[BUG] alters package.json and generates package-lock.json in projects that don't use npm

[willmakley]

Describe the bug With the extension installed, I find that package.json get spontaneously modified and package-lock.json gets spontaneously generated in my project that uses yarn.

To Reproduce Create a yarn project. Use this extension.

Expected behavior If it doesn't support yarn, it should at least detect yarn.lock and show a warning and not run npm commands that break my project.

[yc-w-cn]

I also encountered this issue. I uninstalled the plugin, and the problem was resolved.

[yohkaii]

Seems to be an ongoing problem on version 0.9.5 of the extension. You can either downgrade to v0.9.4 or disable to fix.

[Fydon]

Related to #731, #732 and #736, although probably not duplicate.

[johanklingberg]

Yes! it adds "packagename": "file: " to package.json constantly breaking any builds! It took me forever to hunt down because it started happening just as i had added some new packages. Thought i was going crazy until i found it.

[jhechtf]

I'm seeing this as well version 0.9.5.

[carlosthe19916]

The reports are generated by https://github.com/RHEcosystemAppEng/exhort-javascript-api and according to it:

The Supported Ecosystems are:

Java - Maven JavaScript - Npm Golang - Go Modules Python - pip Installer Gradle - Gradle Installation

Notice that for the Java world there was the need to implement the dependency scanner for both Maven and Gradle separately. The same will need to be done for the Javascript world. Currently only NPM is supported and Yarn implementation will require some effort.

[willmakley]

@carlosthe19916 it would be enough to not run npm commands in yarn projects. I don't need this extension to work so much as to not break things. The current behavior is causing mysterious breakages and changes that are extremely difficult to understand and track down.

[carlosthe19916]

@carlosthe19916 it would be enough to not run npm commands in yarn projects. I don't need this extension to work so much as to not break things. The current behavior is causing mysterious breakages and changes that are extremely difficult to understand and track down.

That's a fair point