monorepo-symlink-test about resolve HOT 5 CLOSED

@cichelero so that i can debug an installed package by running its tests, whether i have internet or not, and even if the github repo has been deleted (for example, substack deleted his github recently and a thousand repos vanished).

from resolve.

It seems this is just a confusion. The monorepo-symlink-test dependency is not being used by this package, but there is a package.json in the test folder that has the same name, which generates the confusion:

I think the simplest solution is to simply remove the name of the test package. However a cleaner solution is not to ship the test folder with the NPM package.

from resolve.

From what I see and understand they include the source code directly in the test folder and do not depend on NPM. The source code of the included library is here
https://github.com/browserify/resolve/blob/main/test/resolver/multirepo/packages/package-a/index.js
https://github.com/browserify/resolve/blob/main/test/resolver/multirepo/packages/package-b/index.js
and I don't see anything strange.
Please correct me if I'm wrong

from resolve.

Because it's a private package that just coincidentally has the same name as the malicious one, it is a false positive - so whatever tool is flagging this repo is broken, and you should strongly reconsider using a tool that is this naive about npm package names.

Duplicate of #303. Duplicate of #291. Duplicate of #288. Duplicate of #304. Duplicate of #305. Duplicate of #306. Duplicate of #309. Duplicate of #310. Duplicate of #311.

Tests must be shipped with packages so that npm explore foo && npm install && npm test always works.

from resolve.

Tests must be shipped with packages so that npm explore foo && npm install && npm test always works.

@ljharb I don't understand why this is required for a package. Can you please explain a bit more?

from resolve.