Skip to content

fix(dart): mark "direct overridden" pub dependencies as direct - #11070

Open
sueun-dev wants to merge 1 commit into
aquasecurity:mainfrom
sueun-dev:fix-dart-pub-direct-overridden
Open

fix(dart): mark "direct overridden" pub dependencies as direct#11070
sueun-dev wants to merge 1 commit into
aquasecurity:mainfrom
sueun-dev:fix-dart-pub-direct-overridden

Conversation

@sueun-dev

Copy link
Copy Markdown
Contributor

Description

pubspec.lock records four dependency kinds, but the parser only handled three. Pub writes dependency: "direct overridden" for any package pinned through dependency_overrides, and relationship() had no case for it, so those packages were reported as RelationshipUnknown instead of RelationshipDirect.

The kinds come from pub's lockfile writer (lib/src/lock_file.dart in dart-lang/pub):

static const _directMain = 'direct main';
static const _directDev = 'direct dev';
static const _directOverridden = 'direct overridden';
static const _transitive = 'transitive';

direct main, direct dev and direct overridden are all direct dependencies; only transitive is indirect.

This adds direct overridden to the direct case and a regression test (testdata/overridden.lock) with a package pinned via dependency_overrides, which was reported as Unknown before and is Direct after. The stale comment that said there are three kinds is corrected.

Related issues

None; found while reading the pub lockfile format.

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

pubspec.lock records four dependency kinds, but relationship() only
handled three. Pub writes "direct overridden" for packages pinned via
dependency_overrides, which fell through to RelationshipUnknown instead
of RelationshipDirect. Add it to the direct case and a regression test.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant