scan-pull-request fails on pnpm 12: 'pnpm ls --depth ""' — MaxTreeDepth never set

Describe the bug

frogbot scan-pull-request fails on any pnpm project when pnpm 12 is on the runner's PATH, because Frogbot invokes pnpm ls with an empty --depth value:

[Info] Calculating Pnpm dependencies...
[Error] failed to audit target branch code for [.] project. Error: ...
failed to generate SBOM for /tmp/jfrog.cli.temp.-...: failed to build dependency tree:
failed while building 'pnpm' dependency tree: failed running command:
'/tmp/jfrog.cli.temp.-... /home/runner/.local/share/mise/installs/pnpm/12.3.4/pnpm ls --depth  --json --long'
with error: exit status 2 - error: invalid value '' for '--depth <DEPTH>': expected a non-negative integer, Infinity, or -1, got ``

pnpm ≤ 11 silently tolerated --depth ""; pnpm 12's stricter CLI parser rejects it.

Root cause

• Frogbot builds AuditBasicParams in utils/scandetails.go (ScanDetails.Audit) and never calls SetMaxTreeDepth(...), so maxTreeDepth stays "".
• jfrog-cli-security copies that straight through in commands/audit/auditparams.go (MaxTreeDepth: params.MaxTreeDepth()) and sca/bom/buildinfo/technologies/pnpm/pnpm.go calculateDependencies() does:

  lsArgs := append([]string{"--depth", params.MaxTreeDepth, "--json", "--long"}, params.Args...)
  

• The "Infinity" default only exists on the jf audit --max-tree-depth CLI flag (cli/docs/flags.go), which Frogbot does not go through.

Reproduction

In any pnpm project:

npx -y pnpm@12 ls --depth "" --json --long   # exit 2, "invalid value '' for '--depth'"
npx -y pnpm@11 ls --depth "" --json --long   # exit 0

Environment

• Frogbot 2.35.2 (also 2.35.3 — the release notes show no related change)
• GitHub Actions, jfrog/frogbot action, scan-pull-request
• pnpm 12.3.4 via mise
• Node 26.8.1 (not relevant — the failure is pnpm's own arg parsing)

Suggested fix

Either have Frogbot call SetMaxTreeDepth("Infinity") when building AuditBasicParams, or have jfrog-cli-security default MaxTreeDepth to "Infinity" in calculateDependencies() / SetMaxTreeDepth when the value is empty. Happy to open a PR for either.

Workaround

Pin pnpm ≤ 11 on the runner until fixed.

Start in utils/scandetails.go at ScanDetails.Audit and trace how AuditBasicParams reaches jfrog-cli-security's commands/audit/auditparams.go and sca/bom/buildinfo/technologies/pnpm/pnpm.go. Reproduce the failure with pnpm 12 using the documented pnpm ls command, then ensure the dependency-tree command no longer passes an empty depth and verify the command succeeds.