syft icon indicating copy to clipboard operation
syft copied to clipboard

PNPM latest lockfile (version 9.0)

Open spiffcs opened this issue 7 months ago • 0 comments

What would you like to be added: The PNPM folks are pretty prolific and we'd like to support more versions of decoding dependencies from their lockfiles. The latest version v9.0 looks like this:

lockfileVersion: '9.0'
settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false
importers:
  .:
    dependencies:
      react:
        specifier: ^19.1.0
        version: 19.1.0
      react-dom:
        specifier: ^19.1.0
        version: 19.1.0([email protected])
    devDependencies:
      jest:
        specifier: ^29.7.0
        version: 29.7.0(@types/[email protected])
packages:
  '@ampproject/[email protected]':
    resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
    engines: {node: '>=6.0.0'}
  '@babel/[email protected]':
    resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
    engines: {node: '>=6.9.0'}
  '@babel/[email protected]':
    resolution: {integrity: sha512-TUtMJYRPyUb/9aU8f3K0mjmjf6M9N5Woshn2CS6nqJSeJtTtQcpLUXjGt9vbF8ZGff0El99sWkLgzwW3VXnxZQ==}
    engines: {node: '>=6.9.0'}
  '@babel/[email protected]':
    resolution: {integrity: sha512-IaaGWsQqfsQWVLqMn9OB92MNN7zukfVA4s7KKAI0KfrrDsZ0yhi5uV4baBuLuN7n3vsZpwP8asPPcVwApxvjBQ==}
    engines: {node: '>=6.9.0'}
  '@babel/[email protected]':
    resolution: {integrity: sha512-UnJfnIpc/+JO0/+KRVQNGU+y5taA5vCbwN8+azkX6beii/ZF+enZJSOKo11ZSzGJjlNfJHfQtmQT8H+9TXPG2w==}
    engines: {node: '>=6.9.0'}

Note that the flat list of packages don't denote whether it's dev or otherwise. The installed section does have this separator, but the full graph does not. We'd like some investigation on this issue on how to provide the full graph while also pruning or including devDependencies based on the user's intent.

Why is this needed: PNPM tip of main support for their lockfile

spiffcs avatar May 21 '25 14:05 spiffcs