Reduce npm lockfile parsing allocations

[andrew]

Preallocate the dependency slice when parsing npm lockfiles and iterate v2/v3 lines without allocating a slice of every line. For lockfiles with 10,000 packages, this reduces allocated bytes by 41% for v1 and 45% for v3.

Also fix duplicate dependencies when parsing v2 lockfiles with CRLF line endings: stop at the end of packages instead of continuing into the legacy dependencies section.

[Copilot]

🟡 Changes recommended

An unresolved CRLF parsing bug can produce duplicate dependencies.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Reduces allocations in npm lockfile parsing while preserving parsing behavior, with added benchmarks and regression coverage.

Changes:

• Preallocates dependency results for v1 parsing.
• Uses iterator-based line parsing for v2/v3.
• Adds allocation benchmarks and edge-case tests.

File summaries

File	Summary
npm_bench_test.go	Adds large-lockfile benchmarks.
npm_allocation_test.go	Adds allocation and parsing regression tests.
internal/npm/npm.go	Optimizes parsing; requires CRLF section termination handling to avoid duplicate dependencies.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

No unresolved review comments were identified.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite