:has()

The :has() pseudo-class matches packages that depend on a match for a given selector expression. It's the dependency graph equivalent of the CSS :has() selector.

Syntax

:has(<selector-list>)

The selector list is evaluated against the whole graph, then packages with a direct dependency on one of its matches are kept. Nest :has() to walk further up the graph, one dependency hop per level.

Examples

Packages with a peer dependency on react

$ vlt query ':has(:peer[name=react])'

Given this dependency graph:

my-app
├── react@18.2.0
├── react-dom@18.2.0
│   └── react@18.2.0 (peer)
└── @testing-library/react@14.0.0
    └── react@18.2.0 (peer)

:has(:peer[name=react]) selects packages that have a peer dependency on react:

my-app
├── react@18.2.0
├── react-dom@18.2.0                 ✅ has peer dep on react
│   └── react@18.2.0 (peer)
└── @testing-library/react@14.0.0   ✅ has peer dep on react
    └── react@18.2.0 (peer)

Packages that depend on vulnerable packages

$ vlt query ':has(:cve)'

This finds packages whose direct dependencies have known CVEs.

Packages that depend on outdated packages

$ vlt query ':has(:outdated(major))'

Packages that depend on changed packages

Find packages that have a dependency that was modified:

$ vlt query ':has(:diff(main))'

See Affected Dependencies for using this to test only what a branch could have broken.

Reaching further than one hop

:has() only looks one dependency deep, so > inside it is redundant — these select the same packages:

$ vlt query ':has(> [name=lodash])'
$ vlt query ':has([name=lodash])'

To match packages that depend on lodash through another package, nest another :has():

# depends on something that depends on lodash
$ vlt query ':has(:has([name=lodash]))'

See also

• :not() — negation pseudo-class
• :is() — forgiving selector list matching
• Combinators — >, , ~
• Affected Dependencies — what a change breaks