feat: support for pnpm lockfile v9 (#12)

lib/lock-parser/build-dep-graph.ts

@@ -36,6 +36,7 @@ export async function buildDepGraph(
   switch (lockfileVersion) {
     case NodeLockfileVersion.PnpmLockV5:
     case NodeLockfileVersion.PnpmLockV6:
+    case NodeLockfileVersion.PnpmLockV9:
       return await lockFileParser.parsePnpmProject(
         manifestFileContents,
         lockFileContents,

lib/lock-parser/index.ts

@@ -47,7 +47,8 @@ export async function parse(
     lockfileVersion === NodeLockfileVersion.NpmLockV2 ||
     lockfileVersion === NodeLockfileVersion.NpmLockV3 ||
     lockfileVersion === NodeLockfileVersion.PnpmLockV5 ||
-    lockfileVersion === NodeLockfileVersion.PnpmLockV6
+    lockfileVersion === NodeLockfileVersion.PnpmLockV6 ||
+    lockfileVersion === NodeLockfileVersion.PnpmLockV9
   ) {
     return await buildDepGraph(
       root,

package.json

@@ -42,7 +42,7 @@
     "lodash.isempty": "^4.4.0",
     "lodash.sortby": "^4.7.0",
     "micromatch": "4.0.2",
-    "snyk-nodejs-lockfile-parser": "^1.53.3",
+    "snyk-nodejs-lockfile-parser": "^1.56.0",
     "snyk-resolve-deps": "4.8.0"
   },
   "devDependencies": {

test/fixtures/pnpm/lock-v9/simple-app/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "one-dep",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "accepts": "1.3.7"
+  }
+}

test/fixtures/pnpm/lock-v9/undefined-package-version/package.json

@@ -0,0 +1,13 @@
+{
+    "name": "pnpm-shallow-goof",
+    "version": "0.0.1",
+    "description": "A vulnerable demo application",
+    "homepage": "https://snyk.io/",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/snyk-fixtures/pnpm-shallow-goof"
+    },
+    "dependencies": {
+        "a": "workspace:*"
+    }
+}

test/fixtures/pnpm/lock-v9/undefined-package-version/packages/pkg-a/package.json

@@ -0,0 +1,16 @@
+{
+    "name": "a",
+    "description": "",
+    "main": "index.js",
+    "scripts": {
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "keywords": [],
+    "author": "",
+    "license": "ISC",
+    "dependencies": {
+        "node-uuid": "1.4.0",
+        "qs": "0.0.6"
+    }
+  }
+

test/fixtures/pnpm/lock-v9/workspace-empty-config-file/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "yarn-1-workspace-with-isolated-pkgs",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "react": "18.0.0"
+  },
+  "private": true
+}

test/fixtures/pnpm/lock-v9/workspace-empty-config-file/packages/pkg-a/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-a",
+  "version": "1.0.0",
+  "dependencies": {
+    "ms": "2.1.2"
+  }
+}

test/fixtures/pnpm/lock-v9/workspace-empty-config-file/packages/pkg-b/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "pkg-b",
+  "version": "1.0.0",
+  "dependencies": {
+    "accepts": "1.3.7"
+  }
+}

test/fixtures/pnpm/lock-v9/workspace-empty-config-file/pnpm-workspace.yaml

@@ -0,0 +1 @@
+// should get all subdirs

test/fixtures/pnpm/lock-v9/workspace-with-cross-ref/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pnpm-1-workspace-with-cross-ref",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "private": true,
+  "workspaces": ["packages/*"]
+}