Track workspaces for transitive dependencies for uv monorepos

Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Jan 20, 2025 · d470c3e · d470c3e
1 parent 3cf90da
commit d470c3e
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 8 deletions.
diff --git a/lib/helpers/utils.js b/lib/helpers/utils.js
@@ -2613,13 +2613,17 @@ export async function parsePnpmLock(
               if (!depsWorkspaceRefs[dref]) {
                 depsWorkspaceRefs[dref] = [];
               }
-              depsWorkspaceRefs[dref].push(wref);
+              if (!depsWorkspaceRefs[dref].includes(wref)) {
+                depsWorkspaceRefs[dref].push(wref);
+              }
               if (dependenciesMap[dref]) {
                 for (const l2ref of dependenciesMap[dref]) {
                   if (!depsWorkspaceRefs[l2ref]) {
                     depsWorkspaceRefs[l2ref] = [];
                   }
-                  depsWorkspaceRefs[l2ref].push(wref);
+                  if (!depsWorkspaceRefs[l2ref].includes(wref)) {
+                    depsWorkspaceRefs[l2ref].push(wref);
+                  }
                 }
               }
             }
@@ -2701,7 +2705,7 @@ export async function parsePnpmLock(
     }
     if (depsWorkspaceRefs[apkg["bom-ref"]]?.length) {
       const wsprops = apkg.properties.filter(
-        (p) => p.name === "interal:workspaceRef",
+        (p) => p.name === "internal:workspaceRef",
       );
       if (!wsprops.length) {
         for (const wref of depsWorkspaceRefs[apkg["bom-ref"]]) {
@@ -4939,9 +4943,14 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
           ) {
             const dependentPkg = pkgBomRefMap[existingPkgMap[nameStr]];
             dependentPkg.properties = dependentPkg.properties || [];
-            for (const pprop of pkg.properties) {
-              if (pprop.name.startsWith("internal:workspace")) {
-                dependentPkg.properties.push(pprop);
+            const wsprops = dependentPkg.properties.filter(
+              (p) => p.name === "internal:workspaceRef",
+            );
+            if (!wsprops.length) {
+              for (const pprop of pkg.properties) {
+                if (pprop.name.startsWith("internal:workspace")) {
+                  dependentPkg.properties.push(pprop);
+                }
               }
             }
           }
@@ -4975,7 +4984,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
         dependentPkg.properties = dependentPkg.properties || [];
         const hasWorkspaceProps =
           dependentPkg.properties.filter((p) =>
-            p.name.startsWith("interal:workspace"),
+            p.name.startsWith("internal:workspace"),
           ).length > 0;
         if (!hasWorkspaceProps) {
           for (const pprop of parentPkg.properties) {

diff --git a/types/lib/helpers/utils.d.ts.map b/types/lib/helpers/utils.d.ts.map