JavaScript: resolve transitive deps from npm v1 lock files

rewrite-javascript/rewrite/src/javascript/node-resolution-result.ts

@@ -60,13 +60,65 @@ export interface PackageLockEntry {
 }
 
 /**
- * Parsed package-lock.json content structure (npm lockfile v3 format).
+ * Entry in a legacy npm lockfileVersion 1 `dependencies` tree (npm 5/6), with its
+ * requirements under `requires` and nested conflicting versions under `dependencies`.
+ */
+export interface LockfileV1Entry {
+    readonly version?: string;
+    readonly resolved?: string;
+    readonly integrity?: string;
+    readonly license?: string | string[] | { type?: string; url?: string };
+    readonly engines?: Record<string, string> | string[];
+    readonly requires?: Record<string, string>;
+    readonly dependencies?: Record<string, LockfileV1Entry>;
+}
+
+/**
+ * Parsed package-lock.json content structure. The `packages` map is the modern
+ * (lockfileVersion 2/3) shape; `dependencies` is the legacy lockfileVersion 1 tree.
  */
 export interface PackageLockContent {
     readonly name?: string;
     readonly version?: string;
     readonly lockfileVersion?: number;
     readonly packages?: Record<string, PackageLockEntry>;
+    readonly dependencies?: Record<string, LockfileV1Entry>;
+}
+
+/**
+ * Converts a legacy npm lockfileVersion 1 `dependencies` tree into the modern
+ * `packages` map keyed by node_modules path, so the resolver can walk transitive
+ * dependencies the same way it does for lockfileVersion 2/3 files. Returns
+ * undefined when the tree is absent or empty.
+ */
+function convertV1DependencyTree(
+    tree: Record<string, LockfileV1Entry> | undefined
+): Record<string, PackageLockEntry> | undefined {
+    if (!tree || Object.keys(tree).length === 0) {
+        return undefined;
+    }
+    const packages: Record<string, PackageLockEntry> = {};
+
+    function walk(deps: Record<string, LockfileV1Entry>, pathPrefix: string): void {
+        for (const [name, entry] of Object.entries(deps)) {
+            const pkgPath = `${pathPrefix}node_modules/${name}`;
+            packages[pkgPath] = {
+                version: entry.version,
+                resolved: entry.resolved,
+                integrity: entry.integrity,
+                license: entry.license,
+                engines: entry.engines,
+                // v1 folds all declared deps into `requires`; the resolver reads `dependencies`.
+                dependencies: entry.requires,
+            };
+            if (entry.dependencies) {
+                walk(entry.dependencies, `${pkgPath}/`);
+            }
+        }
+    }
+
+    walk(tree, "");
+    return packages;
 }
 
 /**
@@ -524,9 +576,12 @@ export function createNodeResolutionResultMarker(
     function parseResolutions(
         lockContent: PackageLockContent
     ): ResolvedDependency[] {
-        if (!lockContent.packages) return [];
-
-        const packages = lockContent.packages;
+        // Prefer the modern `packages` map; fall back to converting a legacy
+        // lockfileVersion 1 `dependencies` tree when no `packages` map is present.
+        const packages = lockContent.packages && Object.keys(lockContent.packages).length > 0
+            ? lockContent.packages
+            : convertV1DependencyTree(lockContent.dependencies);
+        if (!packages) return [];
 
         // First pass: Create all ResolvedDependency placeholders and build path map
         const packageInfos: Array<{ path: string; name: string; version: string; entry: PackageLockEntry }> = [];

rewrite-javascript/rewrite/test/javascript/fixtures/lockfiles/npm-v1/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "json-server-trimmed",
+  "version": "0.14.0",
+  "dependencies": {
+    "chalk": "^2.4.1"
+  }
+}

rewrite-javascript/rewrite/test/javascript/lockfile-parsing.test.ts

@@ -249,6 +249,52 @@ describe("Lock file parsing", () => {
         });
     });
 
+    // Legacy npm lockfileVersion 1 fixture: real entries lifted verbatim from
+    // typicode/json-server@v0.14.0 (the `chalk` dependency and its transitive closure),
+    // exercising a deep chain, a `dev` entry, and nested conflicting versions on real bytes.
+    describe("npm v1 (legacy package-lock.json)", () => {
+        test("should resolve the full graph from a lockfileVersion 1 file", async () => {
+            const marker = await parseAndGetMarker("npm-v1");
+            expect(marker).not.toBeNull();
+            expect(marker!.packageManager).toBe(PackageManager.Npm);
+            expect(marker!.resolvedDependencies.length).toBeGreaterThan(0);
+
+            // Direct dependency resolves to its locked version.
+            const chalk = marker!.dependencies.find(d => d.name === "chalk")?.resolved;
+            expect(chalk).toBeDefined();
+            expect(chalk!.version).toBe("2.4.1");
+        });
+
+        test("should resolve a deep transitive dependency", async () => {
+            const marker = await parseAndGetMarker("npm-v1");
+            expect(marker).not.toBeNull();
+
+            // chalk -> ansi-styles -> color-convert -> color-name
+            const chalk = marker!.dependencies.find(d => d.name === "chalk")!.resolved!;
+            const ansiStyles = chalk.dependencies!.find(d => d.name === "ansi-styles")!.resolved!;
+            const colorConvert = ansiStyles.dependencies!.find(d => d.name === "color-convert")!.resolved!;
+            const colorName = colorConvert.dependencies!.find(d => d.name === "color-name")!.resolved!;
+            expect(colorName.version).toBe("1.1.3");
+        });
+
+        test("should resolve nested conflicting versions by node_modules path", async () => {
+            const marker = await parseAndGetMarker("npm-v1");
+            expect(marker).not.toBeNull();
+
+            // The lock file has ansi-styles@3.2.0 at the top level (a `dev` entry) and
+            // ansi-styles@3.2.1 nested under chalk. chalk must resolve to the nested 3.2.1.
+            const chalk = marker!.dependencies.find(d => d.name === "chalk")!.resolved!;
+            const ansiStyles = chalk.dependencies!.find(d => d.name === "ansi-styles")!.resolved!;
+            expect(ansiStyles.version).toBe("3.2.1");
+
+            const ansiStylesVersions = NodeResolutionResultQueries
+                .getAllResolvedVersions(marker!, "ansi-styles")
+                .map(d => d.version)
+                .sort();
+            expect(ansiStylesVersions).toEqual(["3.2.0", "3.2.1"]);
+        });
+    });
+
     describe("bun (bun.lock)", () => {
         test("should parse all dependencies from bun.lock", async () => {
             const marker = await parseAndGetMarker("bun");