fix: upgrade snyk-nodejs-lockfile-parser from 2.2.2 to 2.2.3

[alexblago-snyk]

Snyk has created this PR to upgrade snyk-nodejs-lockfile-parser from 2.2.2 to 2.2.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.

• The recommended version was released 21 days ago.

Release notes

Package name: snyk-nodejs-lockfile-parser

• 2.2.3 - 2025-10-03
  

  2.2.3 (2025-10-03)

  Bug Fixes

  • aliases in dpgrph names instd of mutating lockfiles (7e9c94a)
  • lodash import issue (350bfa9)
• 2.2.2 - 2025-07-07
  

  2.2.2 (2025-07-07)

  Bug Fixes

  • handle direct dep alias references in transitive deps - npm and yarn (00dc971)

from snyk-nodejs-lockfile-parser GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Missing Lockfile Update The dependency snyk-nodejs-lockfile-parser was updated to ^2.2.3 in package.json, but the corresponding package-lock.json changes are missing from the PR diff. This will likely cause npm ci to fail because the locked version (presumably 2.2.2) will not satisfy the new semantic version range >=2.2.3. Please ensure the updated lockfile is committed. "snyk-nodejs-lockfile-parser": "^2.2.3",

📚 Repository Context Analyzed This review considered 12 relevant code sections from 2 files (average relevance: 0.87) package.json (relevance: 0.91, lines 1-87) package-lock.json (relevance: 0.90, 11 segments, lines 17801-17900)

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Misleading Function Name The function stripUndefinedLabels has been changed to perform a full recursive tree conversion (convertPkgTreeToDepTree) rather than just stripping labels. The name is now misleading regarding both its behavior and its performance characteristics (O(N) traversal). Consider renaming it to something like adaptPkgTreeToDepTree or convertParserResultToDepTree to accurately reflect its new purpose. function stripUndefinedLabels( parserResult: lockFileParser.PkgTree, ): DepTree { return convertPkgTreeToDepTree(parserResult); } Loose Typing The functions convertDependencies and convertLabels use any for their input arguments (dependencies and labels). Since snyk-nodejs-lockfile-parser provides typed interfaces (like PkgTree used in convertPkgTreeToDepTree), consider utilizing those specific types (e.g., PkgTree['dependencies'] or similar) to ensure type safety and catch potential upstream structure changes. function convertDependencies( dependencies?: { [depName: string]: any }, ): { [depName: string]: DepTreeDep } | undefined {

📚 Repository Context Analyzed This review considered 18 relevant code sections from 4 files (average relevance: 0.86) lib/analyzer/applications/node.ts (relevance: 1.00, 5 segments, lines 301-400) package-lock.json (relevance: 0.98, 7 segments, lines 17801-17900) package.json (relevance: 0.91, lines 1-87) lib/dependency-tree/index.ts (relevance: 0.82, 2 segments, lines 201-244)

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Misleading Function Name The function stripUndefinedLabels has been updated to call convertPkgTreeToDepTree, which performs a full recursive conversion and deep copy of the dependency tree. The function name implies a shallow operation (stripping labels) but now executes a potentially expensive O(N) tree traversal. Consider renaming it to something like normalizePkgTree or removing it in favor of calling convertPkgTreeToDepTree directly to accurately reflect its behavior. function stripUndefinedLabels(parserResult: lockFileParser.PkgTree): DepTree { return convertPkgTreeToDepTree(parserResult); } Loose Type Definition The convertDependencies and convertLabels functions utilize explicit any types for their input parameters (dependencies and labels). To maintain type safety and avoid potential runtime errors with unexpected data structures, consider using the specific types exported by snyk-nodejs-lockfile-parser (e.g., PkgTree['dependencies'] or PkgTree['labels']) instead of any. [depName: string]: any; }): { [depName: string]: DepTreeDep } | undefined { if (!dependencies) { return undefined; } const convertedDeps: { [depName: string]: DepTreeDep } = {}; for (const [depName, dep] of Object.entries(dependencies)) { convertedDeps[depName] = { name: dep.name, version: dep.version, dependencies: convertDependencies(dep.dependencies), labels: convertLabels(dep.labels), }; } return convertedDeps; } function stripUndefinedLabels(parserResult: lockFileParser.PkgTree): DepTree { return convertPkgTreeToDepTree(parserResult); } async function buildDepGraph( manifestFileContents: string, lockFileContents: string, lockfileVersion: NodeLockfileVersion, shouldIncludeDevDependencies: boolean, shouldBeStrictForManifestAndLockfileOutOfSync: boolean, ): Promise<DepGraph> { switch (lockfileVersion) { case NodeLockfileVersion.YarnLockV1: return await lockFileParser.parseYarnLockV1Project( manifestFileContents, lockFileContents, { includeDevDeps: shouldIncludeDevDependencies, includeOptionalDeps: true, includePeerDeps: false, pruneLevel: "withinTopLevelDeps", strictOutOfSync: shouldBeStrictForManifestAndLockfileOutOfSync, }, ); case NodeLockfileVersion.YarnLockV2: return await lockFileParser.parseYarnLockV2Project( manifestFileContents, lockFileContents, { includeDevDeps: shouldIncludeDevDependencies, includeOptionalDeps: true, pruneWithinTopLevelDeps: true, strictOutOfSync: shouldBeStrictForManifestAndLockfileOutOfSync, }, ); case NodeLockfileVersion.NpmLockV2: case NodeLockfileVersion.NpmLockV3: return await lockFileParser.parseNpmLockV2Project( manifestFileContents, lockFileContents, { includeDevDeps: shouldIncludeDevDependencies, includeOptionalDeps: true, pruneCycles: true, strictOutOfSync: shouldBeStrictForManifestAndLockfileOutOfSync, }, ); case NodeLockfileVersion.PnpmLockV5: case NodeLockfileVersion.PnpmLockV6: case NodeLockfileVersion.PnpmLockV9: return await lockFileParser.parsePnpmProject( manifestFileContents, lockFileContents, { includeDevDeps: shouldIncludeDevDependencies, includeOptionalDeps: true, includePeerDeps: false, pruneWithinTopLevelDeps: true, strictOutOfSync: shouldBeStrictForManifestAndLockfileOutOfSync, }, lockfileVersion, ); } throw new Error( "Failed to build dep graph from current project, unknown lockfile version : " + lockfileVersion.toString() + ".", ); } async function buildDepGraphFromDepTree( manifestFileContents: string, lockFileContents: string, lockfileType: LockfileType, shouldIncludeDevDependencies: boolean, shouldBeStrictForManifestAndLockfileOutOfSync: boolean, ) { const parserResult = await lockFileParser.buildDepTree( manifestFileContents, lockFileContents, shouldIncludeDevDependencies, lockfileType, shouldBeStrictForManifestAndLockfileOutOfSync, // Don't provide a default manifest file name, prefer the parser to infer it. ); const strippedLabelsParserResult = stripUndefinedLabels(parserResult); return await legacy.depTreeToGraph(strippedLabelsParserResult, lockfileType); } export function convertPkgTreeToDepTree( pkgTree: lockFileParser.PkgTree, ): DepTree { return { name: pkgTree.name, version: pkgTree.version, dependencies: convertDependencies(pkgTree.dependencies), labels: convertLabels(pkgTree.labels), type: pkgTree.type, packageFormatVersion: pkgTree.packageFormatVersion, }; } export function convertLabels( labels?: any,

📚 Repository Context Analyzed This review considered 16 relevant code sections from 5 files (average relevance: 0.91) package-lock.json (relevance: 1.00, 6 segments, lines 17801-17900) lib/analyzer/applications/node.ts (relevance: 1.00, 5 segments, lines 301-400) package.json (relevance: 0.99, lines 1-87) lib/go-parser/go-binary.ts (relevance: 0.83, lines 1-100) lib/dependency-tree/index.ts (relevance: 0.76, 2 segments, lines 201-244)

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Potential Stack Overflow on Circular Dependencies The normalizeDependencies function uses recursion to traverse the dependency tree. While snyk-nodejs-lockfile-parser typically produces trees, if the input pkgTree (which can also come from resolveDeps reading node_modules) contains circular references (e.g. via symlinks not handled by the parser/resolver), this could lead to a stack overflow. Ensure that the input trees are guaranteed to be acyclic, or consider adding a visited set to the normalization logic. for (const [depName, dep] of Object.entries(dependencies)) { result[depName] = { ...dep, labels: normalizeLabels(dep.labels), dependencies: normalizeDependencies(dep.dependencies), }; } Loose Typing In normalizeDependencies, the dependencies parameter and return type use any ({ [depName: string]: any }). Since lockFileParser.PkgTree is available (imported and used elsewhere), consider using the specific type for dependencies (e.g., lockFileParser.Dependencies) to improve type safety and clarity regarding what properties are expected on the dependency objects. function normalizeDependencies(dependencies?: { [depName: string]: any }): | { [depName: string]: any; }

📚 Repository Context Analyzed This review considered 17 relevant code sections from 4 files (average relevance: 0.90) package-lock.json (relevance: 1.00, 8 segments, lines 17801-17900) lib/analyzer/applications/node.ts (relevance: 1.00, 5 segments, lines 301-400) package.json (relevance: 0.99, lines 1-87) lib/go-parser/index.ts (relevance: 0.83, lines 201-221)