Sherif unordered-dependencies Bug Reproduction

Issue

Sherif does not properly handle packages/** glob patterns in pnpm-workspace.yaml, causing it to miss deeply nested packages and not check them for the unordered-dependencies rule.

Setup

This repo has a pnpm workspace with:

packages:
  - 'packages/**'

And packages at different nesting levels:

• packages/level1/ (depth 2)
• packages/level2/level2/ (depth 3)
• packages/level3/level3/level3/ (depth 4)
• packages/level4/level4/level4/level4/ (depth 5)

All packages have intentionally misordered dependencies (should be: axios, react, zod):

{
  "dependencies": {
    "zod": "^3.0.0",
    "react": "^18.0.0",
    "axios": "^1.0.0"
  }
}

Reproduction

Expected behavior

pnpm correctly recognizes all packages:

pnpm ls -r --depth -1 | grep "@repo"

Should show 4 packages.

Actual behavior

Sherif only scans shallow packages:

pnpm dlx sherif@latest -r empty-dependencies -r packages-without-package-json

OR

pnpm check

Expected: 4 unordered-dependencies errors (one per package) Actual: Only finds packages at depth 2, misses deeper packages

Workaround

Adding explicit depth patterns helps but doesn't catch all packages:

packages:
  - 'packages/**'
  - 'packages/**/*'
  - 'packages/**/**/*'
  # ... etc

Environment

• sherif: 1.13.0
• pnpm: 11.2.2
• Node: 24.x