Skip to content

fix: correctly handle native package dependencies size and counts - #3111

Open
jibin7jose wants to merge 2 commits into
npmx-dev:mainfrom
jibin7jose:fix-native-dependency-count
Open

fix: correctly handle native package dependencies size and counts#3111
jibin7jose wants to merge 2 commits into
npmx-dev:mainfrom
jibin7jose:fix-native-dependency-count

Conversation

@jibin7jose

Copy link
Copy Markdown

Resolves #3110

Description

This PR addresses an issue where optional dependencies for native packages (specifically WASM bindings, like @rolldown/binding-wasm32-wasi) were being incorrectly tracked as regular dependencies. This resulted in massively inflated install size calculations and incorrect total transitive dependency counts (e.g., rolldown reporting 10 total dependencies and +14 MB in size instead of 2 total dependencies).

Changes Made

  • Dependency Resolver (server/utils/dependency-resolver.ts):
    • Added detection logic for WASM bindings (by matching -wasm32-, -wasm32, or wasm32-wasi) to correctly categorize them as native packages.
    • Ensured that the isNative flag correctly trickles down and is inherited by all transitive children of a native package.
  • Install Size Calculator (server/utils/install-size.ts):
    • Updated the install size calculation to correctly exclude the individual file sizes of all native optional bindings from the total install size, accurately reflecting the true footprint of the package.
  • Dependency Analysis (server/utils/dependency-analysis.ts):
    • Since the isNative flag now propagates correctly, transitive children of native packages are effectively filtered out of the totalPackages count.

Testing

  • Validated that rolldown now correctly reports 2 total dependencies and an install size of ~895 KB.
  • Verified that the "Significant size increase" banner no longer incorrectly appears for packages relying on WASM optional bindings.

@vercel

vercel Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
npmx.dev Ready Ready Preview Aug 2, 2026 2:04pm
2 Skipped Deployments
Project Deployment Actions Updated (UTC)
docs.npmx.dev Ignored Ignored Preview Aug 2, 2026 2:04pm
npmx-lunaria Ignored Ignored Aug 2, 2026 2:04pm

Request Review

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown

Hello! Thank you for opening your first PR to npmx, @jibin7jose! 🚀

Here’s what will happen next:

  1. Our GitHub bots will run to check your changes.
    If they spot any issues you will see some error messages on this PR.
    Don’t hesitate to ask any questions if you’re not sure what these mean!

  2. In a few minutes, you’ll be able to see a preview of your changes on Vercel

  3. One or more of our maintainers will take a look and may ask you to make changes.
    We try to be responsive, but don’t worry if this takes a few days.

@coderabbitai

coderabbitai Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 39546825-d348-44dd-ac72-73025e2fd233

📥 Commits

Reviewing files that changed from the base of the PR and between 34785d2 and 5683dce.

📒 Files selected for processing (1)
  • server/utils/dependency-resolver.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • server/utils/dependency-resolver.ts

📝 Walkthrough

Summary by CodeRabbit

  • Improvements
    • Dependency analysis now identifies platform-specific and WebAssembly packages more accurately.
    • Native optional packages remain visible in dependency lists while being excluded from overall package counts, installation size totals and dependency counts.
    • Dependency relationships now preserve optional status more consistently, improving the accuracy of dependency reporting.
    • Dependency entries can now indicate when a package is native or platform-specific.

Walkthrough

Changes

Native optional dependency handling

Layer / File(s) Summary
Resolve and propagate native status
server/utils/dependency-resolver.ts
The resolver detects OS-, CPU-, libc-, and wasm-specific packages. It propagates native and optional status through dependency traversal.
Expose and exclude native packages from install totals
shared/types/install-size.ts, server/utils/install-size.ts
Install-size entries expose isNative. Optional native packages remain listed but do not affect aggregate size or dependency count.
Exclude native packages from dependency totals
server/utils/dependency-analysis.ts
Dependency analysis excludes native optional packages from totalPackages and builds vulnerability counts in the returned result.

Sequence Diagram(s)

sequenceDiagram
  participant dependency_resolver
  participant dependency_analysis
  participant install_size
  dependency_resolver->>dependency_analysis: Provide resolved packages with native status
  dependency_resolver->>install_size: Provide resolved packages with native status
  dependency_analysis->>dependency_analysis: Exclude native optional packages from totals
  install_size->>install_size: Exclude native optional packages from size and count
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the fix to native package dependency size and count handling.
Description check ✅ Passed The description explains the native optional dependency bug and the implemented fixes for dependency counts and install size.
Linked Issues check ✅ Passed The changes detect native WASM packages, propagate native status, and exclude their descendants from counts as required by issue #3110.
Out of Scope Changes check ✅ Passed The changes are limited to native dependency detection, status propagation, dependency counts, and install-size calculations.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Aug 2, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 78.26087% with 5 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
server/utils/install-size.ts 0.00% 2 Missing and 1 partial ⚠️
server/utils/dependency-analysis.ts 90.90% 1 Missing ⚠️
server/utils/dependency-resolver.ts 88.88% 0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
server/utils/dependency-resolver.ts (1)

203-223: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Preserve required-path reachability when paths converge.

Line 203 discards a later path when nextLevel already contains depName. If an optional native branch inserts the package first, a required non-native branch is ignored. Concurrent traversal makes the retained optional and isNativeParent state order-dependent.

The downstream aggregate filters then exclude a package that a required dependency path installs. Track traversal state per path, or merge states so exclusion applies only when no required non-native path reaches the package. Reprocess descendants when merged state changes.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/utils/dependency-resolver.ts` around lines 203 - 223, The dependency
traversal around the `nextLevel.set` calls must merge converging paths instead
of discarding later entries by `depName`. Ensure a required non-native path
overrides optional/native-only state, preserve the package when any such path
reaches it, and reprocess descendants whenever the merged `optional` or
`isNativeParent` state changes; update the downstream aggregate filtering
accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@server/utils/dependency-resolver.ts`:
- Around line 164-188: Update the libc detection in the selfIsNative calculation
to read through a typed local value instead of casting versionData to any.
Preserve the existing Array.isArray and non-empty checks, matching the type-safe
handling of os and cpu.

---

Outside diff comments:
In `@server/utils/dependency-resolver.ts`:
- Around line 203-223: The dependency traversal around the `nextLevel.set` calls
must merge converging paths instead of discarding later entries by `depName`.
Ensure a required non-native path overrides optional/native-only state, preserve
the package when any such path reaches it, and reprocess descendants whenever
the merged `optional` or `isNativeParent` state changes; update the downstream
aggregate filtering accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 131d3e8f-8906-44ea-8ce5-871571cb4a2b

📥 Commits

Reviewing files that changed from the base of the PR and between e951b5f and 34785d2.

📒 Files selected for processing (4)
  • server/utils/dependency-analysis.ts
  • server/utils/dependency-resolver.ts
  • server/utils/install-size.ts
  • shared/types/install-size.ts

Comment thread server/utils/dependency-resolver.ts

@gameroman gameroman left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add tests and follow the PR template

@jibin7jose

Copy link
Copy Markdown
Author

Please add tests and follow the PR template

ok

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Optional dependencies for native packages are counted incorrectly

2 participants