dependency-check / dependency-check/DependencyCheck
Make PnpmAuditAnalyzer compatible with the frontend-maven-plugin
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
In our project we are using the frontend-maven-plugin and would like to let Dependency-Check perform the audit of the frontend libraries. It seems rather cumbersome (if not impossible) to let the _PnpmAuditAnalyzer_ use the pnpm installed by the frontend-maven-plugin.
After said plugin installs pnpm, it would be possible to execute pnpm with the command `node\node node\node_modules\pnpm\bin\pnpm.cjs`. This, however, can not be added as "pathToPnpm" property. The _PnpmAuditAnalyzer_ checks whether the given path is an actual path, which it is not. We also tried to use a script file with the content `node\node node\node_modules\pnpm\bin\pnpm.cjs "$@"`, but the analyzer just says that the "Pnpm executable was not found." (furthermore, using a script would add undesired platform dependency to the dependency check process).
**Describe the solution you'd like**
It would be very helpful if the dependency check plugin would be able to use the pnpm installed by the frontend-maven-plugin, even if it is not a single path.
**Describe alternatives you've considered**
Don't use the dependency check plugin for the pnpm audit part. This is for several reasons undesired though.
Contributor guide
Assessment
This issue has not been assessed yet.