mirror of
https://github.com/n8n-io/n8n.git
synced 2026-10-17 13:39:44 +02:00
b21ef9f5bc
The scratch step installed ~2500 packages to read their package.json files. `npm install --package-lock-only` reports the tree npm would install without fetching a tarball, and the lockfile's `packages` keys are the paths npm materializes — one key is one physical copy, the same ground truth the on-disk walk reads. `copiesFromLockfile` maps that to the shape `analyze()` already takes. Two details the on-disk walk got for free: - An alias (`"zod-v3": "npm:zod@^3"`) is a real second copy of zod. npm records `name` on the entry when it differs from the directory, so the copy is keyed on the manifest name. - A lockfile lists every platform's build of an optional native dependency, where an install unpacks only the matching one. Entries whose `os`/`cpu` rule out this machine are dropped, or the report invents copies that never coexist. An unreadable or v1 lockfile throws, matching `collectCopies`: callers must read that as "the check did not run", never as "no duplicates found". Verified equivalent through the CLI on a 17-package closure (413 resolved packages): the duplicate report is byte-identical to the real install's — 15 groups, same copy counts, same versions. `collectCopies` stays; `verify-closure` still walks a built closure on disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| @n8n | ||
| cli | ||
| core | ||
| extensions/insights | ||
| frontend | ||
| modules | ||
| node-dev | ||
| nodes-base | ||
| testing | ||
| workflow | ||