fix(nodejs): remove unused fields for the pnpm lockfile

[nikpivkin]

Description

I have deleted unused fields so that changes in the pnpm lockfile specification do not affect the parser operation.

Before

go run cmd/trivy/main.go fs -f json --scanners vuln /Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo -d
2023-06-15T17:17:42.747+0600    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-06-15T17:17:42.755+0600    DEBUG   cache dir:  /Users/tososomaru/Library/Caches/trivy
2023-06-15T17:17:42.755+0600    DEBUG   DB update was skipped because the local DB is the latest
2023-06-15T17:17:42.755+0600    DEBUG   DB Schema: 2, UpdatedAt: 2023-06-15 06:08:18.929820658 +0000 UTC, NextUpdate: 2023-06-15 12:08:18.929820158 +0000 UTC, DownloadedAt: 2023-06-15 06:18:51.189024 +0000 UTC
2023-06-15T17:17:42.755+0600    INFO    Vulnerability scanning is enabled
2023-06-15T17:17:42.755+0600    DEBUG   Vulnerability type:  [os library]
2023-06-15T17:17:42.756+0600    DEBUG   Walk the file tree rooted at '/Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo' in parallel
2023-06-15T17:17:42.763+0600    DEBUG   Analysis error: unable to parse pnpm-lock.yaml: failed to parse pnpm-lock.yaml: failed to parse pnpm-lock.yaml: decode error: yaml: unmarshal errors:
  line 8: cannot unmarshal !!map into string
  ....
  line 171: cannot unmarshal !!map into string
2023-06-15T17:17:42.773+0600    DEBUG   OS is not detected.
2023-06-15T17:17:42.773+0600    DEBUG   Detected OS: unknown
2023-06-15T17:17:42.773+0600    INFO    Number of language-specific files: 0
{
  "SchemaVersion": 2,
  "ArtifactName": "/Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  }
}

After

go run cmd/trivy/main.go fs -f json --scanners vuln /Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo -d
2023-06-15T17:16:38.881+0600    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-06-15T17:16:38.894+0600    DEBUG   cache dir:  /Users/tososomaru/Library/Caches/trivy
2023-06-15T17:16:38.895+0600    DEBUG   DB update was skipped because the local DB is the latest
2023-06-15T17:16:38.895+0600    DEBUG   DB Schema: 2, UpdatedAt: 2023-06-15 06:08:18.929820658 +0000 UTC, NextUpdate: 2023-06-15 12:08:18.929820158 +0000 UTC, DownloadedAt: 2023-06-15 06:18:51.189024 +0000 UTC
2023-06-15T17:16:38.895+0600    INFO    Vulnerability scanning is enabled
2023-06-15T17:16:38.895+0600    DEBUG   Vulnerability type:  [os library]
2023-06-15T17:16:38.896+0600    DEBUG   Walk the file tree rooted at '/Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo' in parallel
2023-06-15T17:16:38.917+0600    DEBUG   OS is not detected.
2023-06-15T17:16:38.917+0600    DEBUG   Detected OS: unknown
2023-06-15T17:16:38.917+0600    INFO    Number of language-specific files: 1
2023-06-15T17:16:38.917+0600    INFO    Detecting pnpm vulnerabilities...
2023-06-15T17:16:38.917+0600    DEBUG   Detecting library vulnerabilities, type: pnpm, path: pnpm-lock.yaml
{
  "SchemaVersion": 2,
  "ArtifactName": "/Users/tososomaru/projects/trivy-test/pnpm-turbo-docker-monorepo",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  }
}

Related issues

• Close PNPM scanning is broken #4559

Related PRs

• refactor(nodejs): remove unused fields for the pnpm lockfile go-dep-parser#230

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

The title should be fix(nodejs) as this change actually resolves the problem.

[knqyf263]

@nikpivkin Did you confirm it worked with https://github.com/kikar/pnpm-turbo-docker-monorepo?

[nikpivkin]

@knqyf263 Yes, I updated the description and added an example before and after