[muntasir-396]

Description

Following #1422, npm-shrinkwrap.json routes through the full lockfile graph and no longer falls back to path-derived edge reconstruction.

This PR updates the JSDoc on SpdxOptions.dependencyEdges in src/output/spdx.ts to remove the outdated npm-shrinkwrap.json citation, leaving the fallback description focused on unreadable or unsupported lockfiles.

Verification

• npm run lint:tests: Passed (no Mocha-isms or focused tests)
• npm test tests/spdx.test.ts: 52/52 tests passed

Closes #1447

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Automatic approval policy

Commit: b9d0f79d6a84.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

No overrides matched. The global limits apply.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: OWASP/cve-lite-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 9f17cca
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2211e8ce-89a6-4ce1-a729-9c0ace40e026

Commits

Reviewing files that changed from the base of the PR and between 0fea62e and b9d0f79.

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated the description of path-derived dependency edges to cover unreadable or unsupported lockfiles generally, rather than naming a specific lockfile. The documentation now describes when this fallback applies without tying it to one file type.

I corrected the SpdxOptions.dependencyEdges documentation. It no longer describes npm-shrinkwrap.json as a case for path-derived fallback edges. This documentation-only change does not alter behavior.

Changes: SPDX dependency edge documentation

Layer / File(s)	Summary
Update fallback description src/output/spdx.ts	The comment now describes unreadable or unsupported lockfiles as cases where the path-derived fallback is used.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other · Severity of issue fixed: Low

Possibly related issues

• OWASP/cve-lite-cli#1423: The internal documentation now reflects the shrinkwrap behavior addressed by this issue.

Possibly related PRs

• OWASP/cve-lite-cli#1450: This PR changes the dependency-edge identity and covers npm-shrinkwrap.json, which relates to the fallback behavior documented here.
• OWASP/cve-lite-cli#1446: This PR updates the corresponding fallback statement in the public SPDX documentation.

Merge Risk: Minimal · up to b9d0f

No merge-blocking issue was identified in this documentation change.

Pre-merge checks: 6 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Title check		The title describes the documentation change, but it does not use the required format. The required prefix is "docs:", while the title uses "docs(spdx):".	Change the title to the form "docs: short description", for example: "docs: remove stale npm-shrinkwrap.json fallback claim".

Passed checks: 6 passed

Check name	Status	Explanation
Description check		The description explains what changed, why it changed, which file was updated, verification results, and the closed issue. It uses "## Description" instead of the template heading "## What changed and…
Linked Issues check		Issue #1447 requires removal of the stale npm-shrinkwrap.json fallback claim from SpdxOptions.dependencyEdges JSDoc. The whole-PR evidence shows that src/output/spdx.ts now describes fallback be…
Out of Scope Changes check		The whole-PR evidence shows one documentation change in src/output/spdx.ts. The change directly supports issue #1447. No unrelated change is shown.
Linked Issue		The pull request body references an issue with the required keyword and number: “Closes #1447.”
Closes Keyword Matches Scope		The PR body uses Closes #1447. Issue #1447 asks to remove the stale npm-shrinkwrap.json fallback claim from SpdxOptions.dependencyEdges documentation. The PR changes exactly that JSDoc in `src/o…
No New Runtime Dependency		This documentation-only change introduces no runtime dependency. The reviewed diff changes only src/output/spdx.ts, and package.json has no diff. The dependencies and optionalDependencies sections are…

Full details: Description check

Explanation

The description explains what changed, why it changed, which file was updated, verification results, and the closed issue. It uses "## Description" instead of the template heading "## What changed and why", but the required information is present.

Full details: Linked Issues check

Explanation

Issue #1447 requires removal of the stale npm-shrinkwrap.json fallback claim from SpdxOptions.dependencyEdges JSDoc. The whole-PR evidence shows that src/output/spdx.ts now describes fallback behavior for unreadable or unsupported lockfiles. The change meets the linked issue requirement.

Full details: Closes Keyword Matches Scope

Explanation

The PR body uses Closes #1447. Issue #1447 asks to remove the stale npm-shrinkwrap.json fallback claim from SpdxOptions.dependencyEdges documentation. The PR changes exactly that JSDoc in src/output/spdx.ts, replacing the shrinkwrap example with unreadable or unsupported lockfile. No requested issue item remains missing.

Full details: No New Runtime Dependency

Explanation

This documentation-only change introduces no runtime dependency. The reviewed diff changes only src/output/spdx.ts, and package.json has no diff. The dependencies and optionalDependencies sections are unchanged; no devDependency moved to dependencies.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonukapoor]

Thanks @muntasir-396. The comment was stale since #1422, and the new wording is accurate: the SBOM falls back to path-derived links only when the lockfile can't be read or isn't one of the four types we build the graph for. Approved. I merge these one at a time rather than in a batch, so it will land shortly.

[sonukapoor]

Merged - thank you @muntasir-396!