Skip to content

Add pnpm-aliased-chain regression fixture (#528)#559

Open
Ayush7614 wants to merge 1 commit into
OWASP:mainfrom
Ayush7614:ayush20
Open

Add pnpm-aliased-chain regression fixture (#528)#559
Ayush7614 wants to merge 1 commit into
OWASP:mainfrom
Ayush7614:ayush20

Conversation

@Ayush7614
Copy link
Copy Markdown
Contributor

@Ayush7614 Ayush7614 commented Jun 5, 2026

Summary

  • Adds examples/pnpm-aliased-chain/ for Discussion Help wanted: edge case lockfile fixtures for regression testing #528 fixture 6
  • Minimal crafted pnpm v9 lockfile reproducing the formisch/vm2 alias bug fixed in v1.18.2
  • Chain: vercel@vercel/remix-builder@remix-run/dev (alias → @vercel/remix-run-dev) → vm2@3.9.19
  • Lockfile entry '@remix-run/dev': '@vercel/remix-run-dev@1.16.1' — dep name differs from real package name
  • Documents fixture in examples/readme.md

Verified scan output

node dist/index.js examples/pnpm-aliased-chain --verbose
  • 4 packages parsed from pnpm-lock.yaml
  • 1 critical finding: vm2@3.9.19 (transitive)
  • Dependency path: project → vercel → @vercel/remix-builder → @vercel/remix-run-dev → vm2 (real name, not alias)
  • Fix command: pnpm add vercel@32.0.2 (parent upgrade — not a broken direct-install on the alias name)

Test plan

Closes Discussion #528 fixture 6 (regression fixture).

Minimal pnpm v9 lockfile reproducing the formisch/vm2 alias bug: deep
transitive vm2@3.9.19 through @remix-run/dev → @vercel/remix-run-dev.
Path resolution must keep the real package name and suggest pnpm add vercel.
@Ayush7614
Copy link
Copy Markdown
Contributor Author

cc: @sonukapoor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant