[vibgrate-team]

Summary

parseChartYaml found dependencies: and then ran a - name: scan over the rest of the file. The last entry's block ran to EOF. In charts whose keys are alphabetical (the usual Bitnami layout), maintainers: comes next and its - name: lines were recorded as chart dependencies. That same last block's version: match could also adopt the chart's own top-level version:. parseChartLock scanned the same way.

Both parsers now stop at the first following top-level (unindented) key. version, repository, and condition are read only from each entry's own indented lines, so a dependency that does not declare a version stays * and never inherits the chart version. Quoted scalars are still unquoted, and a tags: list inside an entry still belongs to that entry.

Related issues

Closes #581

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed — no user-facing doc describes this parser
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

test/helm-chart-dependencies.test.ts covers:

• A Chart.yaml with dependencies: redis 20.x.x (oci://registry-1.docker.io/bitnamicharts), then maintainers: - name: Jane Doe, then version: 1.4.2. The parse and the offline scan both yield exactly one dependency, redis at 20.x.x.
• A dependency with no version of its own stays * when the chart version: follows the list.
• Quoted fields, a second dependency, and a tags: list still parse as before.
• Chart.lock is bounded the same way, including an entry with no version and a lock file that has no dependencies: key.