| LOW | test/lib/commands/ci.js | 501 | // Root cause: an optional peerDependency at an exact version causes buildIdealTree() to resolve a different version tha | COMMENT |
| LOW | test/lib/commands/install.js | 1181 | }) | COMMENT |
| LOW | workspaces/config/lib/definitions/definitions.js | 101 | flatOptions[camel] = obj[key] | COMMENT |
| LOW | workspaces/config/lib/definitions/definitions.js | 121 | // instead do `npm.config.set('foo', 'bar')` prior to passing the | COMMENT |
| LOW | workspaces/arborist/README.md | 61 | }) | COMMENT |
| LOW | workspaces/arborist/README.md | 81 | // add: Array of package specifiers to add at the top level. Each of | COMMENT |
| LOW | workspaces/arborist/README.md | 101 | // preferDedupe: prefer to deduplicate packages if possible, rather than | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 401 | t.equal(zy.location, y.location, 'y bundled under z is removed') | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 581 | nodeLoc: 'node_modules/b/node_modules/c', | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1021 | }) | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1061 | explicitRequest: true, | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1121 | // root | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1441 | // b@2 -> PEER(c@2) | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1481 | { pkg: { name: 'c', version: '1.0.0', peerDependencies: { d: '1' } } }, | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1541 | // v@4 -> PEER(a@1||2) | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1581 | { pkg: { name: 'a', version: '1.0.0', peerDependencies: { b: '1' } } }, | COMMENT |
| LOW | workspaces/arborist/test/place-dep.js | 1661 | peerSet: [ | COMMENT |
| LOW | workspaces/arborist/test/node.js | 1341 | // y@2 -> x@1 | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 481 | ], | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 761 | // b@1.0.1 -> PEER(c@1) | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 961 | // dd@1.0.1 -> PEER(c@1) | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1061 | // root -> (a) | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1121 | | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1201 | // | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1241 | // b@1 -> PEER(c@1) | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1301 | // a@2 -> PEER(b@2) | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1341 | { pkg: { name: 'c', version: '1.0.0', peerDependencies: { e: '1' } } }, | COMMENT |
| LOW | workspaces/arborist/test/can-place-dep.js | 1401 | // partly overlapping peer sets that diverge | COMMENT |
| LOW | workspaces/arborist/lib/optional-set.js | 1 | // when an optional dep fails to install, we need to remove the branch of the | COMMENT |
| LOW | workspaces/arborist/lib/release-age-exclude.js | 1 | // Determine whether a package name is exempt from the `min-release-age` / | COMMENT |
| LOW | workspaces/arborist/lib/signals.js | 1 | // copied from signal-exit | COMMENT |
| LOW | workspaces/arborist/lib/place-dep.js | 61 | } | COMMENT |
| LOW | workspaces/arborist/lib/place-dep.js | 101 | this.checks.set(target, cpd) | COMMENT |
| LOW | workspaces/arborist/lib/place-dep.js | 201 | if (placementType === KEEP) { | COMMENT |
| LOW | workspaces/arborist/lib/place-dep.js | 341 | | COMMENT |
| LOW | workspaces/arborist/lib/place-dep.js | 361 | // gather all peer edgesIn which are at this level, and will not be | COMMENT |
| LOW | workspaces/arborist/lib/unreviewed-scripts.js | 1 | const isScriptAllowed = require('./script-allowed.js') | COMMENT |
| LOW | workspaces/arborist/lib/install-scripts.js | 1 | const { isNodeGypPackage } = require('@npmcli/node-gyp') | COMMENT |
| LOW | workspaces/arborist/lib/install-scripts.js | 21 | // purpose: | COMMENT |
| LOW | workspaces/arborist/lib/edge.js | 121 | // There's some override. If the target node satisfies the overriding spec | COMMENT |
| LOW | workspaces/arborist/lib/peer-entry-sets.js | 1 | // Given a node in a tree, return all of the peer dependency sets that | COMMENT |
| LOW | workspaces/arborist/lib/peer-entry-sets.js | 41 | for (const edge of peer.edgesOut.values()) { | COMMENT |
| LOW | workspaces/arborist/lib/shrinkwrap.js | 1 | // a module that manages a lockfile (package-lock.json). | COMMENT |
| LOW | workspaces/arborist/lib/shrinkwrap.js | 21 | const mismatch = (a, b) => a && b && a !== b | COMMENT |
| LOW | workspaces/arborist/lib/shrinkwrap.js | 761 | // Symlinks were already handled above, so that leaves git. | COMMENT |
| LOW | workspaces/arborist/lib/vuln.js | 1 | // An object representing a vulnerability either as the result of an | COMMENT |
| LOW | workspaces/arborist/lib/node.js | 1 | // inventory, path, realpath, root, and parent | COMMENT |
| LOW | workspaces/arborist/lib/node.js | 161 | // since _location is just where the module ended up in the tree, | COMMENT |
| LOW | workspaces/arborist/lib/node.js | 241 | // its various deps, then we're going to _first_ create all the | COMMENT |
| LOW | workspaces/arborist/lib/node.js | 1261 | | COMMENT |
| LOW | workspaces/arborist/lib/calc-dep-flags.js | 1 | // Dep flag (dev, peer, etc.) calculation requires default or reset flags. | COMMENT |
| LOW | workspaces/arborist/lib/yarn-lock.js | 1 | // parse a yarn lock file | COMMENT |
| LOW | workspaces/arborist/lib/yarn-lock.js | 221 | | COMMENT |
| LOW | workspaces/arborist/lib/yarn-lock.js | 241 | // | +-- z@2 | COMMENT |
| LOW | workspaces/arborist/lib/script-allowed.js | 1 | const { resolve, sep } = require('node:path') | COMMENT |
| LOW | workspaces/arborist/lib/script-allowed.js | 21 | // attacker-controlled. A package can publish a tarball claiming any | COMMENT |
| LOW | workspaces/arborist/lib/script-allowed.js | 221 | // Preferred source: the lockfile's resolved URL parsed via | COMMENT |
| LOW | workspaces/arborist/lib/script-allowed.js | 401 | return false | COMMENT |
| LOW | workspaces/arborist/lib/can-place-dep.js | 1 | // Internal methods used by buildIdealTree. | COMMENT |
| LOW | workspaces/arborist/lib/can-place-dep.js | 21 | // - if satisfying and preferDedupe? KEEP | COMMENT |
| 31 more matches not shown… |
Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).