hash
+        this.dispatch("function-name:" + String(fn.name));
+      }
+
+      if (options.respectFunctionProperties) {
+        this._object(fn);
+      }
+    },
+    _number: function(number){
+      return write('number:' + number.toString());
+    },
+    _xml: function(xml){
+      return write('xml:' + xml.toString());
+    },
+    _null: function() {
+      return write('Null');
+    },
+    _undefined: function() {
+      return write('Undefined');
+    },
+    _regexp: function(regex){
+      return write('regex:' + regex.toString());
+    },
+    _uint8array: function(arr){
+      write('uint8array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _uint8clampedarray: function(arr){
+      write('uint8clampedarray:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _int8array: function(arr){
+      write('int8array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _uint16array: function(arr){
+      write('uint16array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _int16array: function(arr){
+      write('int16array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _uint32array: function(arr){
+      write('uint32array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _int32array: function(arr){
+      write('int32array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _float32array: function(arr){
+      write('float32array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _float64array: function(arr){
+      write('float64array:');
+      return this.dispatch(Array.prototype.slice.call(arr));
+    },
+    _arraybuffer: function(arr){
+      write('arraybuffer:');
+      return this.dispatch(new Uint8Array(arr));
+    },
+    _url: function(url) {
+      return write('url:' + url.toString(), 'utf8');
+    },
+    _map: function(map) {
+      write('map:');
+      var arr = Array.from(map);
+      return this._array(arr, options.unorderedSets !== false);
+    },
+    _set: function(set) {
+      write('set:');
+      var arr = Array.from(set);
+      return this._array(arr, options.unorderedSets !== false);
+    },
+    _file: function(file) {
+      write('file:');
+      return this.dispatch([file.name, file.size, file.type, file.lastModfied]);
+    },
+    _blob: function() {
+      if (options.ignoreUnknown) {
+        return write('[blob]');
+      }
+
+      throw Error('Hashing Blob objects is currently not supported\n' +
+        '(see https://github.com/puleos/object-hash/issues/26)\n' +
+        'Use "options.replacer" or "options.ignoreUnknown"\n');
+    },
+    _domwindow: function() { return write('domwindow'); },
+    _bigint: function(number){
+      return write('bigint:' + number.toString());
+    },
+    /* Node.js standard native objects */
+    _process: function() { return write('process'); },
+    _timer: function() { return write('timer'); },
+    _pipe: function() { return write('pipe'); },
+    _tcp: function() { return write('tcp'); },
+    _udp: function() { return write('udp'); },
+    _tty: function() { return write('tty'); },
+    _statwatcher: function() { return write('statwatcher'); },
+    _securecontext: function() { return write('securecontext'); },
+    _connection: function() { return write('connection'); },
+    _zlib: function() { return write('zlib'); },
+    _context: function() { return write('context'); },
+    _nodescript: function() { return write('nodescript'); },
+    _httpparser: function() { return write('httpparser'); },
+    _dataview: function() { return write('dataview'); },
+    _signal: function() { return write('signal'); },
+    _fsevent: function() { return write('fsevent'); },
+    _tlswrap: function() { return write('tlswrap'); },
+  };
+}
+
+// Mini-implementation of stream.PassThrough
+// We are far from having need for the full implementation, and we can
+// make assumptions like "many writes, then only one final read"
+// and we can ignore encoding specifics
+function PassThrough() {
+  return {
+    buf: '',
+
+    write: function(b) {
+      this.buf += b;
+    },
+
+    end: function(b) {
+      this.buf += b;
+    },
+
+    read: function() {
+      return this.buf;
+    }
+  };
+}
+
+
 /***/ }),
 
 /***/ 47860:
@@ -190044,7 +192525,7 @@ function buildDepGraph(partialDepTree, projectName) {
     });
     if (projectName)
         partialDepTree.name = projectName;
-    return legacy_1.depTreeToGraph(partialDepTree, 'pip');
+    return (0, legacy_1.depTreeToGraph)(partialDepTree, 'pip');
 }
 exports.buildDepGraph = buildDepGraph;
 //# sourceMappingURL=build-dep-graph.js.map
@@ -190075,7 +192556,7 @@ function getDependencies(root, targetFile, options) {
         const includeDevDeps = !!(options.dev || false);
         // handle poetry projects by parsing manifest & lockfile and return a dep-graph
         if (path.basename(targetFile) === types_1.FILENAMES.poetry.lockfile) {
-            return poetry_1.getPoetryDependencies(command, root, targetFile, includeDevDeps);
+            return (0, poetry_1.getPoetryDependencies)(command, root, targetFile, includeDevDeps);
         }
         let baseargs = [];
         if (path.basename(targetFile) === types_1.FILENAMES.pipenv.manifest) {
@@ -190088,8 +192569,8 @@ function getDependencies(root, targetFile, options) {
             baseargs = ['run', 'python'];
         }
         const [plugin, dependencyGraph] = yield Promise.all([
-            inspect_implementation_1.getMetaData(command, baseargs, root, targetFile),
-            inspect_implementation_1.inspectInstalledDeps(command, baseargs, root, targetFile, options.allowMissing || false, includeDevDeps, options.allowEmpty, options.args, options.projectName),
+            (0, inspect_implementation_1.getMetaData)(command, baseargs, root, targetFile),
+            (0, inspect_implementation_1.inspectInstalledDeps)(command, baseargs, root, targetFile, options.allowMissing || false, includeDevDeps, options.allowEmpty, options.args, options.projectName),
         ]);
         return { plugin, dependencyGraph };
     });
@@ -190209,7 +192690,7 @@ function inspectInstalledDeps(command, baseargs, root, targetFile, allowMissing,
                 env: pythonEnv,
             });
             const result = JSON.parse(output);
-            return build_dep_graph_1.buildDepGraph(result, projectName);
+            return (0, build_dep_graph_1.buildDepGraph)(result, projectName);
         }
         catch (error) {
             if (typeof error === 'string') {
@@ -190309,7 +192790,7 @@ function getPoetryDependencies(command, root, targetFile, includeDevDeps = false
             const manifestContents = fs.readFileSync(manifestPath, 'utf-8');
             const lockfileContents = fs.readFileSync(lockfilePath, 'utf-8');
             const dependencyGraph = poetry.buildDepGraph(manifestContents, lockfileContents, includeDevDeps);
-            const plugin = yield inspect_implementation_1.getMetaData(command, [], root, targetFile);
+            const plugin = yield (0, inspect_implementation_1.getMetaData)(command, [], root, targetFile);
             return {
                 plugin,
                 package: null,
@@ -190349,7 +192830,7 @@ function execute(command, args, options) {
     return new Promise((resolve, reject) => {
         let stdout = '';
         let stderr = '';
-        const proc = child_process_1.spawn(command, args, spawnOptions);
+        const proc = (0, child_process_1.spawn)(command, args, spawnOptions);
         proc.stdout.on('data', (data) => {
             stdout = stdout + data;
         });
@@ -190367,7 +192848,7 @@ function execute(command, args, options) {
 exports.execute = execute;
 function executeSync(command, args, options) {
     const spawnOptions = makeSpawnOptions(options);
-    return child_process_1.spawnSync(command, args, spawnOptions);
+    return (0, child_process_1.spawnSync)(command, args, spawnOptions);
 }
 exports.executeSync = executeSync;
 //# sourceMappingURL=sub-process.js.map
@@ -190410,6 +192891,7 @@ exports.RequiredPackagesMissingError = RequiredPackagesMissingError;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.PythonPluginErrorNames = exports.RequiredPackagesMissingError = exports.EmptyManifestError = exports.inspect = void 0;
 var dependencies_1 = __webpack_require__(69797);
 Object.defineProperty(exports, "inspect", ({ enumerable: true, get: function () { return dependencies_1.getDependencies; } }));
 var errors_1 = __webpack_require__(99893);