Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bug(pnpm): infinity loop for markRootPkgs function #6848

Closed
1 of 2 tasks
DmitriyLewen opened this issue Jun 4, 2024 Discussed in #6843 · 0 comments · Fixed by #6857
Closed
1 of 2 tasks

bug(pnpm): infinity loop for markRootPkgs function #6848

DmitriyLewen opened this issue Jun 4, 2024 Discussed in #6843 · 0 comments · Fixed by #6857
Assignees
@DmitriyLewen
Labels
kind/bug Categorizes issue or PR as related to a bug.

Comments

@DmitriyLewen
Copy link
Contributor

Discussed in #6843

Originally posted by marcindulak June 3, 2024

Description

https://github.com/aquasecurity/trivy/tree/v0.52.0 fails with fatal error: stack overflow on some pnpm-lock.yaml files.

Desired Behavior

Successful scan

Actual Behavior

runtime: goroutine stack exceeds 1000000000-byte limit
runtime: sp=0x14023c265d0 stack=[0x14023c26000, 0x14043c26000]
fatal error: stack overflow

runtime stack:
...

Reproduction Steps

1. Download trivy
   
   path=v0.52.0/trivy_0.52.0_Linux-64bit.tar.gz
   path=v0.52.0/trivy_0.52.0_macOS-ARM64.tar.gz
   curl -sLO https://github.com/aquasecurity/trivy/releases/download/$path
   file=$(echo $path | cut -d/ -f2)
   tar zxf $file trivy
  1. Generate a problematic pnpm-lock.yaml 
    docker run --rm -it --volume $PWD:/mnt --name trivy-fatal-error node:20-bookworm-slim bash -c "npm install -g pnpm && cd /mnt && rm -f package.json pnpm-lock.yaml && pnpm add @babel/core"
  2. Run a scan 
    ./trivy filesystem --scanners vuln --format json --exit-code 1 --severity HIGH,CRITICAL --no-progress .

Here is an example of a failing pnpm-lock.yaml

lockfileVersion: '9.0'

settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

importers:

  .:
    dependencies:
      '@babel/core':
        specifier: ^7.24.6
        version: 7.24.6

packages:

  '@ampproject/remapping@2.3.0':
    resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
    engines: {node: '>=6.0.0'}

  '@babel/code-frame@7.24.6':
    resolution: {integrity: sha512-ZJhac6FkEd1yhG2AHOmfcXG4ceoLltoCVJjN5XsWN9BifBQr+cHJbWi0h68HZuSORq+3WtJ2z0hwF2NG1b5kcA==}
    engines: {node: '>=6.9.0'}

  '@babel/compat-data@7.24.6':
    resolution: {integrity: sha512-aC2DGhBq5eEdyXWqrDInSqQjO0k8xtPRf5YylULqx8MCd6jBtzqfta/3ETMRpuKIc5hyswfO80ObyA1MvkCcUQ==}
    engines: {node: '>=6.9.0'}

  '@babel/core@7.24.6':
    resolution: {integrity: sha512-qAHSfAdVyFmIvl0VHELib8xar7ONuSHrE2hLnsaWkYNTI68dmi1x8GYDhJjMI/e7XWal9QBlZkwbOnkcw7Z8gQ==}
    engines: {node: '>=6.9.0'}

  '@babel/generator@7.24.6':
    resolution: {integrity: sha512-S7m4eNa6YAPJRHmKsLHIDJhNAGNKoWNiWefz1MBbpnt8g9lvMDl1hir4P9bo/57bQEmuwEhnRU/AMWsD0G/Fbg==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-compilation-targets@7.24.6':
    resolution: {integrity: sha512-VZQ57UsDGlX/5fFA7GkVPplZhHsVc+vuErWgdOiysI9Ksnw0Pbbd6pnPiR/mmJyKHgyIW0c7KT32gmhiF+cirg==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-environment-visitor@7.24.6':
    resolution: {integrity: sha512-Y50Cg3k0LKLMjxdPjIl40SdJgMB85iXn27Vk/qbHZCFx/o5XO3PSnpi675h1KEmmDb6OFArfd5SCQEQ5Q4H88g==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-function-name@7.24.6':
    resolution: {integrity: sha512-xpeLqeeRkbxhnYimfr2PC+iA0Q7ljX/d1eZ9/inYbmfG2jpl8Lu3DyXvpOAnrS5kxkfOWJjioIMQsaMBXFI05w==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-hoist-variables@7.24.6':
    resolution: {integrity: sha512-SF/EMrC3OD7dSta1bLJIlrsVxwtd0UpjRJqLno6125epQMJ/kyFmpTT4pbvPbdQHzCHg+biQ7Syo8lnDtbR+uA==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-module-imports@7.24.6':
    resolution: {integrity: sha512-a26dmxFJBF62rRO9mmpgrfTLsAuyHk4e1hKTUkD/fcMfynt8gvEKwQPQDVxWhca8dHoDck+55DFt42zV0QMw5g==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-module-transforms@7.24.6':
    resolution: {integrity: sha512-Y/YMPm83mV2HJTbX1Qh2sjgjqcacvOlhbzdCCsSlblOKjSYmQqEbO6rUniWQyRo9ncyfjT8hnUjlG06RXDEmcA==}
    engines: {node: '>=6.9.0'}
    peerDependencies:
      '@babel/core': ^7.0.0

  '@babel/helper-simple-access@7.24.6':
    resolution: {integrity: sha512-nZzcMMD4ZhmB35MOOzQuiGO5RzL6tJbsT37Zx8M5L/i9KSrukGXWTjLe1knIbb/RmxoJE9GON9soq0c0VEMM5g==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-split-export-declaration@7.24.6':
    resolution: {integrity: sha512-CvLSkwXGWnYlF9+J3iZUvwgAxKiYzK3BWuo+mLzD/MDGOZDj7Gq8+hqaOkMxmJwmlv0iu86uH5fdADd9Hxkymw==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-string-parser@7.24.6':
    resolution: {integrity: sha512-WdJjwMEkmBicq5T9fm/cHND3+UlFa2Yj8ALLgmoSQAJZysYbBjw+azChSGPN4DSPLXOcooGRvDwZWMcF/mLO2Q==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-validator-identifier@7.24.6':
    resolution: {integrity: sha512-4yA7s865JHaqUdRbnaxarZREuPTHrjpDT+pXoAZ1yhyo6uFnIEpS8VMu16siFOHDpZNKYv5BObhsB//ycbICyw==}
    engines: {node: '>=6.9.0'}

  '@babel/helper-validator-option@7.24.6':
    resolution: {integrity: sha512-Jktc8KkF3zIkePb48QO+IapbXlSapOW9S+ogZZkcO6bABgYAxtZcjZ/O005111YLf+j4M84uEgwYoidDkXbCkQ==}
    engines: {node: '>=6.9.0'}

  '@babel/helpers@7.24.6':
    resolution: {integrity: sha512-V2PI+NqnyFu1i0GyTd/O/cTpxzQCYioSkUIRmgo7gFEHKKCg5w46+r/A6WeUR1+P3TeQ49dspGPNd/E3n9AnnA==}
    engines: {node: '>=6.9.0'}

  '@babel/highlight@7.24.6':
    resolution: {integrity: sha512-2YnuOp4HAk2BsBrJJvYCbItHx0zWscI1C3zgWkz+wDyD9I7GIVrfnLyrR4Y1VR+7p+chAEcrgRQYZAGIKMV7vQ==}
    engines: {node: '>=6.9.0'}

  '@babel/parser@7.24.6':
    resolution: {integrity: sha512-eNZXdfU35nJC2h24RznROuOpO94h6x8sg9ju0tT9biNtLZ2vuP8SduLqqV+/8+cebSLV9SJEAN5Z3zQbJG/M+Q==}
    engines: {node: '>=6.0.0'}
    hasBin: true

  '@babel/template@7.24.6':
    resolution: {integrity: sha512-3vgazJlLwNXi9jhrR1ef8qiB65L1RK90+lEQwv4OxveHnqC3BfmnHdgySwRLzf6akhlOYenT+b7AfWq+a//AHw==}
    engines: {node: '>=6.9.0'}

  '@babel/traverse@7.24.6':
    resolution: {integrity: sha512-OsNjaJwT9Zn8ozxcfoBc+RaHdj3gFmCmYoQLUII1o6ZrUwku0BMg80FoOTPx+Gi6XhcQxAYE4xyjPTo4SxEQqw==}
    engines: {node: '>=6.9.0'}

  '@babel/types@7.24.6':
    resolution: {integrity: sha512-WaMsgi6Q8zMgMth93GvWPXkhAIEobfsIkLTacoVZoK1J0CevIPGYY2Vo5YvJGqyHqXM6P4ppOYGsIRU8MM9pFQ==}
    engines: {node: '>=6.9.0'}

  '@jridgewell/gen-mapping@0.3.5':
    resolution: {integrity: sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/resolve-uri@3.1.2':
    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/set-array@1.2.1':
    resolution: {integrity: sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/sourcemap-codec@1.4.15':
    resolution: {integrity: sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==}

  '@jridgewell/trace-mapping@0.3.25':
    resolution: {integrity: sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==}

  ansi-styles@3.2.1:
    resolution: {integrity: sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==}
    engines: {node: '>=4'}

  browserslist@4.23.0:
    resolution: {integrity: sha512-QW8HiM1shhT2GuzkvklfjcKDiWFXHOeFCIA/huJPwHsslwcydgk7X+z2zXpEijP98UCY7HbubZt5J2Zgvf0CaQ==}
    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
    hasBin: true

  caniuse-lite@1.0.30001627:
    resolution: {integrity: sha512-4zgNiB8nTyV/tHhwZrFs88ryjls/lHiqFhrxCW4qSTeuRByBVnPYpDInchOIySWknznucaf31Z4KYqjfbrecVw==}

  chalk@2.4.2:
    resolution: {integrity: sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==}
    engines: {node: '>=4'}

  color-convert@1.9.3:
    resolution: {integrity: sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==}

  color-name@1.1.3:
    resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}

  convert-source-map@2.0.0:
    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}

  debug@4.3.5:
    resolution: {integrity: sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==}
    engines: {node: '>=6.0'}
    peerDependencies:
      supports-color: '*'
    peerDependenciesMeta:
      supports-color:
        optional: true

  electron-to-chromium@1.4.788:
    resolution: {integrity: sha512-ubp5+Ev/VV8KuRoWnfP2QF2Bg+O2ZFdb49DiiNbz2VmgkIqrnyYaqIOqj8A6K/3p1xV0QcU5hBQ1+BmB6ot1OA==}

  escalade@3.1.2:
    resolution: {integrity: sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==}
    engines: {node: '>=6'}

  escape-string-regexp@1.0.5:
    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
    engines: {node: '>=0.8.0'}

  gensync@1.0.0-beta.2:
    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
    engines: {node: '>=6.9.0'}

  globals@11.12.0:
    resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
    engines: {node: '>=4'}

  has-flag@3.0.0:
    resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
    engines: {node: '>=4'}

  js-tokens@4.0.0:
    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}

  jsesc@2.5.2:
    resolution: {integrity: sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==}
    engines: {node: '>=4'}
    hasBin: true

  json5@2.2.3:
    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
    engines: {node: '>=6'}
    hasBin: true

  lru-cache@5.1.1:
    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}

  ms@2.1.2:
    resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}

  node-releases@2.0.14:
    resolution: {integrity: sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw==}

  picocolors@1.0.1:
    resolution: {integrity: sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==}

  semver@6.3.1:
    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
    hasBin: true

  supports-color@5.5.0:
    resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
    engines: {node: '>=4'}

  to-fast-properties@2.0.0:
    resolution: {integrity: sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==}
    engines: {node: '>=4'}

  update-browserslist-db@1.0.16:
    resolution: {integrity: sha512-KVbTxlBYlckhF5wgfyZXTWnMn7MMZjMu9XG8bPlliUOP9ThaF4QnhP8qrjrH7DRzHfSk0oQv1wToW+iA5GajEQ==}
    hasBin: true
    peerDependencies:
      browserslist: '>= 4.21.0'

  yallist@3.1.1:
    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}

snapshots:

  '@ampproject/remapping@2.3.0':
    dependencies:
      '@jridgewell/gen-mapping': 0.3.5
      '@jridgewell/trace-mapping': 0.3.25

  '@babel/code-frame@7.24.6':
    dependencies:
      '@babel/highlight': 7.24.6
      picocolors: 1.0.1

  '@babel/compat-data@7.24.6': {}

  '@babel/core@7.24.6':
    dependencies:
      '@ampproject/remapping': 2.3.0
      '@babel/code-frame': 7.24.6
      '@babel/generator': 7.24.6
      '@babel/helper-compilation-targets': 7.24.6
      '@babel/helper-module-transforms': 7.24.6(@babel/core@7.24.6)
      '@babel/helpers': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/template': 7.24.6
      '@babel/traverse': 7.24.6
      '@babel/types': 7.24.6
      convert-source-map: 2.0.0
      debug: 4.3.5
      gensync: 1.0.0-beta.2
      json5: 2.2.3
      semver: 6.3.1
    transitivePeerDependencies:
      - supports-color

  '@babel/generator@7.24.6':
    dependencies:
      '@babel/types': 7.24.6
      '@jridgewell/gen-mapping': 0.3.5
      '@jridgewell/trace-mapping': 0.3.25
      jsesc: 2.5.2

  '@babel/helper-compilation-targets@7.24.6':
    dependencies:
      '@babel/compat-data': 7.24.6
      '@babel/helper-validator-option': 7.24.6
      browserslist: 4.23.0
      lru-cache: 5.1.1
      semver: 6.3.1

  '@babel/helper-environment-visitor@7.24.6': {}

  '@babel/helper-function-name@7.24.6':
    dependencies:
      '@babel/template': 7.24.6
      '@babel/types': 7.24.6

  '@babel/helper-hoist-variables@7.24.6':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/helper-module-imports@7.24.6':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/helper-module-transforms@7.24.6(@babel/core@7.24.6)':
    dependencies:
      '@babel/core': 7.24.6
      '@babel/helper-environment-visitor': 7.24.6
      '@babel/helper-module-imports': 7.24.6
      '@babel/helper-simple-access': 7.24.6
      '@babel/helper-split-export-declaration': 7.24.6
      '@babel/helper-validator-identifier': 7.24.6

  '@babel/helper-simple-access@7.24.6':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/helper-split-export-declaration@7.24.6':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/helper-string-parser@7.24.6': {}

  '@babel/helper-validator-identifier@7.24.6': {}

  '@babel/helper-validator-option@7.24.6': {}

  '@babel/helpers@7.24.6':
    dependencies:
      '@babel/template': 7.24.6
      '@babel/types': 7.24.6

  '@babel/highlight@7.24.6':
    dependencies:
      '@babel/helper-validator-identifier': 7.24.6
      chalk: 2.4.2
      js-tokens: 4.0.0
      picocolors: 1.0.1

  '@babel/parser@7.24.6':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/template@7.24.6':
    dependencies:
      '@babel/code-frame': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/types': 7.24.6

  '@babel/traverse@7.24.6':
    dependencies:
      '@babel/code-frame': 7.24.6
      '@babel/generator': 7.24.6
      '@babel/helper-environment-visitor': 7.24.6
      '@babel/helper-function-name': 7.24.6
      '@babel/helper-hoist-variables': 7.24.6
      '@babel/helper-split-export-declaration': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/types': 7.24.6
      debug: 4.3.5
      globals: 11.12.0
    transitivePeerDependencies:
      - supports-color

  '@babel/types@7.24.6':
    dependencies:
      '@babel/helper-string-parser': 7.24.6
      '@babel/helper-validator-identifier': 7.24.6
      to-fast-properties: 2.0.0

  '@jridgewell/gen-mapping@0.3.5':
    dependencies:
      '@jridgewell/set-array': 1.2.1
      '@jridgewell/sourcemap-codec': 1.4.15
      '@jridgewell/trace-mapping': 0.3.25

  '@jridgewell/resolve-uri@3.1.2': {}

  '@jridgewell/set-array@1.2.1': {}

  '@jridgewell/sourcemap-codec@1.4.15': {}

  '@jridgewell/trace-mapping@0.3.25':
    dependencies:
      '@jridgewell/resolve-uri': 3.1.2
      '@jridgewell/sourcemap-codec': 1.4.15

  ansi-styles@3.2.1:
    dependencies:
      color-convert: 1.9.3

  browserslist@4.23.0:
    dependencies:
      caniuse-lite: 1.0.30001627
      electron-to-chromium: 1.4.788
      node-releases: 2.0.14
      update-browserslist-db: 1.0.16(browserslist@4.23.0)

  caniuse-lite@1.0.30001627: {}

  chalk@2.4.2:
    dependencies:
      ansi-styles: 3.2.1
      escape-string-regexp: 1.0.5
      supports-color: 5.5.0

  color-convert@1.9.3:
    dependencies:
      color-name: 1.1.3

  color-name@1.1.3: {}

  convert-source-map@2.0.0: {}

  debug@4.3.5:
    dependencies:
      ms: 2.1.2

  electron-to-chromium@1.4.788: {}

  escalade@3.1.2: {}

  escape-string-regexp@1.0.5: {}

  gensync@1.0.0-beta.2: {}

  globals@11.12.0: {}

  has-flag@3.0.0: {}

  js-tokens@4.0.0: {}

  jsesc@2.5.2: {}

  json5@2.2.3: {}

  lru-cache@5.1.1:
    dependencies:
      yallist: 3.1.1

  ms@2.1.2: {}

  node-releases@2.0.14: {}

  picocolors@1.0.1: {}

  semver@6.3.1: {}

  supports-color@5.5.0:
    dependencies:
      has-flag: 3.0.0

  to-fast-properties@2.0.0: {}

  update-browserslist-db@1.0.16(browserslist@4.23.0):
    dependencies:
      browserslist: 4.23.0
      escalade: 3.1.2
      picocolors: 1.0.1

  yallist@3.1.1: {}



### Target

Filesystem

### Scanner

Vulnerability

### Output Format

JSON

### Mode

Standalone

### Debug Output

```bash
2024-06-03T17:16:58+02:00	DEBUG	Parsed severities	severities=[HIGH CRITICAL]
2024-06-03T17:16:58+02:00	DEBUG	Ignore statuses	statuses=[]
2024-06-03T17:16:58+02:00	DEBUG	Cache dir	dir="/Users/user/Library/Caches/trivy"
2024-06-03T17:16:58+02:00	DEBUG	DB update was skipped because the local DB is the latest
2024-06-03T17:16:58+02:00	DEBUG	DB info	schema=2 updated_at=2024-06-03T12:11:45.362440298Z next_update=2024-06-03T18:11:45.362440047Z downloaded_at=2024-06-03T15:11:43.348442Z
2024-06-03T17:16:58+02:00	INFO	Vulnerability scanning is enabled
2024-06-03T17:16:58+02:00	DEBUG	Vulnerability type	type=[os library]
2024-06-03T17:16:58+02:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-06-03T17:16:58+02:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
runtime: goroutine stack exceeds 1000000000-byte limit
runtime: sp=0x14023c265d0 stack=[0x14023c26000, 0x14043c26000]
fatal error: stack overflow

runtime stack:
runtime.throw({0x107151d21?, 0x200000001?})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/panic.go:1023 +0x40 fp=0x16ee031a0 sp=0x16ee03170 pc=0x1010387d0
runtime.newstack()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/stack.go:1103 +0x460 fp=0x16ee03350 sp=0x16ee031a0 pc=0x101055150
runtime.morestack()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:341 +0x70 fp=0x16ee03350 sp=0x16ee03350 pc=0x10106e180

goroutine 11 gp=0x14000584e00 m=0 mp=0x10d5e5d80 [running]:
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:222 +0x18c fp=0x14023c265d0 sp=0x14023c265d0 pc=0x106e3fb1c
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c269a0 sp=0x14023c265d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c26d70 sp=0x14023c269a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27140 sp=0x14023c26d70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27510 sp=0x14023c27140 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c278e0 sp=0x14023c27510 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27cb0 sp=0x14023c278e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28080 sp=0x14023c27cb0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28450 sp=0x14023c28080 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28820 sp=0x14023c28450 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28bf0 sp=0x14023c28820 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28fc0 sp=0x14023c28bf0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29390 sp=0x14023c28fc0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29760 sp=0x14023c29390 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29b30 sp=0x14023c29760 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29f00 sp=0x14023c29b30 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2a2d0 sp=0x14023c29f00 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2a6a0 sp=0x14023c2a2d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2aa70 sp=0x14023c2a6a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ae40 sp=0x14023c2aa70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b210 sp=0x14023c2ae40 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b5e0 sp=0x14023c2b210 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b9b0 sp=0x14023c2b5e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2bd80 sp=0x14023c2b9b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c150 sp=0x14023c2bd80 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c520 sp=0x14023c2c150 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c8f0 sp=0x14023c2c520 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ccc0 sp=0x14023c2c8f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d090 sp=0x14023c2ccc0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d460 sp=0x14023c2d090 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d830 sp=0x14023c2d460 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2dc00 sp=0x14023c2d830 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2dfd0 sp=0x14023c2dc00 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2e3a0 sp=0x14023c2dfd0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2e770 sp=0x14023c2e3a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2eb40 sp=0x14023c2e770 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ef10 sp=0x14023c2eb40 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2f2e0 sp=0x14023c2ef10 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2f6b0 sp=0x14023c2f2e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2fa80 sp=0x14023c2f6b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2fe50 sp=0x14023c2fa80 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c30220 sp=0x14023c2fe50 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c305f0 sp=0x14023c30220 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c309c0 sp=0x14023c305f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c30d90 sp=0x14023c309c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31160 sp=0x14023c30d90 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31530 sp=0x14023c31160 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31900 sp=0x14023c31530 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31cd0 sp=0x14023c31900 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c320a0 sp=0x14023c31cd0 pc=0x106e3fadc
...549976 frames elided...
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1b3f0 sp=0x14043c1b020 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1b7c0 sp=0x14043c1b3f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1bb90 sp=0x14043c1b7c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1bf60 sp=0x14043c1bb90 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1c330 sp=0x14043c1bf60 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1c700 sp=0x14043c1c330 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1cad0 sp=0x14043c1c700 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1cea0 sp=0x14043c1cad0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1d270 sp=0x14043c1cea0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1d640 sp=0x14043c1d270 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1da10 sp=0x14043c1d640 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1dde0 sp=0x14043c1da10 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e1b0 sp=0x14043c1dde0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e580 sp=0x14043c1e1b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e950 sp=0x14043c1e580 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1ed20 sp=0x14043c1e950 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f0f0 sp=0x14043c1ed20 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f4c0 sp=0x14043c1f0f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f890 sp=0x14043c1f4c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1fc60 sp=0x14043c1f890 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20030 sp=0x14043c1fc60 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20400 sp=0x14043c20030 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c207d0 sp=0x14043c20400 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20ba0 sp=0x14043c207d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20f70 sp=0x14043c20ba0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21340 sp=0x14043c20f70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21710 sp=0x14043c21340 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21ae0 sp=0x14043c21710 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21eb0 sp=0x14043c21ae0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22280 sp=0x14043c21eb0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22650 sp=0x14043c22280 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22a20 sp=0x14043c22650 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22df0 sp=0x14043c22a20 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c231c0 sp=0x14043c22df0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23590 sp=0x14043c231c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23960 sp=0x14043c23590 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23d30 sp=0x14043c23960 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c24100 sp=0x14043c23d30 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c79698, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c244d0 sp=0x14043c24100 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c900c0, 0x28}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c248a0 sp=0x14043c244d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c79ba8, 0x12}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c24c70 sp=0x14043c248a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).parseV9(0x14000e76450, {{0x108d7b120, 0x140034783a0}, 0x0, 0x0, 0x1400189bd40, {{0x1400189bce0, 0x0}}, 0x1400189bdd0})
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:214 +0x77c fp=0x14043c25ab0 sp=0x14043c24c70 pc=0x106e3f48c
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).Parse(0x14000e76450, {0x109ca8e30, 0x14000e76448})
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:87 +0x260 fp=0x14043c25b90 sp=0x14043c25ab0 pc=0x106e3e480
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language.Parse({0x1070f7334, 0x4}, {0x14000d1b310, 0xe}, {0x109c078a0?, 0x14000e76448?}, {0x109c1c9a0, 0x14000e76450})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/analyze.go:55 +0xac fp=0x14043c25c50 sp=0x14043c25b90 pc=0x106ddddec
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language.Analyze({0x1070f7334?, 0x4?}, {0x14000d1b310, 0xe}, {0x109ca8e30?, 0x14000e76448?}, {0x109c1c9a0?, 0x14000e76450?})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/analyze.go:23 +0x5c fp=0x14043c25cf0 sp=0x14043c25c50 pc=0x106ddd94c
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pnpm.pnpmLibraryAnalyzer.Analyze({}, {0x1400050a5e8?, 0x10104d734?}, {{0x16ee0386e, 0x1}, {0x14000d1b310, 0xe}, {0x109cc7608, 0x14001c27ba0}, {0x109ca8e30, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/nodejs/pnpm/pnpm.go:28 +0xb4 fp=0x14043c25d80 sp=0x14043c25cf0 pc=0x106e40604
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pnpm.(*pnpmLibraryAnalyzer).Analyze(0x10d32ca30?, {0x109cb9030?, 0x14000d4a000?}, {{0x16ee0386e, 0x1}, {0x14000d1b310, 0xe}, {0x109cc7608, 0x14001c27ba0}, {0x109ca8e30, ...}, ...})
	<autogenerated>:1 +0x8c fp=0x14043c25df0 sp=0x14043c25d80 pc=0x106e4088c
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile.func1({0x109cbbc90?, 0x10d656ac0?}, {0x109cb9888?, 0x14000e76448?})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:432 +0x184 fp=0x14043c25fa0 sp=0x14043c25df0 pc=0x10695cc34
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile.gowrap1()
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:444 +0x3c fp=0x14043c25fd0 sp=0x14043c25fa0 pc=0x10695ca7c
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14043c25fd0 sp=0x14043c25fd0 pc=0x1010703f4
created by github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile in goroutine 1
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:427 +0x3bc

goroutine 1 gp=0x140000021c0 m=nil [semacquire]:
runtime.gopark(0x10d5f3560?, 0x0?, 0x80?, 0x73?, 0x4?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14003abf410 sp=0x14003abf3f0 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.semacquire1(0x14003c0dec8, 0x0, 0x1, 0x0, 0x12)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/sema.go:160 +0x208 fp=0x14003abf460 sp=0x14003abf410 pc=0x10104ee18
sync.runtime_Semacquire(0x14003abf401?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/sema.go:62 +0x2c fp=0x14003abf4a0 sp=0x14003abf460 pc=0x10106b7ac
sync.(*WaitGroup).Wait(0x14003c0dec0)
	/opt/hostedtoolcache/go/1.22.3/x64/src/sync/waitgroup.go:116 +0x74 fp=0x14003abf4c0 sp=0x14003abf4a0 pc=0x10107e124
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16ee0386e, 0x1}, {0x134ee5140, 0x14001311510}, {0x109c08060, 0x10d656ac0}, {0x140013117f0, {0x14000c89200, 0x1e, 0x20}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:117 +0x320 fp=0x14003abfc30 sp=0x14003abf4c0 pc=0x106d3e120
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.(*Artifact).Inspect(_, {_, _})
	<autogenerated>:1 +0xc0 fp=0x14003ac0990 sp=0x14003abfc30 pc=0x106d3edc0
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x14003d03b40, 0x2, 0x2}, {0x14003d03d40, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/scanner/scan.go:146 +0xa4 fp=0x14003ac1480 sp=0x14003ac0990 pc=0x106e7df64
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000bea20, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:691 +0x320 fp=0x14003ac2fc0 sp=0x14003ac1480 pc=0x106e83f80
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:264 +0xa8 fp=0x14003ac3cc0 sp=0x14003ac2fc0 pc=0x106e7fac8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:212 +0xac fp=0x14003ac49b0 sp=0x14003ac3cc0 pc=0x106e7f48c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:192 +0x1b8 fp=0x14003ac56b0 sp=0x14003ac49b0 pc=0x106e7f178
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000bea20, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:425 +0x408 fp=0x14003ac6ca0 sp=0x14003ac56b0 pc=0x106e80fa8
github.com/aquasecurity/trivy/pkg/commands.NewFilesystemCommand.func2(0x14000a3b808, {0x140013d9550, 0x1, 0xb})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:372 +0x160 fp=0x14003ac7b40 sp=0x14003ac6ca0 pc=0x106f27780
github.com/spf13/cobra.(*Command).execute(0x14000a3b808, {0x140013d93f0, 0xb, 0xb})
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:983 +0x840 fp=0x14003ac7cd0 sp=0x14003ac7b40 pc=0x101205940
github.com/spf13/cobra.(*Command).ExecuteC(0x14000a3b208)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1115 +0x344 fp=0x14003ac7db0 sp=0x14003ac7cd0 pc=0x101206104
github.com/spf13/cobra.(*Command).Execute(0x107186795?)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1039 +0x1c fp=0x14003ac7dd0 sp=0x14003ac7db0 pc=0x101205d0c
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:39 +0x120 fp=0x14003ac7e90 sp=0x14003ac7dd0 pc=0x1070f43a0
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20 fp=0x14003ac7f40 sp=0x14003ac7e90 pc=0x1070f4180
runtime.main()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:271 +0x28c fp=0x14003ac7fd0 sp=0x14003ac7f40 pc=0x10103b10c
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14003ac7fd0 sp=0x14003ac7fd0 pc=0x1010703f4

goroutine 2 gp=0x14000002700 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ecf90 sp=0x140000ecf70 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.forcegchelper()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:326 +0xb8 fp=0x140000ecfd0 sp=0x140000ecf90 pc=0x10103b3c8
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ecfd0 sp=0x140000ecfd0 pc=0x1010703f4
created by runtime.init.6 in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:314 +0x24

goroutine 3 gp=0x14000002c40 m=nil [GC sweep wait]:
runtime.gopark(0x1?, 0x0?, 0x0?, 0x0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ed760 sp=0x140000ed740 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.bgsweep(0x140000fe000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcsweep.go:318 +0x108 fp=0x140000ed7b0 sp=0x140000ed760 pc=0x1010254c8
runtime.gcenable.gowrap1()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:203 +0x28 fp=0x140000ed7d0 sp=0x140000ed7b0 pc=0x101019668
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ed7d0 sp=0x140000ed7d0 pc=0x1010703f4
created by runtime.gcenable in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:203 +0x6c

goroutine 4 gp=0x14000002e00 m=nil [sleep]:
runtime.gopark(0x14000114000?, 0x2b4d0245aa46?, 0x0?, 0x0?, 0x109bf1c90?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000edf20 sp=0x140000edf00 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.(*scavengerState).sleep(0x10d5cc460, 0x40fd34a000000000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcscavenge.go:504 +0x128 fp=0x140000edf90 sp=0x140000edf20 pc=0x101023048
runtime.bgscavenge(0x140000fe000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcscavenge.go:662 +0x9c fp=0x140000edfb0 sp=0x140000edf90 pc=0x1010233fc
runtime.gcenable.gowrap2()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:204 +0x28 fp=0x140000edfd0 sp=0x140000edfb0 pc=0x101019608
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000edfd0 sp=0x140000edfd0 pc=0x1010703f4
created by runtime.gcenable in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:204 +0xac

goroutine 5 gp=0x14000003340 m=nil [finalizer wait]:
runtime.gopark(0x0?, 0x10dd6ae08?, 0xc8?, 0xc5?, 0x10100cc74?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ec580 sp=0x140000ec560 pc=0x10103b568
runtime.runfinq()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mfinal.go:194 +0x108 fp=0x140000ec7d0 sp=0x140000ec580 pc=0x101018738
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ec7d0 sp=0x140000ec7d0 pc=0x1010703f4
created by runtime.createfing in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mfinal.go:164 +0x80

goroutine 6 gp=0x140002cc540 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7d36?, 0x1?, 0x8d?, 0x85?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ee730 sp=0x140000ee710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000ee7d0 sp=0x140000ee730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ee7d0 sp=0x140000ee7d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 17 gp=0x14000184380 m=nil [GC worker (idle)]:
runtime.gopark(0x10d65b1a0?, 0x3?, 0xed?, 0xca?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e8730 sp=0x140000e8710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e87d0 sp=0x140000e8730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e87d0 sp=0x140000e87d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 33 gp=0x14000502000 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7d60?, 0x3?, 0xbc?, 0x28?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14000508730 sp=0x14000508710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140005087d0 sp=0x14000508730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140005087d0 sp=0x140005087d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 7 gp=0x140002cc700 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c95964c89?, 0x3?, 0x1?, 0xfc?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000eef30 sp=0x140000eef10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000eefd0 sp=0x140000eef30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000eefd0 sp=0x140000eefd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 18 gp=0x14000184540 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c500bca?, 0x3?, 0x2d?, 0xa0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e8f30 sp=0x140000e8f10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e8fd0 sp=0x140000e8f30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e8fd0 sp=0x140000e8fd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 8 gp=0x140002cc8c0 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4fbea4?, 0x14000500040?, 0x1a?, 0xa?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ef730 sp=0x140000ef710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000ef7d0 sp=0x140000ef730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ef7d0 sp=0x140000ef7d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 34 gp=0x140005021c0 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7ddd?, 0x3?, 0x3c?, 0xa9?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14000508f30 sp=0x14000508f10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x14000508fd0 sp=0x14000508f30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14000508fd0 sp=0x14000508fd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 19 gp=0x14000184700 m=nil [GC worker (idle)]:
runtime.gopark(0x10d65b1a0?, 0x3?, 0x3b?, 0x24?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e9730 sp=0x140000e9710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e97d0 sp=0x140000e9730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e97d0 sp=0x140000e97d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 9 gp=0x14000502c40 m=nil [select]:
runtime.gopark(0x1400050b768?, 0x3?, 0x0?, 0x20?, 0x1400050b762?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x1400050b610 sp=0x1400050b5f0 pc=0x10103b568
runtime.selectgo(0x1400050b768, 0x1400050b75c, 0x14000ce3480?, 0x0, 0x0?, 0x1)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/select.go:327 +0x614 fp=0x1400050b720 sp=0x1400050b610 pc=0x10104dfd4
go.opencensus.io/stats/view.(*worker).start(0x14000ce3480)
	/home/runner/go/pkg/mod/go.opencensus.io@v0.24.0/stats/view/worker.go:292 +0x88 fp=0x1400050b7b0 sp=0x1400050b720 pc=0x10544f788
go.opencensus.io/stats/view.init.0.gowrap1()
	/home/runner/go/pkg/mod/go.opencensus.io@v0.24.0/stats/view/worker.go:34 +0x28 fp=0x1400050b7d0 sp=0x1400050b7b0 pc=0x10544eb88
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x1400050b7d0 sp=0x1400050b7d0 pc=0x1010703f4
created by go.opencensus.io/stats/view.init.0 in goroutine 1
	/home/runner/go/pkg/mod/go.opencensus.io@v0.24.0/stats/view/worker.go:34 +0x98

Operating System

macOS sonoma 14.5 and Ubuntu Linux 22.04

Version

Version: 0.52.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-06-03 12:11:45.362440298 +0000 UTC
  NextUpdate: 2024-06-03 18:11:45.362440047 +0000 UTC
  DownloadedAt: 2024-06-03 15:11:43.348442 +0000 UTC

Checklist
@DmitriyLewen DmitriyLewen added the kind/bug Categorizes issue or PR as related to a bug. label Jun 4, 2024
@DmitriyLewen DmitriyLewen self-assigned this Jun 4, 2024
@DmitriyLewen DmitriyLewen mentioned this issue Jun 5, 2024
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DmitriyLewen DmitriyLewen

Labels
kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(nodejs): fix infinity loops for pnpm with cyclic imports DmitriyLewen/trivy
1 participant
@DmitriyLewen