diff --git a/syft/pkg/cataloger/javascript/parse_yarn_lock.go b/syft/pkg/cataloger/javascript/parse_yarn_lock.go index 36e8ae4c0..eb6cb0539 100644 --- a/syft/pkg/cataloger/javascript/parse_yarn_lock.go +++ b/syft/pkg/cataloger/javascript/parse_yarn_lock.go @@ -15,9 +15,18 @@ import ( var _ common.ParserFn = parseYarnLock var ( + // composedNameExp matches the "composed" variant of yarn.lock entry names, + // where the name appears in quotes and is prefixed with @. + // For example: "@babel/code-frame@^7.0.0" composedNameExp = regexp.MustCompile(`^"(@[^@]+)`) - simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`) - versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`) + + // simpleNameExp matches the "simple" variant of yarn.lock entry names, for packages with no namespace prefix. + // For example: aws-sdk@2.706.0 + simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`) + + // versionExp matches the "version" line of a yarn.lock entry and captures the version value. + // For example: version "4.10.1" (...and the value "4.10.1" is captured) + versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`) ) const (