feat: add alias support for yarn v1 and v2

Author: aarlaud

lib/aliasesPreprocessors/pkgJson.ts

@@ -0,0 +1,37 @@
+import { parsePkgJson } from '../dep-graph-builders/util';
+
+export const rewriteAliasesPkgJson = (packageJsonContent: string): string => {
+  const pkgJsonPreprocessed = parsePkgJson(packageJsonContent);
+  pkgJsonPreprocessed.dependencies = rewriteAliases(
+    pkgJsonPreprocessed.dependencies,
+  );
+  pkgJsonPreprocessed.devDependencies = rewriteAliases(
+    pkgJsonPreprocessed.devDependencies,
+  );
+  pkgJsonPreprocessed.optionalDependencies = rewriteAliases(
+    pkgJsonPreprocessed.optionalDependencies,
+  );
+  pkgJsonPreprocessed.peerDependencies = rewriteAliases(
+    pkgJsonPreprocessed.peerDependencies,
+  );
+  return JSON.stringify(pkgJsonPreprocessed);
+};
+
+export const rewriteAliases = (
+  dependencies: Record<string, string> | undefined,
+): Record<string, string> | undefined => {
+  if (!dependencies) {
+    return undefined;
+  }
+  const newDependencies: Record<string, string> = {};
+  for (const key in dependencies) {
+    const value = dependencies[key];
+    if (value.startsWith('npm:')) {
+      newDependencies[value.substring(4, value.lastIndexOf('@'))] =
+        value.substring(value.lastIndexOf('@') + 1, value.length);
+    } else {
+      newDependencies[key] = value;
+    }
+  }
+  return newDependencies;
+};

lib/aliasesPreprocessors/yarn-lock-v1.ts

@@ -0,0 +1,7 @@
+export const rewriteAliasesInLockV1 = (lockfileContent: string): string => {
+  const regex = /^(\s*)"(.+?@npm:)([^"]+)":/gm;
+
+  const lockfilePreprocessed = lockfileContent.replace(regex, '$1"$3":');
+
+  return lockfilePreprocessed;
+};

lib/aliasesPreprocessors/yarn-lock-v2.ts

@@ -0,0 +1,42 @@
+import { NormalisedPkgs } from '../dep-graph-builders/types';
+import * as cloneDeep from 'lodash.clonedeep';
+export const rewriteAliasesInLockV2 = (
+  lockfileNormalisedPkgs: NormalisedPkgs,
+): NormalisedPkgs => {
+  const lockfileNormalisedPkgsPreprocessed: NormalisedPkgs = cloneDeep(
+    lockfileNormalisedPkgs,
+  );
+  for (const pkg in lockfileNormalisedPkgsPreprocessed) {
+    const pkgSplit = pkg.substring(0, pkg.lastIndexOf('@'));
+    const resolutionSplit =
+      lockfileNormalisedPkgsPreprocessed[pkg].resolution?.split(
+        /@npm[:%3A]/,
+      )[0];
+
+    if (
+      !pkg.startsWith('v2@workspace') &&
+      resolutionSplit &&
+      pkgSplit != resolutionSplit
+    ) {
+      const newPkg = lockfileNormalisedPkgsPreprocessed[pkg];
+      delete lockfileNormalisedPkgsPreprocessed[pkg];
+      const newKey = pkg.replace(pkgSplit, resolutionSplit);
+      lockfileNormalisedPkgsPreprocessed[newKey] = newPkg;
+    }
+    if (pkg.startsWith('v2@workspace')) {
+      const newDependencies: Record<string, string> = {};
+      for (const key in lockfileNormalisedPkgsPreprocessed[pkg].dependencies) {
+        const value = lockfileNormalisedPkgsPreprocessed[pkg].dependencies[key];
+        if (value.startsWith('npm:')) {
+          newDependencies[value.substring(4, value.lastIndexOf('@'))] =
+            value.substring(value.lastIndexOf('@') + 1, value.length);
+        } else {
+          newDependencies[key] = value;
+        }
+      }
+      lockfileNormalisedPkgsPreprocessed[pkg].dependencies = newDependencies;
+    }
+  }
+
+  return lockfileNormalisedPkgsPreprocessed;
+};

lib/dep-graph-builders/types.ts

@@ -24,6 +24,7 @@ export type NormalisedPkgs = Record<
   PkgIdentifier,
   {
     version: string; // This is resolved version
+    resolution?: string;
     dependencies: Record<string, string>;
     optionalDependencies: Record<string, string>;
   }
@@ -35,6 +36,7 @@ export type DepGraphBuildOptions = {
   strictOutOfSync: boolean;
   includePeerDeps?: boolean;
   pruneNpmStrictOutOfSync?: boolean;
+  honorAliases?: boolean;
 };
 
 export type LockFileParseOptions = {
@@ -57,6 +59,7 @@ export type YarnLockV2ProjectParseOptions = {
   includeOptionalDeps: boolean;
   strictOutOfSync: boolean;
   pruneWithinTopLevelDeps: boolean;
+  honorAliases?: boolean;
 };
 
 /*
@@ -73,6 +76,7 @@ export type YarnLockV1ProjectParseOptions = {
   includePeerDeps: boolean;
   strictOutOfSync: boolean;
   pruneLevel: PruneLevel;
+  honorAliases?: boolean;
 };
 
 export type Yarn1DepGraphBuildOptions = {

lib/dep-graph-builders/yarn-lock-v1/simple.ts

@@ -1,4 +1,7 @@
 import { buildDepGraphYarnLockV1Simple } from '.';
+import { rewriteAliasesPkgJson } from '../../aliasesPreprocessors/pkgJson';
+import { rewriteAliasesInLockV1 } from '../../aliasesPreprocessors/yarn-lock-v1';
+
 import { PackageJsonBase, YarnLockV1ProjectParseOptions } from '../types';
 import { parsePkgJson } from '../util';
 import { buildDepGraphYarnLockV1SimpleCyclesPruned } from './build-depgraph-simple-pruned';
@@ -15,11 +18,16 @@ export const parseYarnLockV1Project = async (
     includePeerDeps,
     pruneLevel,
     strictOutOfSync,
+    honorAliases,
   } = options;
 
-  const pkgs = extractPkgsFromYarnLockV1(yarnLockContent);
+  const pkgs = extractPkgsFromYarnLockV1(
+    honorAliases ? rewriteAliasesInLockV1(yarnLockContent) : yarnLockContent,
+  );
 
-  const pkgJson: PackageJsonBase = parsePkgJson(pkgJsonContent);
+  const pkgJson: PackageJsonBase = parsePkgJson(
+    honorAliases ? rewriteAliasesPkgJson(pkgJsonContent) : pkgJsonContent,
+  );
 
   const depGraph =
     pruneLevel === 'cycles'

lib/dep-graph-builders/yarn-lock-v2/simple.ts

@@ -7,6 +7,8 @@ import {
 } from '../types';
 import { buildDepGraphYarnLockV2Simple } from './build-depgraph-simple';
 import { DepGraph } from '@snyk/dep-graph';
+import { rewriteAliasesPkgJson } from '../../aliasesPreprocessors/pkgJson';
+import { rewriteAliasesInLockV2 } from '../../aliasesPreprocessors/yarn-lock-v2';
 
 export const parseYarnLockV2Project = async (
   pkgJsonContent: string,
@@ -19,11 +21,16 @@ export const parseYarnLockV2Project = async (
     includeOptionalDeps,
     strictOutOfSync,
     pruneWithinTopLevelDeps,
+    honorAliases,
   } = options;
 
-  const pkgs = extractPkgsFromYarnLockV2(yarnLockContent);
+  const pkgs = honorAliases
+    ? rewriteAliasesInLockV2(extractPkgsFromYarnLockV2(yarnLockContent))
+    : extractPkgsFromYarnLockV2(yarnLockContent);
 
-  const pkgJson: PackageJsonBase = parsePkgJson(pkgJsonContent);
+  const pkgJson: PackageJsonBase = parsePkgJson(
+    honorAliases ? rewriteAliasesPkgJson(pkgJsonContent) : pkgJsonContent,
+  );
 
   const depgraph = await buildDepGraphYarnLockV2Simple(
     pkgs,

test/jest/dep-graph-builders/aliases.test.ts

@@ -0,0 +1,93 @@
+import { join } from 'path';
+import { readFileSync } from 'fs';
+import {
+  parseNpmLockV2Project,
+  parseYarnLockV1Project,
+  parseYarnLockV2Project,
+} from '../../../lib/';
+
+describe('Testing aliases', () => {
+  it('match aliased package - yarn-lock-v1', async () => {
+    const pkgJsonContent = readFileSync(
+      join(__dirname, `./fixtures/aliases/yarn-lock-v1/package.json`),
+      'utf8',
+    );
+    const yarnLockContent = readFileSync(
+      join(__dirname, `./fixtures/aliases/yarn-lock-v1/yarn.lock`),
+      'utf8',
+    );
+
+    const newDepGraph = await parseYarnLockV1Project(
+      pkgJsonContent,
+      yarnLockContent,
+      {
+        includeDevDeps: true,
+        includeOptionalDeps: true,
+        includePeerDeps: false,
+        pruneLevel: 'withinTopLevelDeps',
+        strictOutOfSync: true,
+        honorAliases: true,
+      },
+    );
+
+    expect(newDepGraph).toBeDefined;
+
+    expect(JSON.stringify(newDepGraph)).toContain('@yao-pkg/pkg');
+    expect(JSON.stringify(newDepGraph)).not.toContain("'pkg'");
+  });
+
+  it('match aliased package - yarn-lock-v2', async () => {
+    const pkgJsonContent = readFileSync(
+      join(__dirname, `./fixtures/aliases/yarn-lock-v2/package.json`),
+      'utf8',
+    );
+    const yarnLockContent = readFileSync(
+      join(__dirname, `./fixtures/aliases/yarn-lock-v2/yarn.lock`),
+      'utf8',
+    );
+
+    const newDepGraph = await parseYarnLockV2Project(
+      pkgJsonContent,
+      yarnLockContent,
+      {
+        includeDevDeps: true,
+        includeOptionalDeps: true,
+        strictOutOfSync: true,
+        pruneWithinTopLevelDeps: true,
+        honorAliases: true,
+      },
+    );
+    console.log(JSON.stringify(newDepGraph));
+    expect(newDepGraph).toBeDefined;
+
+    expect(JSON.stringify(newDepGraph)).toContain('@yao-pkg/pkg');
+    expect(JSON.stringify(newDepGraph)).not.toContain("'pkg@");
+  });
+
+  // it('match aliased package - npm-lock-v2', async () => {
+  //   const pkgJsonContent = readFileSync(
+  //     join(__dirname, `./fixtures/aliases/package.json`),
+  //     'utf8',
+  //   );
+  //   const pkgLockContent = readFileSync(
+  //     join(__dirname, `./fixtures/aliases/package-lock.json`),
+  //     'utf8',
+  //   );
+
+  //   const newDepGraph = await parseNpmLockV2Project(
+  //     pkgJsonContent,
+  //     pkgLockContent,
+  //     {
+  //       includeDevDeps: false,
+  //       includeOptionalDeps: true,
+  //       pruneCycles: true,
+  //       strictOutOfSync: true,
+  //     },
+  //   );
+
+  //   expect(newDepGraph).toBeDefined;
+
+  //   expect(JSON.stringify(newDepGraph)).toContain('@yao-pkg/pkg');
+  //   expect(JSON.stringify(newDepGraph)).not.toContain("'pkg'");
+  // });
+});

test/jest/dep-graph-builders/fixtures/aliases/yarn-lock-v1/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "yarnalias",
+  "version": "2.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "lodash": "npm:lodash@^4.17.15",
+    "pkg": "npm:@yao-pkg/pkg@^6.4.1"
+  }
+}