oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-05-20 04:05:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: resolve yarn lock aliases to source package (#4836)

Browse Source 
Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com>
This commit is contained in:
Rayan Salhab 2026-04-29 16:50:09 +03:00 committed by GitHub
parent 3b046b3787
commit 8cb78ce40c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
syft/pkg/cataloger/javascript/parse_yarn_lock.go
View File

@ -25,6 +25,11 @@ import (
)
var (
// packageAliasExp matches aliased yarn dependencies and captures the
// underlying npm package name instead of the local alias.
// For example: "old-async@npm:async@0.9.2" returns "async".
packageAliasExp = regexp.MustCompile(`^"?(?:@\w[\w-_.]*\/)?\w[\w-_.]*@npm:((?:@\w[\w-_.]*\/)?\w[\w-_.]*)@`)
// packageNameExp matches the name of the dependency in yarn.lock
// including scope/namespace prefix if found.
// For example: "aws-sdk@2.706.0" returns "aws-sdk"
@ -305,6 +310,9 @@ func (a genericYarnLockAdapter) parseYarnLock(ctx context.Context, resolver file
}
func findPackageName(line string) string {
if matches := packageAliasExp.FindStringSubmatch(line); len(matches) >= 2 {
return matches[1]
}
if matches := packageNameExp.FindStringSubmatch(line); len(matches) >= 2 {
return matches[1]
}

12
syft/pkg/cataloger/javascript/parse_yarn_lock_test.go
View File

@ -708,6 +708,18 @@ func TestParseYarnFindPackageNames(t *testing.T) {
line: `"color-convert@npm:^1.9.0":`,
expected: "color-convert",
},
{
line: `"old-async@npm:async@0.9.2":`,
expected: "async",
},
{
line: `"old-foo@npm:@scope/foo@1.2.3":`,
expected: "@scope/foo",
},
{
line: `"@scope/old-foo@npm:@scope/foo@1.2.3":`,
expected: "@scope/foo",
},
{
line: `"@npmcorp/code-frame@^7.1.0", "@npmcorp/code-frame@^7.10.4":`,
expected: "@npmcorp/code-frame",