dependency-check / dependency-check/DependencyCheck

Make PnpmAuditAnalyzer compatible with the frontend-maven-plugin

Open
#5,432 6 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**

In our project we are using the frontend-maven-plugin and would like to let Dependency-Check perform the audit of the frontend libraries. It seems rather cumbersome (if not impossible) to let the _PnpmAuditAnalyzer_ use the pnpm installed by the frontend-maven-plugin.

After said plugin installs pnpm, it would be possible to execute pnpm with the command `node\node node\node_modules\pnpm\bin\pnpm.cjs`. This, however, can not be added as "pathToPnpm" property. The _PnpmAuditAnalyzer_ checks whether the given path is an actual path, which it is not. We also tried to use a script file with the content `node\node node\node_modules\pnpm\bin\pnpm.cjs "$@"`, but the analyzer just says that the "Pnpm executable was not found." (furthermore, using a script would add undesired platform dependency to the dependency check process).

**Describe the solution you'd like**

It would be very helpful if the dependency check plugin would be able to use the pnpm installed by the frontend-maven-plugin, even if it is not a single path.

**Describe alternatives you've considered**

Don't use the dependency check plugin for the pnpm audit part. This is for several reasons undesired though.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.