-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(nodejs): parse licenses in yarn projects #4652
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work!
I left few small comments.
@nikpivkin take a look, when you have time, please.
...er/language/nodejs/yarn/testdata/yarn-classic-licenses/node_modules/is-callable/package.json
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have 1 question:
If package is installed in workspace
- does yarn
still create copy/link of package.json
file in node_mosules
/.yarn
folder?
Can you check this case?
Could you also update nodejs page in docs, please.
@DmitriyLewen yarn has only 1 |
ok, thanks for the clarification! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@nikpivkin left some comments
integration/testdata/fixtures/fs/yarn/node_modules/jquery/package.json
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
@nikpivkin I left 1 comment about debug message. Can you take a look?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Description
At the moment, dependency licenses in projects with the
yarn
package manager are not parsed. This pr adds license scanning for packages from the cache folders.yarn
(for yarn 2+) andnode_modules
(yarn classic). The license field is also checked, because it can refer to a file and then it is necessary to classify the license. (npm/npm#8795 (comment), https://docs.npmjs.com/cli/v9/configuring-npm/package-json#license)Related issues
Checklist