Skip to content

feat(manifest): parse Cargo.lock and package-lock.json for transitive dependencies - #31

Open
NePreby wants to merge 1 commit into
Flow-Pulse:mainfrom
NePreby:feat/lockfile-transitive-deps-parser
Open

NePreby wants to merge 1 commit into
Flow-Pulse:mainfrom
NePreby:feat/lockfile-transitive-deps-parser

Conversation

@NePreby

@NePreby NePreby commented Nov 9, 2026

Copy link
Copy Markdown

Summary

Fixes #6.

Overview of Changes

  1. Lockfile Parsing Engine (frontend/src/lib/manifest.ts):

    • Implemented parseCargoLock: parses Cargo.lock [[package]] blocks, identifies the root package, extracts direct dependencies by default, and extracts transitive dependencies when includeTransitive: true.
    • Implemented parsePackageLock: supports both modern package-lock.json v2/v3 (packages structure) and legacy v1 (dependencies structure).
    • Deduplication: packages with the same name are deduplicated (keeping the earliest resolved version).
    • Strict contract limit capping: capped at maxDeps (default 32, matching Soroban contract's MAX_SPLITS = 32).
    • Extended parseManifest to automatically detect lockfiles by filename or content ([[package]] or lockfileVersion).
    • Updated fetchRepoManifest to support fetching lockfiles (Cargo.lock, package-lock.json).
  2. UI Integration (frontend/src/pages/Cascades.tsx):

    • Added an includeTransitive state and checkbox in the split table import card: "Include transitive dependencies (lockfile, up to 32)".
    • Passes options through parse() and fetchRepo().
  3. Test Suites (frontend/src/lib/__tests__/manifest.test.ts):

    • Tested Cargo.lock with direct dependencies only.
    • Tested Cargo.lock with transitive dependencies enabled.
    • Tested package-lock.json (v2/v3 and v1) for both direct and transitive modes.
    • Tested deduplication and enforcement of the 32-split contract cap.
    • All 26 vitest tests passing; 0 TypeScript errors.

Payout Details

  • Network: TRX Tron (TRC20)
  • Address: TMqmJjRgVS21NL2eFtfyHciTxvE4BqGmEv

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Parse Cargo.lock and package-lock.json for transitive dependencies

1 participant