Skip to content

v1.7.0 - pnpm lockfile v9 support and Analog case study

Choose a tag to compare

View all tags
@sonukapoor sonukapoor released this 17 Apr 17:55
· 634 commits to main since this release
v1.7.0
228f5e8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • pnpm lockfile v9 support — the v9 format (default in current pnpm installations) uses name@version keys and a snapshots section instead of the legacy /name/version and packages layout; the parser now branches on lockfileVersion and routes v9+ lockfiles through a dedicated path, eliminating false negatives on modern pnpm projects
  • Analog case study — full scan-fix workflow on a real pnpm v9 Angular monorepo (3,367 packages), including a comparison table against pnpm audit, fix journey, and baseline findings table
  • Baseline findings tables backported to NestJS and Juice Shop case studies for structural consistency across all studies

Fixed

  • BFS path-tracking in the pnpm parser replaced path-fingerprint seenPaths with a visited-key seenKeys set, eliminating exponential queue growth through circular dependency chains in large lockfiles (e.g. Analog's 15 circular deps)

Validation

  • npm test
  • npm run build
Assets 2
Loading