Implement a "dealias_packages" flag for npm file parsing

[brrygrdn]

What are you trying to accomplish?

When we are parsing files for update jobs, aliases represent something an Update doesn't have a clear strategy to handle so they are ignored.

For graphing purposes, ignoring aliases presents a risk as it means we do not notice any vulnerabilities or licences related to the package being aliased which can have implications for a project's compliance posture.

To solve this problem without modifying updater behaviour, this PR does the following:

• Introduces the dealias_packages! flag on FileParsers
• Update the npm_and_yarn package to implement behaviour when this flag is setup for npm, yarn and pnpm projects
• Update the npm_and_yarn grapher to set the dealias_packages! flag on the FileParser layer

Note: This pass is focused on ensuring we align with existing Dependency Graph behaviour, a future improvement would be to extract the alias name as metadata, but we'd need wiring to use it so I'm not addressing this for now.

Anything you want to highlight for special attention from reviewers?

For now, this behaviour is unique to npm but I plan to backport it to go_modules to ensure we apply this dealiasing strategy consistently, modulo some ecosystem corners.

How will you know you've accomplished your goal?

When I process an npm package that uses an alias statement, the snapshot correctly identifies the underlying 'real' package instead of omitting it entirely.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Adds a dealias_packages option to FileParsers::Base so that aliased npm/yarn/pnpm packages can be parsed under their real package name (instead of being skipped). The npm_and_yarn ecosystem implements this across manifest parsing and all three lockfile parsers, and the npm_and_yarn dependency grapher opts in via the new dealias_packages! mutator so security/license scanning sees the underlying packages.

Changes:

• New dealias_packages! flag on FileParsers::Base that toggles a :dealias_packages option.
• npm_and_yarn manifest, JSON lock, yarn lock, and pnpm lock parsers now emit dependencies under the real package name when the flag is set.
• Dependabot::NpmAndYarn::DependencyGrapher#prepare! enables the flag for graph jobs; added fixtures and spec coverage for npm/yarn/pnpm alias scenarios.

Show a summary per file

File	Description
common/lib/dependabot/file_parsers/base.rb	Adds shared dealias_packages! setter on options.
npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb	Adds dealias_packages?, manifest alias rewriting, and propagates flag to lockfile parser.
npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb	Threads dealias_packages into per-lockfile parsers.
npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb	Uses details["name"] to resolve aliased entries when flag enabled.
npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb	Emits real package name for name@npm:real@ver reqs when flag enabled.
npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb	Stops skipping aliased entries when flag enabled.
npm_and_yarn/lib/dependabot/npm_and_yarn/dependency_grapher.rb	Calls file_parser.dealias_packages! in prepare!.
npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser_spec.rb	Tests manifest/lockfile alias handling with and without flag.
npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser/lockfile_parser_spec.rb	Tests lockfile parser alias handling.
npm_and_yarn/spec/dependabot/npm_and_yarn/dependency_grapher_spec.rb	Verifies grapher resolves aliased packages for npm/yarn/pnpm.
npm_and_yarn/spec/fixtures/projects/grapher/{npm,yarn,pnpm}_with_alias/*	New fixture projects with aliased dependencies.
npm_and_yarn/spec/fixtures/projects/npm8/aliased_dependency_no_lockfile/package.json	Fixture for alias-without-lockfile parser test.

Copilot's findings

Files not reviewed (2)

• npm_and_yarn/spec/fixtures/projects/grapher/npm_with_alias/package-lock.json: Language not supported
• npm_and_yarn/spec/fixtures/projects/grapher/pnpm_with_alias/pnpm-lock.yaml: Language not supported

• Files reviewed: 14/17 changed files
• Comments generated: 0