Trivy classifies production pnpm workspace dependencies in pnpm deploy lockfiles as dev dependencies

[sergio-ferreira-jscrambler]

Description

We scan each service's production dependency lockfile after running pnpm deploy --prod. The deployed service has a production dependency on a local workspace package, which itself has a production dependency on @xmldom/xmldom@0.8.13. The package is present in the production deployment.

In the generated pnpm-lock.yaml, pnpm records the local workspace package as a file: dependency. Trivy treats the transitive package as a development dependency and suppresses its vulnerabilities by default. Scanning the same deployed lockfile with --include-dev-deps reports the findings.

This reproduces with pnpm 11.27.0 and pnpm 12.11.2, using Trivy 0.75.0. The minimal fixture is this repository; see README.md and repro.sh.

Desired Behavior

When scanning a lockfile generated by pnpm deploy --prod, Trivy should report vulnerabilities in all dependencies included in that production deployment by default. It should continue to omit actual development dependencies, which pnpm deploy --prod excludes from the deployed lockfile and package tree.

Actual Behavior

Without --include-dev-deps, Trivy reports zero HIGH or CRITICAL findings for the deployed lockfile. With --include-dev-deps, it reports eight HIGH findings for @xmldom/xmldom@0.8.13:

• CVE-2026-83605
• CVE-2026-83607
• CVE-2026-83608
• CVE-2026-83613
• CVE-2026-83614
• CVE-2026-83615
• CVE-2026-83616
• CVE-2026-83619

Reproduction Steps

1. Clone or use the minimal reproduction repository at https://github.com/sergio-ferreira-jscrambler/trivy-pnpm-workspace-repro

2. Run the production deployment:

   pnpm install --frozen-lockfile --ignore-scripts
   pnpm --config.inject-workspace-packages=true deploy --prod --filter=repro-service --ignore-scripts .deploy

3. Scan the deployed lockfile both ways:

   trivy fs .deploy/pnpm-lock.yaml --scanners vuln --severity HIGH,CRITICAL
   trivy fs .deploy/pnpm-lock.yaml --include-dev-deps --scanners vuln --severity HIGH,CRITICAL

4. Compare the results: the first scan reports zero findings; the second reports the eight HIGH xmldom findings listed above.

There's also a repro.sh file that you can use that does the steps above

Tested with both pnpm 11.27.0 and and pnpm 12.11.2; the result was the same.

Target

Filesystem

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

2026-10-12T11:01:46+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-10-12T11:01:46+01:00	DEBUG	Cache dir	dir="/home/sergio-wpi/.cache/trivy"
2026-10-12T11:01:46+01:00	DEBUG	Cache dir	dir="/home/sergio-wpi/.cache/trivy"
2026-10-12T11:01:46+01:00	DEBUG	Parsed severities	severities=[HIGH CRITICAL]
2026-10-12T11:01:46+01:00	DEBUG	Ignore statuses	statuses=[]
2026-10-12T11:01:46+01:00	DEBUG	DB update was skipped because the local DB is the latest
2026-10-12T11:01:46+01:00	DEBUG	DB info	schema=2 updated_at=2026-10-12T07:12:51.98420317Z next_update=2026-10-13T07:12:51.98420302Z downloaded_at=2026-10-12T08:40:47.110880068Z
2026-10-12T11:01:46+01:00	DEBUG	[pkg] Package types	types=[os library]
2026-10-12T11:01:46+01:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2026-10-12T11:01:46+01:00	INFO	[vuln] Vulnerability scanning is enabled
2026-10-12T11:01:46+01:00	DEBUG	Initializing scan cache...	type="memory"
2026-10-12T11:01:46+01:00	DEBUG	[notification] Running version check and sending anonymous telemetry
2026-10-12T11:01:46+01:00	DEBUG	[fs] Analyzing...	root=".deploy/pnpm-lock.yaml"
2026-10-12T11:01:46+01:00	DEBUG	[fs] Random cache key will be used	err="failed to open git repository: lstat /tmp/trivy-pnpm12-repro/.deploy/pnpm-lock.yaml/.git: not a directory"
2026-10-12T11:01:46+01:00	DEBUG	Created process-specific temp directory	path="/tmp/trivy-2351381578"
2026-10-12T11:01:46+01:00	INFO	[pnpm] Run "pnpm install" to collect the license information of packages	dir="node_modules"
2026-10-12T11:01:46+01:00	DEBUG	[pnpm] Skip non-semver package	pkg_path="repro-shared@file:///tmp/trivy-pnpm12-repro/packages/shared" version="file:///tmp/trivy-pnpm12-repro/packages/shared" err="invalid semantic version"
2026-10-12T11:01:46+01:00	DEBUG	OS is not detected.
2026-10-12T11:01:46+01:00	INFO	Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2026-10-12T11:01:46+01:00	DEBUG	Detected OS: unknown
2026-10-12T11:01:46+01:00	INFO	Number of language-specific files	num=1
2026-10-12T11:01:46+01:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2026-10-12T11:01:46+01:00	DEBUG	[vex] VEX filtering is disabled
2026-10-12T11:01:46+01:00	DEBUG	Cleaning up temp directory	path="/tmp/trivy-2351381578"

Operating System

Ubuntu 24.04.1 LTS, Linux kernel 7.0.0-34-generic, x86_64

Version

Trivy:
Version: 0.75.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-10-12 07:12:51.98420317 +0000 UTC
  NextUpdate: 2026-10-13 07:12:51.98420302 +0000 UTC
  DownloadedAt: 2026-10-12 08:40:47.110880068 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @sergio-ferreira-jscrambler
Thanks for your report!

Created #11389

Regards, Dmitriy