Scan manifest files as well (not just lockfiles)
Open
backlog
enhancement
- Dominant language
- Go
- Stars
- 11k
- Forks
- 792
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 48
Description
Add the ability to scan manifest files e.g. `package.json` in addition to `package-lock.json`. Possibly using deps.dev dependency graph data to scan transitive dependencies.
Motivation: Some projects don't check in their package-lock.json files, breaking automated repo scanning that's done by projects like scorecard. E/.g see #410
Current languages that can get immediate benefit:
- pnpm (#1298)
- yarn (#799)
- cargo.lock (#654)
Related #352
Contributor guide
Assessment
This issue has not been assessed yet.