jfrog / jfrog/jfrog-cli-security
"jf audit " for pnpm project scan did not support monorepo
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
The "jf audit" for pnpm project scan does not support monorepos. It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
After reviewing the code, it appears that this limitation is due to the fact that the pnpm ls command does not support the -r or --filter parameters, so it is unable to resolve all dependency information.
Current behavior
It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
Reproduction steps
git clone https://github.com/astonishqft/pnpm-monorepo-demo.git
cd pnpm-monorepo-demo
pnpm install
pnpm ls
pnpm ls -r
jf audit --pnpm=true
Expected behavior
It is necessary to scan for vulnerabilities in all packages.
JFrog CLI-Security version
2.73.0
JFrog CLI version (if applicable)
No response
Operating system type and version
ubuntu 22.04
JFrog Xray version
jfrog cloud saas
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the limitation with the linked pnpm-monorepo-demo using pnpm install, pnpm ls, pnpm ls -r, and jf audit --pnpm=true. Trace the CLI's pnpm dependency-resolution path and make the scan include dependencies from all packages; done means vulnerabilities in the monorepo's non-root packages are detected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100