feat: support for pnpm lockfile v9 (#12)

Author: gemaxim

lib/lock-parser/build-dep-graph.ts

@@ -36,6 +36,7 @@ export async function buildDepGraph(
   switch (lockfileVersion) {
     case NodeLockfileVersion.PnpmLockV5:
     case NodeLockfileVersion.PnpmLockV6:
+    case NodeLockfileVersion.PnpmLockV9:
       return await lockFileParser.parsePnpmProject(
         manifestFileContents,
         lockFileContents,

lib/lock-parser/index.ts

@@ -47,7 +47,8 @@ export async function parse(
     lockfileVersion === NodeLockfileVersion.NpmLockV2 ||
     lockfileVersion === NodeLockfileVersion.NpmLockV3 ||
     lockfileVersion === NodeLockfileVersion.PnpmLockV5 ||
-    lockfileVersion === NodeLockfileVersion.PnpmLockV6
+    lockfileVersion === NodeLockfileVersion.PnpmLockV6 ||
+    lockfileVersion === NodeLockfileVersion.PnpmLockV9
   ) {
     return await buildDepGraph(
       root,

package.json

@@ -42,7 +42,7 @@
     "lodash.isempty": "^4.4.0",
     "lodash.sortby": "^4.7.0",
     "micromatch": "4.0.2",
-    "snyk-nodejs-lockfile-parser": "^1.53.3",
+    "snyk-nodejs-lockfile-parser": "^1.56.0",
     "snyk-resolve-deps": "4.8.0"
   },
   "devDependencies": {

test/fixtures/pnpm/lock-v9/simple-app/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "one-dep",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "accepts": "1.3.7"
+  }
+}

test/fixtures/pnpm/lock-v9/simple-app/pnpm-lock.yaml

@@ -0,0 +1,13 @@
+{
+    "name": "pnpm-shallow-goof",
+    "version": "0.0.1",
+    "description": "A vulnerable demo application",
+    "homepage": "https://snyk.io/",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/snyk-fixtures/pnpm-shallow-goof"
+    },
+    "dependencies": {
+        "a": "workspace:*"
+    }
+}

test/fixtures/pnpm/lock-v9/undefined-package-version/package.json

@@ -0,0 +1,16 @@
+{
+    "name": "a",
+    "description": "",
+    "main": "index.js",
+    "scripts": {
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "keywords": [],
+    "author": "",
+    "license": "ISC",
+    "dependencies": {
+        "node-uuid": "1.4.0",
+        "qs": "0.0.6"
+    }
+  }
+  

test/fixtures/pnpm/lock-v9/undefined-package-version/packages/pkg-a/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "yarn-1-workspace-with-isolated-pkgs",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "react": "18.0.0"
+  },
+  "private": true
+}