From 48d271a12c4c2ec1c62e27c4cf53818f189d49f2 Mon Sep 17 00:00:00 2001
From: Joe Lafiosca <joe@lafiosca.com>
Date: Fri, 11 Sep 2020 15:14:47 -0400
Subject: [PATCH 1/2] fix npm audit warning by bumping bl version

---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 995a5c2..14ab93a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1206,9 +1206,9 @@
       }
     },
     "bl": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.0.2.tgz",
-      "integrity": "sha512-j4OH8f6Qg2bGuWfRiltT2HYGx0e1QcBTrK9KAHNMwMZdQnDZFk0ZSYIpADjYCB3U12nicC5tVJwSIhwOWjb4RQ==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.0.3.tgz",
+      "integrity": "sha512-fs4G6/Hu4/EE+F75J8DuN/0IpQqNjAdC7aEQv7Qt8MHGUH7Ckv2MwTEEeN9QehD0pfIDkMI1bkHYkKy7xHyKIg==",
       "requires": {
         "buffer": "^5.5.0",
         "inherits": "^2.0.4",

From 0e1802d8ab0f487d74661537930cf30012dae700 Mon Sep 17 00:00:00 2001
From: Joe Lafiosca <joe@lafiosca.com>
Date: Fri, 11 Sep 2020 17:38:46 -0400
Subject: [PATCH 2/2] add path de-dupe logic

---
 cli.js                  |  4 +++-
 lib/dedupe-list.js      | 21 +++++++++++++++++++++
 lib/dedupe-list.spec.js | 30 ++++++++++++++++++++++++++++++
 lib/index.js            |  1 +
 4 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 lib/dedupe-list.js
 create mode 100644 lib/dedupe-list.spec.js

diff --git a/cli.js b/cli.js
index c1acee8..8edb646 100644
--- a/cli.js
+++ b/cli.js
@@ -2,6 +2,7 @@
 
 const { Readable } = require('stream');
 const {
+  dedupeList,
   findNodeModules,
   findUsedModules,
   toRelativeModulePath,
@@ -13,8 +14,9 @@ const {
     const params = parseArgs(process.argv);
 
     const handler = params.entry ? handleEntry : handlePackJSON;
-    const result = (await handler(params))
+    const rawResult = (await handler(params))
       .map(toRelativeModulePath);
+    const result = dedupeList(rawResult);
     if (params.zip) zip(result, params);
 
     const output = formatOutput(result, params);
diff --git a/lib/dedupe-list.js b/lib/dedupe-list.js
new file mode 100644
index 0000000..fee950a
--- /dev/null
+++ b/lib/dedupe-list.js
@@ -0,0 +1,21 @@
+const path = require('path');
+
+module.exports = dedupeList;
+
+function dedupeList (list) {
+  const sorted = [...list].sort();
+  const seen = {};
+  return sorted.filter((item) => {
+    const parts = item.split(path.sep);
+    let dupe = seen[item];
+    while (!dupe && parts.length > 1) {
+      if (seen[parts.join(path.sep)]) {
+        dupe = true;
+      } else {
+        parts.pop();
+      }
+    }
+    seen[item] = true;
+    return !dupe;
+  });
+}
diff --git a/lib/dedupe-list.spec.js b/lib/dedupe-list.spec.js
new file mode 100644
index 0000000..7075c97
--- /dev/null
+++ b/lib/dedupe-list.spec.js
@@ -0,0 +1,30 @@
+const dedupeList = require('./dedupe-list');
+
+describe('dedupeList', () => {
+  it('should sort and dedupe paths (and subpaths)', () => {
+    expect(dedupeList([
+      '../../node_modules/aws-serverless-express',
+      '../../node_modules/send/node_modules/ms',
+      '../../node_modules/express',
+      '../../node_modules/send/node_modules/http-errors',
+      '../../node_modules/morgan',
+      '../../node_modules/cookie-signature',
+      '../../node_modules/send',
+      '../../node_modules/morgan',
+      '../../node_modules/cookie/node_modules/something',
+      '../../node_modules/cors',
+      '../../node_modules/morgan',
+      '../../node_modules/send/node_modules/ms',
+      '../../node_modules/morgan',
+      '../../node_modules/cookie'
+    ])).toEqual([
+      '../../node_modules/aws-serverless-express',
+      '../../node_modules/cookie',
+      '../../node_modules/cookie-signature',
+      '../../node_modules/cors',
+      '../../node_modules/express',
+      '../../node_modules/morgan',
+      '../../node_modules/send'
+    ]);
+  });
+});
diff --git a/lib/index.js b/lib/index.js
index 72d6648..6ad5c7c 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -1,3 +1,4 @@
+module.exports.dedupeList = require('./dedupe-list');
 module.exports.findNodeModules = require('./find-node-modules');
 module.exports.findUsedModules = require('./find-used-modules');
 module.exports.toRelativeModulePath = require('./to-relative-module-path');