oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Skip package-lock.json and yarn.lock in node_modules #431 (#485)

Browse Source 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Keith Zantow
2021-08-20 13:50:28 -04:00
committed by GitHub
parent cba5b5723b
commit ff828fbac2
116 changed files with 23778 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/javascript/parse_package_lock.go
+9 -3
View File
@@ -27,9 +27,15 @@ type Dependency struct {
Requires map[string]string
}
// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
packages := make([]pkg.Package, 0)
// parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.
func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {
// in the case we find package-lock.json files in the node_modules directories, skip those
// as the whole purpose of the lock file is for the specific dependencies of the root project
if pathContainsNodeModulesDirectory(path) {
return nil, nil
}
var packages []pkg.Package
dec := json.NewDecoder(reader)
for {