From 52b28c7cfe3d43d698b86ff574a6aaa1996ae9a5 Mon Sep 17 00:00:00 2001
From: "Raulo Erwan." <erwan.raulo.externe@emeria.eu>
Date: Tue, 21 Jul 2026 22:58:48 +0200
Subject: [PATCH 1/2] fix(tree-walker): LocalDependencyTreeLoader fails
 resolving symlink location on macos

---
 .changeset/busy-pianos-dress.md                       |  5 +++++
 .../tree-walker/src/npm/LocalDependencyTreeLoader.ts  | 11 +++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/busy-pianos-dress.md

diff --git a/.changeset/busy-pianos-dress.md b/.changeset/busy-pianos-dress.md
new file mode 100644
index 00000000..b57e2da9
--- /dev/null
+++ b/.changeset/busy-pianos-dress.md
@@ -0,0 +1,5 @@
+---
+"@nodesecure/tree-walker": patch
+---
+
+fix(tree-walker): LocalDependencyTreeLoader fails resolving symlink location on macos
diff --git a/workspaces/tree-walker/src/npm/LocalDependencyTreeLoader.ts b/workspaces/tree-walker/src/npm/LocalDependencyTreeLoader.ts
index 560ba454..b95e6f88 100644
--- a/workspaces/tree-walker/src/npm/LocalDependencyTreeLoader.ts
+++ b/workspaces/tree-walker/src/npm/LocalDependencyTreeLoader.ts
@@ -29,23 +29,26 @@ export class LocalDependencyTreeLoader implements LocalDependencyTreeLoaderProvi
     options: LocalDependencyTreeLoaderOptions = {}
   ): Promise<TreeDependencies> {
     const { registry, ...treeDepOptions } = options;
+    const resolvedLocation = await fs.realpath(location);
 
     const arb = new Arborist({
       ...utils.NPM_TOKEN,
-      path: location,
+      path: resolvedLocation,
       registry
     });
 
     try {
       await fs.access(
-        path.join(location, "node_modules")
+        path.join(resolvedLocation, "node_modules")
       );
 
       await arb.loadActual();
 
-      const treeNode = await arb.buildIdealTree();
+      if (!arb.actualTree) {
+        throw new Error("arborist loadActual fn did not produce a tree");
+      }
 
-      return TreeDependencies.fromArboristNode(treeNode, treeDepOptions);
+      return TreeDependencies.fromArboristNode(arb.actualTree, treeDepOptions);
     }
     catch {
       const treeNode = await arb.loadVirtual();

From e07ba86761958bf82b60799518a5ee8e34e43307 Mon Sep 17 00:00:00 2001
From: "Raulo Erwan." <erwan.raulo.externe@emeria.eu>
Date: Thu, 23 Jul 2026 13:37:09 +0200
Subject: [PATCH 2/2] fix( dep-walker): update files count in test relying on
 npm registry

should be more reliable by not testing files coming from npm registry
---
 workspaces/scanner/test/depWalker.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workspaces/scanner/test/depWalker.spec.ts b/workspaces/scanner/test/depWalker.spec.ts
index b704b69a..9701f70c 100644
--- a/workspaces/scanner/test/depWalker.spec.ts
+++ b/workspaces/scanner/test/depWalker.spec.ts
@@ -196,7 +196,7 @@ describe("depWalker", { concurrency: 2 }, () => {
       { path: "EntryFileAnalyser", filesCount: 17 },
       { path: "EntryFileAnalyser", filesCount: 47 },
       { path: "EntryFileAnalyser", filesCount: 67 },
-      { path: "EntryFileAnalyser", filesCount: 210 }].sort(byFilesCount));
+      { path: "EntryFileAnalyser", filesCount: 214 }].sort(byFilesCount));
   });
 
   function byFilesCount<T extends { filesCount: number; } | undefined>(a: T, b: T) {