anchore / anchore/syft

Investigate Yarn 2 Plug'n'Play

Open
#486 0 comments 0 reactions 0 assignees View on GitHub
ecosystem:javascript enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**What would you like to be added**:
Verify support for Yarn's Plug'n'Play package resolution.

**Why is this needed**:
This is potentially incompatible with the current `yarn.lock`-based scanning of a directory and `node_modules` handling.

**Additional context**:
Yarn 1 by default duplicates npm's behavior of putting things in the `node_modules` directory. [Yarn 2 by default](https://yarnpkg.com/getting-started/migration#why-should-you-migrate) uses [Plug'n'Play](https://yarnpkg.com/features/pnp), which does not put files directly in `node_modules` but uses another strategy.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the current yarn.lock-based directory scanning and node_modules handling, then compare them with Yarn 2 Plug'n'Play's package-resolution approach. Done means determining whether Plug'n'Play is supported and documenting or implementing the compatibility work required.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cli, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.