Fixes nested dependency detection in NpmLockfile3Detector and applies the engines array fix that was missing from PR #1400.

[gzproger]

Changes

• Rewrote ProcessLockfile to iterate ALL packages directly (matching npm's actual behavior)
• Applied PackageJsonEnginesConverter to PackageLockV3Package.Engines (PR don't throw if engines property is a string array #1400 only fixed NpmComponentDetector, not NpmLockfile3Detector)
• Fixed devOptional classification for packages that are both dev and optional dependencies of non-dev packages
• Added node-style module resolution for building dependency graph edges

Testing

• All unit tests pass (11/11)
• Tested on 3 real-world repos with correct component counts

[codecov]

Codecov Report

❌ Patch coverage is 95.59939% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.2%. Comparing base (601ebcd) to head (4b9e0d0).

Files with missing lines	Patch %	Lines
...entDetection.Detectors/npm/NpmLockfile3Detector.cs	80.0%	12 Missing and 9 partials ⚠️
...onentDetection.Detectors.Tests/NpmTestUtilities.cs	90.2%	0 Missing and 8 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1606     +/-   ##
=======================================
+ Coverage   90.0%   90.2%   +0.1%     
=======================================
  Files        437     437             
  Lines      37181   37777    +596     
  Branches    2306    2332     +26     
=======================================
+ Hits       33499   34082    +583     
+ Misses      3210    3208      -2     
- Partials     472     487     +15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR fixes nested dependency detection in NpmLockfile3Detector and applies the missing engines array converter fix from PR #1400. The core change rewrites the ProcessLockfile method from a queue-based traversal to a cleaner three-pass approach that processes all packages directly, then registers components, and finally builds dependency edges using node-style module resolution.

Key changes:

• Replaces complex queue-based dependency traversal with direct iteration over all packages in lockfile
• Implements node-style module resolution for dependency graph construction, walking up the directory tree to find dependencies
• Fixes devOptional classification to correctly mark peer dependencies that are also dev dependencies

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Microsoft.ComponentDetection.Detectors/npm/NpmLockfile3Detector.cs	Complete rewrite of ProcessLockfile to use three-pass approach with node-style resolution; removes queue-based traversal
src/Microsoft.ComponentDetection.Detectors/npm/NpmLockfileDetectorBase.cs	Adds new RecordComponent overload for registering components with explicit reference flag
src/Microsoft.ComponentDetection.Detectors/npm/Contracts/PackageLockV3Package.cs	Applies PackageJsonEnginesConverter to Engines property to handle array format
test/Microsoft.ComponentDetection.Detectors.Tests/NpmLockfile3DetectorTests.cs	Adds three new tests for devOptional, peer, and engines array handling
test/Microsoft.ComponentDetection.Detectors.Tests/NpmTestUtilities.cs	Adds helper methods for generating test lockfiles with devOptional and peer dependencies