NodeSecure / NodeSecure/scanner
(Tree-walker) support pnpm lockfile
Open
Nobody has claimed this yet.
hard
- Dominant language
- TypeScript
- Stars
- 40
- Forks
- 23
- Avg merge
- 23h 23m
- Merged PRs (30d)
- 2
Description
Vulnera support pnpm by using @pnpm/audit but for the tree-walking we are not supporting pnpm as we are using Aborist (official NPM package).
Not sure if there is an easy solution here (there is no unified API yet). We may need to look at @pnpm/lockfile-file
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the tree-walking implementation that currently relies on Arborist and compare its lockfile assumptions with @pnpm/lockfile-file. Determine how pnpm lockfiles can provide the dependency tree and define validation for Vulnera's pnpm support; the issue names no files or tests, so the relevant entry point must be located first.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100