oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-03 07:56:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(javascript): Add dependency parsing (#4304)

Browse Source 
* feat: Add dependency parsing to javascript package locks

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Bump schema version

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Add support for yarn and pnpm, excl. yarn v1

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Add support for dependencies for v1 yarn lock files

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Ensure schema is correctly generated

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* Fix tests

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

* PR feedback

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>

---------

Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com>
This commit is contained in:
Tim Olshansky
2025-11-06 16:03:43 -05:00
committed by GitHub
parent e5711e9b42
commit 4e06a7ab32
18 changed files with 5346 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/npm.go
+20
View File
@@ -31,6 +31,9 @@ type NpmPackageLockEntry struct {
// Integrity is Subresource Integrity hash for verification using standard SRI format (sha512-... or sha1-...). npm changed from SHA-1 to SHA-512 in newer versions. For registry sources this is the integrity from registry, for remote tarballs it's SHA-512 of the file. npm verifies tarball matches this hash before unpacking, throwing EINTEGRITY error if mismatch detected.
Integrity string `mapstructure:"integrity" json:"integrity"`
// Dependencies is a map of dependencies and their version markers, i.e. "lodash": "^1.0.0"
Dependencies map[string]string `mapstructure:"dependencies" json:"dependencies"`
}
// YarnLockEntry represents a single entry section of a yarn.lock file.
@@ -40,4 +43,21 @@ type YarnLockEntry struct {
// Integrity is Subresource Integrity hash for verification (SRI format)
Integrity string `mapstructure:"integrity" json:"integrity"`
// Dependencies is a map of dependencies and their versions
Dependencies map[string]string `mapstructure:"dependencies" json:"dependencies"`
}
type PnpmLockResolution struct {
// Integrity is Subresource Integrity hash for verification (SRI format)
Integrity string `mapstructure:"integrity" json:"integrity"`
}
// PnpmLockEntry represents a single entry in the "packages" section of a pnpm-lock.yaml file.
type PnpmLockEntry struct {
// Resolution is the resolution information for the package
Resolution PnpmLockResolution `mapstructure:"resolution" json:"resolution"`
// Dependencies is a map of dependencies and their versions
Dependencies map[string]string `mapstructure:"dependencies" json:"dependencies"`
}