feat: add new login cmd (#1068)

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>

.github/workflows/pr.yaml

@@ -1,17 +0,0 @@
-# Uses https://github.com/actions/add-to-project example to add PR to Anchore OSS project
-name: Add pr to OSS project
-
-on:
-  pull_request:
-    types:
-      - opened
-
-jobs:
-  add-to-project:
-    name: Add pr to project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/add-to-project@main
-        with:
-          project-url: https://github.com/orgs/anchore/projects/22
-          github-token: ${{ secrets.CI_WRITE_GITHUB_TOKEN }}

README.md

@@ -11,14 +11,6 @@
 
 A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like [Grype](https://github.com/anchore/grype).
 
-### Join our Virtual OSS Meetup!
-
-You are invited to join us on June 15th, 11AM-Noon PT for our virtual open source meetup.  
-
-Hosts Amy Bass from Docker Desktop and Christopher Phillips from Anchore OSS will explore how Docker Extensions for Docker Desktop is supporting open source projects and we’ll have the latest update on Syft: in-toto attestations.
-
-[Register here ->](https://get.anchore.com/anchore-oss-meetup-jun-15-2022/)
-
 ### Join our community meetings!
 
 - Calendar: https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t
@@ -38,6 +30,8 @@ Hosts Amy Bass from Docker Desktop and Christopher Phillips from Anchore OSS wil
 ### Supported Ecosystems
 
 - Alpine (apk)
+- C (conan)
+- C++ (conan)
 - Dart (pubs)
 - Debian (dpkg)
 - Dotnet (deps.json)
@@ -230,6 +224,40 @@ Where the `formats` available are:
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `github`: A JSON report conforming to GitHub's dependency snapshot format.
 - `table`: A columnar summary (default).
+- `template`: Lets the user specify the output format. See ["Using templates"](#using-templates) below.
+
+#### Using templates
+
+Syft lets you define custom output formats, using [Go templates](https://pkg.go.dev/text/template). Here's how it works:
+
+- Define your format as a Go template, and save this template as a file.
+
+- Set the output format to "template" (`-o template`). 
+
+- Specify the path to the template file (`-t ./path/to/custom.template`).
+
+- Syft's template processing uses the same data models as the `json` output format — so if you're wondering what data is available as you author a template, you can use the output from `syft <image> -o json` as a reference.
+
+**Example:** You could make Syft output data in CSV format by writing a Go template that renders CSV data and then running `syft <image> -o template -t ~/path/to/csv.tmpl`.
+
+Here's what the `csv.tmpl` file might look like:
+```gotemplate
+"Package","Version Installed","Found by"
+{{- range .Artifacts}}
+"{{.Name}}","{{.Version}}","{{.FoundBy}}"
+{{- end}}
+```
+
+Which would produce output like:
+```text
+"Package","Version Installed","Found by"
+"alpine-baselayout","3.2.0-r20","apkdb-cataloger"
+"alpine-baselayout-data","3.2.0-r20","apkdb-cataloger"
+"alpine-keys","2.4-r1","apkdb-cataloger"
+...
+```
+
+Syft also includes a vast array of utility templating functions from [sprig](http://masterminds.github.io/sprig/) apart from the default Golang [text/template](https://pkg.go.dev/text/template#hdr-Functions) to allow users to customize the output format.
 
 #### Multiple outputs
 
@@ -360,6 +388,29 @@ exclude: []
 # same as --platform; SYFT_PLATFORM env var
 platform: ""
 
+# set the list of package catalogers to use when generating the SBOM
+# default = empty (cataloger set determined automatically by the source type [image or file/directory])
+# catalogers:
+#   - ruby-gemfile
+#   - ruby-gemspec
+#   - python-index
+#   - python-package
+#   - javascript-lock
+#   - javascript-package
+#   - php-composer-installed
+#   - php-composer-lock
+#   - alpmdb
+#   - dpkgdb
+#   - rpmdb
+#   - java
+#   - apkdb
+#   - go-module-binary
+#   - go-mod-file
+#   - dartlang-lock
+#   - rust
+#   - dotnet-deps
+catalogers:
+
 # cataloging packages is exposed through the packages and power-user subcommands
 package:
 

cmd/syft/cli/commands.go

@@ -15,6 +15,7 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/event"
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/gookit/color"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -30,6 +31,7 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
+// nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}
 
@@ -82,13 +84,22 @@ func New() (*cobra.Command, error) {
 		return nil, err
 	}
 
+	// commands to add to root
+	cmds := []*cobra.Command{
+		packagesCmd,
+		attestCmd,
+		convertCmd,
+		poweruserCmd,
+		poweruserCmd,
+		Completion(),
+		Version(v, app),
+		cranecmd.NewCmdAuthLogin("syft"),
+	}
+
 	// Add sub-commands.
-	rootCmd.AddCommand(packagesCmd)
-	rootCmd.AddCommand(attestCmd)
-	rootCmd.AddCommand(convertCmd)
-	rootCmd.AddCommand(poweruserCmd)
-	rootCmd.AddCommand(Completion())
-	rootCmd.AddCommand(Version(v, app))
+	for _, cmd := range cmds {
+		rootCmd.AddCommand(cmd)
+	}
 
 	return rootCmd, err
 }

cmd/syft/cli/convert/convert.go

@@ -13,7 +13,7 @@ import (
 
 func Run(ctx context.Context, app *config.Application, args []string) error {
 	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
-	writer, err := options.MakeWriter(app.Outputs, app.File)
+	writer, err := options.MakeWriter(app.Outputs, app.File, "")
 	if err != nil {
 		return err
 	}

cmd/syft/cli/eventloop/tasks.go

@@ -46,7 +46,7 @@ func generateCatalogPackagesTask(app *config.Application) (Task, error) {
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.Package.ToConfig())
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.ToCatalogerConfig())
 		if err != nil {
 			return nil, err
 		}

cmd/syft/cli/options/packages.go

@@ -15,6 +15,7 @@ import (
 type PackagesOptions struct {
 	Scope                  string
 	Output                 []string
+	OutputTemplatePath     string
 	File                   string
 	Platform               string
 	Host                   string
@@ -24,45 +25,52 @@ type PackagesOptions struct {
 	Exclude                []string
 	OverwriteExistingImage bool
 	ImportTimeout          uint
+	Catalogers             []string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
 
 func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.PersistentFlags().StringVarP(&o.Scope, "scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
+	cmd.Flags().StringVarP(&o.Scope, "scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
-	cmd.PersistentFlags().StringArrayVarP(&o.Output, "output", "o", FormatAliases(table.ID),
+	cmd.Flags().StringArrayVarP(&o.Output, "output", "o", FormatAliases(table.ID),
 		fmt.Sprintf("report output format, options=%v", FormatAliases(syft.FormatIDs()...)))
 
-	cmd.PersistentFlags().StringVarP(&o.File, "file", "", "",
+	cmd.Flags().StringVarP(&o.File, "file", "", "",
 		"file to write the default report output to (default is STDOUT)")
 
-	cmd.PersistentFlags().StringVarP(&o.Platform, "platform", "", "",
+	cmd.Flags().StringVarP(&o.OutputTemplatePath, "template", "t", "",
+		"specify the path to a Go template file")
+
+	cmd.Flags().StringVarP(&o.Platform, "platform", "", "",
 		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")
 
-	cmd.PersistentFlags().StringVarP(&o.Host, "host", "H", "",
+	cmd.Flags().StringVarP(&o.Host, "host", "H", "",
 		"the hostname or URL of the Anchore Enterprise instance to upload to")
 
-	cmd.PersistentFlags().StringVarP(&o.Username, "username", "u", "",
+	cmd.Flags().StringVarP(&o.Username, "username", "u", "",
 		"the username to authenticate against Anchore Enterprise")
 
-	cmd.PersistentFlags().StringVarP(&o.Password, "password", "p", "",
+	cmd.Flags().StringVarP(&o.Password, "password", "p", "",
 		"the password to authenticate against Anchore Enterprise")
 
-	cmd.PersistentFlags().StringVarP(&o.Dockerfile, "dockerfile", "d", "",
+	cmd.Flags().StringVarP(&o.Dockerfile, "dockerfile", "d", "",
 		"include dockerfile for upload to Anchore Enterprise")
 
-	cmd.PersistentFlags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
+	cmd.Flags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
 		"exclude paths from being scanned using a glob expression")
 
-	cmd.PersistentFlags().BoolVarP(&o.OverwriteExistingImage, "overwrite-existing-image", "", false,
+	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
+		"enable one or more package catalogers")
+
+	cmd.Flags().BoolVarP(&o.OverwriteExistingImage, "overwrite-existing-image", "", false,
 		"overwrite an existing image during the upload to Anchore Enterprise")
 
-	cmd.PersistentFlags().UintVarP(&o.ImportTimeout, "import-timeout", "", 30,
+	cmd.Flags().UintVarP(&o.ImportTimeout, "import-timeout", "", 30,
 		"set a timeout duration (in seconds) for the upload to Anchore Enterprise")
 
-	return bindPackageConfigOptions(cmd.PersistentFlags(), v)
+	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
 func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
@@ -80,10 +88,18 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("catalogers", flags.Lookup("catalogers")); err != nil {
+		return err
+	}
+
 	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}
 
+	if err := v.BindPFlag("output-template-path", flags.Lookup("template")); err != nil {
+		return err
+	}
+
 	if err := v.BindPFlag("platform", flags.Lookup("platform")); err != nil {
 		return err
 	}

cmd/syft/cli/options/writer.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
@@ -12,8 +13,8 @@ import (
 
 // makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
 // or an error but neither both and if there is no error, sbom.Writer.Close() should be called
-func MakeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
-	outputOptions, err := parseOutputs(outputs, defaultFile)
+func MakeWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Writer, error) {
+	outputOptions, err := parseOutputs(outputs, defaultFile, templateFilePath)
 	if err != nil {
 		return nil, err
 	}
@@ -27,7 +28,7 @@ func MakeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 }
 
 // parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOutputs(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
+func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out []sbom.WriterOption, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
 		outputs = append(outputs, string(table.ID))
@@ -56,6 +57,11 @@ func parseOutputs(outputs []string, defaultFile string) (out []sbom.WriterOption
 			continue
 		}
 
+		if tmpl, ok := format.(template.OutputFormat); ok {
+			tmpl.SetTemplatePath(templateFilePath)
+			format = tmpl
+		}
+
 		out = append(out, sbom.NewWriterOption(format, file))
 	}
 	return out, errs

cmd/syft/cli/options/writer_test.go

@@ -28,7 +28,7 @@ func TestIsSupportedFormat(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		_, err := MakeWriter(tt.outputs, "")
+		_, err := MakeWriter(tt.outputs, "", "")
 		tt.wantErr(t, err)
 	}
 }

cmd/syft/cli/packages.go

@@ -14,12 +14,13 @@ import (
 
 const (
 	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
-  {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx            show a SPDX 2.2 Tag-Value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json       show a SPDX 2.2 JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -vv                show verbose debug information
+  {{.appName}} {{.command}} alpine:latest -o json                        show all possible cataloging details
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx                        show a SPDX 2.2 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json                   show a SPDX 2.2 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -vv                            show verbose debug information
+  {{.appName}} {{.command}} alpine:latest -o template -t my_format.tmpl  show a SBOM formatted according to given template file
 
   Supports the following image sources:
     {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.

cmd/syft/cli/packages/packages.go

@@ -13,6 +13,7 @@ import (
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
@@ -25,7 +26,12 @@ import (
 )
 
 func Run(ctx context.Context, app *config.Application, args []string) error {
-	writer, err := options.MakeWriter(app.Outputs, app.File)
+	err := validateOutputOptions(app)
+	if err != nil {
+		return err
+	}
+
+	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
 	if err != nil {
 		return err
 	}
@@ -185,3 +191,19 @@ func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Applicati
 
 	return nil
 }
+
+func validateOutputOptions(app *config.Application) error {
+	var usesTemplateOutput bool
+	for _, o := range app.Outputs {
+		if o == template.ID.String() {
+			usesTemplateOutput = true
+			break
+		}
+	}
+
+	if usesTemplateOutput && app.OutputTemplatePath == "" {
+		return fmt.Errorf(`must specify path to template file when using "template" output format`)
+	}
+
+	return nil
+}

cmd/syft/cli/poweruser.go

@@ -13,7 +13,7 @@ import (
 
 const powerUserExample = `  {{.appName}} {{.command}} <image>
   DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
-  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported, template outputs are not supported.
   All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
 `
 

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/anchore/stereoscope v0.0.0-20220518185348-c97a3c6ffc67
+	github.com/anchore/stereoscope v0.0.0-20220628191509-5bd627c0f9ce
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
@@ -54,6 +54,7 @@ require (
 )
 
 require (
+	github.com/Masterminds/sprig/v3 v3.2.2
 	github.com/docker/docker v20.10.12+incompatible
 	github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839
 	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
@@ -79,6 +80,8 @@ require (
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
 	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
@@ -110,7 +113,7 @@ require (
 	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/containerd v1.5.10 // indirect
+	github.com/containerd/containerd v1.5.13 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
 	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
@@ -175,6 +178,7 @@ require (
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
@@ -197,6 +201,8 @@ require (
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
@@ -218,6 +224,7 @@ require (
 	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/shopspring/decimal v1.2.0 // indirect
 	github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect

go.sum

@@ -186,14 +186,17 @@ github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae
 github.com/GoogleCloudPlatform/cloudsql-proxy v1.27.0/go.mod h1:bn9iHmAjogMoIPkqBGyJ9R1m9cXGCjBE/cuhBs3oEsQ=
 github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
 github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.0.3/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.1.0/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
+github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
 github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -215,6 +218,7 @@ github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn
 github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
 github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
+github.com/Microsoft/hcsshim v0.8.24/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
@@ -269,8 +273,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7 h1:kDrYkTSM9uIxaX/P9s0F4nKYNM+hnSgLJdLpqvsaQ/g=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20220518185348-c97a3c6ffc67 h1:nbcYgEEv9CLnuKg/8ExvXDiEpCA9pwZcyyraZyBE+aw=
-github.com/anchore/stereoscope v0.0.0-20220518185348-c97a3c6ffc67/go.mod h1:yoCLUZY0k/pYLNIy0L80p2Ko0PKVNXm8rHtgxp4OiSc=
+github.com/anchore/stereoscope v0.0.0-20220628191509-5bd627c0f9ce h1:KNB0d342QvE6V7iwqyf4NoyxRp6LVYoGjU1htgf0at8=
+github.com/anchore/stereoscope v0.0.0-20220628191509-5bd627c0f9ce/go.mod h1:sai2ZjAtT/y1GRQBDRbynhdhnQcGWBvVcv8CN3hTWmI=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.2/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -505,6 +509,7 @@ github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4S
 github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
 github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
 github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
+github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
 github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
@@ -527,8 +532,8 @@ github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTV
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
 github.com/containerd/containerd v1.5.9/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
-github.com/containerd/containerd v1.5.10 h1:3cQ2uRVCkJVcx5VombsE7105Gl9Wrl7ORAO3+4+ogf4=
-github.com/containerd/containerd v1.5.10/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
+github.com/containerd/containerd v1.5.13 h1:XqvKw9i4P7/mFrC3TSM7yV5cwFZ9avXe6M3YANKnzEE=
+github.com/containerd/containerd v1.5.13/go.mod h1:3AlCrzKROjIuP3JALsY14n8YtntaUDBu7vek+rPN5Vc=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -1300,6 +1305,7 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 h1:i462o439ZjprVSFSZLZxcsoAe592sZB1rci2Z8j4wdk=
@@ -1854,6 +1860,7 @@ github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c/go.mod h1:/PevMnwAx
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shirou/gopsutil/v3 v3.21.10/go.mod h1:t75NhzCZ/dYyPQjyQmrAYP6c8+LCdFANeBMdLPCNnew=
+github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=

internal/config/application.go

@@ -5,8 +5,11 @@ import (
 	"fmt"
 	"path"
 	"reflect"
+	"sort"
 	"strings"
 
+	"github.com/anchore/syft/syft/pkg/cataloger"
+
 	"github.com/sirupsen/logrus"
 
 	"github.com/adrg/xdg"
@@ -38,11 +41,13 @@ type Application struct {
 	// -q, indicates to not show any status output to stderr (ETUI or logging UI)
 	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`
 	Outputs            []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
+	OutputTemplatePath string             `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
 	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
 	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
 	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
+	Catalogers         []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
 	Package            pkg                `yaml:"package" json:"package" mapstructure:"package"`
 	FileMetadata       FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
 	FileClassification fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
@@ -54,6 +59,17 @@ type Application struct {
 	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 }
 
+func (cfg Application) ToCatalogerConfig() cataloger.Config {
+	return cataloger.Config{
+		Search: cataloger.SearchConfig{
+			IncludeIndexedArchives:   cfg.Package.SearchIndexedArchives,
+			IncludeUnindexedArchives: cfg.Package.SearchUnindexedArchives,
+			Scope:                    cfg.Package.Cataloger.ScopeOpt,
+		},
+		Catalogers: cfg.Catalogers,
+	}
+}
+
 func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
 	// priority order: viper.Set, flag, env, config, kv, defaults
 	// flags have already been loaded into viper by command construction
@@ -85,6 +101,16 @@ func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
 }
 
 func (cfg *Application) parseConfigValues() error {
+	// parse options on this struct
+	var catalogers []string
+	for _, c := range cfg.Catalogers {
+		for _, f := range strings.Split(c, ",") {
+			catalogers = append(catalogers, strings.TrimSpace(f))
+		}
+	}
+	sort.Strings(catalogers)
+	cfg.Catalogers = catalogers
+
 	// parse application config options
 	for _, optionFn := range []func() error{
 		cfg.parseUploadOptions,
@@ -172,6 +198,7 @@ func loadDefaultValues(v *viper.Viper) {
 	// set the default values for primitive fields in this struct
 	v.SetDefault("quiet", false)
 	v.SetDefault("check-for-app-update", true)
+	v.SetDefault("catalogers", nil)
 
 	// for each field in the configuration struct, see if the field implements the defaultValueLoader interface and invoke it if it does
 	value := reflect.ValueOf(Application{})

internal/config/pkg.go

@@ -21,13 +21,3 @@ func (cfg pkg) loadDefaultValues(v *viper.Viper) {
 func (cfg *pkg) parseConfigValues() error {
 	return cfg.Cataloger.parseConfigValues()
 }
-
-func (cfg pkg) ToConfig() cataloger.Config {
-	return cataloger.Config{
-		Search: cataloger.SearchConfig{
-			IncludeIndexedArchives:   cfg.SearchIndexedArchives,
-			IncludeUnindexedArchives: cfg.SearchUnindexedArchives,
-			Scope:                    cfg.Cataloger.ScopeOpt,
-		},
-	}
-}

internal/config/registry.go

@@ -30,7 +30,7 @@ func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }
 
-// nolint: unparam
+// nolint:unparam
 func (cfg *registry) parseConfigValues() error {
 	// there may be additional credentials provided by env var that should be appended to the set of credentials
 	authority, username, password, token :=

internal/formats/common/spdxhelpers/source_info.go

@@ -35,6 +35,8 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from rust cargo manifest"
 	case pkg.PhpComposerPkg:
 		answer = "acquired package info from PHP composer manifest"
+	case pkg.ConanPkg:
+		answer = "acquired package info from conan manifest"
 	default:
 		answer = "acquired package info from the following paths"
 	}

internal/formats/common/spdxhelpers/source_info_test.go

@@ -150,6 +150,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from ALPM DB",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.ConanPkg,
+			},
+			expected: []string{
+				"from conan manifest",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {

internal/formats/syftjson/model/package.go

@@ -63,7 +63,7 @@ func (p *Package) UnmarshalJSON(b []byte) error {
 	return unpackMetadata(p, unpacker)
 }
 
-// nolint:funlen
+// nolint:funlen,gocognit,gocyclo
 func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
 	p.MetadataType = unpacker.MetadataType
 	switch p.MetadataType {
@@ -145,6 +145,12 @@ func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
 			return err
 		}
 		p.Metadata = payload
+	case pkg.ConanaMetadataType:
+		var payload pkg.ConanMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
 	case pkg.DotnetDepsMetadataType:
 		var payload pkg.DotnetDepsMetadata
 		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {

internal/formats/template/encoder.go

@@ -0,0 +1,49 @@
+package template
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"reflect"
+	"text/template"
+
+	"github.com/Masterminds/sprig/v3"
+	"github.com/mitchellh/go-homedir"
+)
+
+func makeTemplateExecutor(templateFilePath string) (*template.Template, error) {
+	if templateFilePath == "" {
+		return nil, errors.New("no template file: please provide a template path")
+	}
+
+	expandedPathToTemplateFile, err := homedir.Expand(templateFilePath)
+	if err != nil {
+		return nil, fmt.Errorf("unable to expand path %s", templateFilePath)
+	}
+
+	templateContents, err := os.ReadFile(expandedPathToTemplateFile)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get template content: %w", err)
+	}
+
+	templateName := expandedPathToTemplateFile
+	tmpl, err := template.New(templateName).Funcs(funcMap).Parse(string(templateContents))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse template: %w", err)
+	}
+
+	return tmpl, nil
+}
+
+// These are custom functions available to template authors.
+var funcMap = func() template.FuncMap {
+	f := sprig.HermeticTxtFuncMap()
+	f["getLastIndex"] = func(collection interface{}) int {
+		if v := reflect.ValueOf(collection); v.Kind() == reflect.Slice {
+			return v.Len() - 1
+		}
+
+		return 0
+	}
+	return f
+}()

internal/formats/template/encoder_test.go

@@ -0,0 +1,29 @@
+package template
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/stretchr/testify/assert"
+)
+
+var updateTmpl = flag.Bool("update-tmpl", false, "update the *.golden files for json encoders")
+
+func TestFormatWithOption(t *testing.T) {
+	f := OutputFormat{}
+	f.SetTemplatePath("test-fixtures/csv.template")
+
+	testutils.AssertEncoderAgainstGoldenSnapshot(t,
+		f,
+		testutils.DirectoryInput(t),
+		*updateTmpl,
+	)
+
+}
+
+func TestFormatWithoutOptions(t *testing.T) {
+	f := Format()
+	err := f.Encode(nil, testutils.DirectoryInput(t))
+	assert.ErrorContains(t, err, "no template file: please provide a template path")
+}

internal/formats/template/format.go

@@ -0,0 +1,47 @@
+package template
+
+import (
+	"io"
+
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "template"
+
+func Format() sbom.Format {
+	return OutputFormat{}
+}
+
+// implementation of sbom.Format interface
+// to make use of format options
+type OutputFormat struct {
+	templateFilePath string
+}
+
+func (f OutputFormat) ID() sbom.FormatID {
+	return ID
+}
+
+func (f OutputFormat) Decode(reader io.Reader) (*sbom.SBOM, error) {
+	return nil, sbom.ErrDecodingNotSupported
+}
+
+func (f OutputFormat) Encode(output io.Writer, s sbom.SBOM) error {
+	tmpl, err := makeTemplateExecutor(f.templateFilePath)
+	if err != nil {
+		return err
+	}
+
+	doc := syftjson.ToFormatModel(s)
+	return tmpl.Execute(output, doc)
+}
+
+func (f OutputFormat) Validate(reader io.Reader) error {
+	return sbom.ErrValidationNotSupported
+}
+
+// SetTemplatePath sets path for template file
+func (f *OutputFormat) SetTemplatePath(filePath string) {
+	f.templateFilePath = filePath
+}

internal/formats/template/test-fixtures/csv.template

@@ -0,0 +1,4 @@
+"Package","Version Installed", "Found by"
+{{- range .Artifacts}}
+"{{.Name}}","{{.Version}}","{{.FoundBy}}"
+{{- end}}

internal/formats/template/test-fixtures/snapshot/TestFormatWithOption.golden

@@ -0,0 +1,3 @@
+"Package","Version Installed", "Found by"
+"package-1","1.0.1","the-cataloger-1"
+"package-2","2.0.1","the-cataloger-2"

syft/formats.go

@@ -11,6 +11,7 @@ import (
 	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/formats/text"
 	"github.com/anchore/syft/syft/sbom"
 )
@@ -25,6 +26,7 @@ const (
 	GitHubID              = github.ID
 	SPDXTagValueFormatID  = spdx22tagvalue.ID
 	SPDXJSONFormatID      = spdx22json.ID
+	TemplateFormatID      = template.ID
 )
 
 var formats []sbom.Format
@@ -39,6 +41,7 @@ func init() {
 		spdx22json.Format(),
 		table.Format(),
 		text.Format(),
+		template.Format(),
 	}
 }
 
@@ -84,6 +87,8 @@ func FormatByName(name string) sbom.Format {
 		return FormatByID(table.ID)
 	case "text":
 		return FormatByID(text.ID)
+	case "template":
+		FormatByID(template.ID)
 	}
 
 	return nil

syft/formats_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/formats/text"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/stretchr/testify/require"
@@ -181,6 +182,11 @@ func TestFormatByName(t *testing.T) {
 			name: "github-json",
 			want: github.ID,
 		},
+
+		{
+			name: "template",
+			want: template.ID,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

syft/lib.go

@@ -64,6 +64,10 @@ func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []
 		return nil, nil, nil, fmt.Errorf("unable to determine cataloger set from scheme=%+v", src.Metadata.Scheme)
 	}
 
+	if cataloger.RequestedAllCatalogers(cfg) {
+		catalogers = cataloger.AllCatalogers(cfg)
+	}
+
 	catalog, relationships, err := cataloger.Catalog(resolver, release, catalogers...)
 	if err != nil {
 		return nil, nil, nil, err

syft/pkg/cataloger/cataloger.go

@@ -6,10 +6,14 @@ catalogers defined in child packages as well as the interface definition to impl
 package cataloger
 
 import (
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/alpm"
 	"github.com/anchore/syft/syft/pkg/cataloger/apkdb"
+	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/deb"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
@@ -24,6 +28,8 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
+const AllCatalogersPattern = "all"
+
 // Cataloger describes behavior for an object to participate in parsing container image or file system
 // contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
 // for a specific Package Type or ecosystem.
@@ -36,7 +42,7 @@ type Cataloger interface {
 
 // ImageCatalogers returns a slice of locally implemented catalogers that are fit for detecting installations of packages.
 func ImageCatalogers(cfg Config) []Cataloger {
-	return []Cataloger{
+	return filterCatalogers([]Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemSpecCataloger(),
 		python.NewPythonPackageCataloger(),
@@ -48,12 +54,12 @@ func ImageCatalogers(cfg Config) []Cataloger {
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModuleBinaryCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
-	}
+	}, cfg.Catalogers)
 }
 
 // DirectoryCatalogers returns a slice of locally implemented catalogers that are fit for detecting packages from index files (and select installations)
 func DirectoryCatalogers(cfg Config) []Cataloger {
-	return []Cataloger{
+	return filterCatalogers([]Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemFileLockCataloger(),
 		python.NewPythonIndexCataloger(),
@@ -63,18 +69,20 @@ func DirectoryCatalogers(cfg Config) []Cataloger {
 		deb.NewDpkgdbCataloger(),
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(cfg.Java()),
+		java.NewJavaPomCataloger(),
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModuleBinaryCataloger(),
 		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
 		dart.NewPubspecLockCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
-	}
+		cpp.NewConanfileCataloger(),
+	}, cfg.Catalogers)
 }
 
 // AllCatalogers returns all implemented catalogers
 func AllCatalogers(cfg Config) []Cataloger {
-	return []Cataloger{
+	return filterCatalogers([]Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemFileLockCataloger(),
 		ruby.NewGemSpecCataloger(),
@@ -85,11 +93,59 @@ func AllCatalogers(cfg Config) []Cataloger {
 		deb.NewDpkgdbCataloger(),
 		rpmdb.NewRpmdbCataloger(),
 		java.NewJavaCataloger(cfg.Java()),
+		java.NewJavaPomCataloger(),
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModuleBinaryCataloger(),
 		golang.NewGoModFileCataloger(),
 		rust.NewCargoLockCataloger(),
 		dart.NewPubspecLockCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
+		php.NewPHPComposerInstalledCataloger(),
+		php.NewPHPComposerLockCataloger(),
+		cpp.NewConanfileCataloger(),
+	}, cfg.Catalogers)
+}
+
+func RequestedAllCatalogers(cfg Config) bool {
+	for _, enableCatalogerPattern := range cfg.Catalogers {
+		if enableCatalogerPattern == AllCatalogersPattern {
+			return true
+		}
 	}
+	return false
+}
+
+func filterCatalogers(catalogers []Cataloger, enabledCatalogerPatterns []string) []Cataloger {
+	// if cataloger is not set, all applicable catalogers are enabled by default
+	if len(enabledCatalogerPatterns) == 0 {
+		return catalogers
+	}
+	for _, enableCatalogerPattern := range enabledCatalogerPatterns {
+		if enableCatalogerPattern == AllCatalogersPattern {
+			return catalogers
+		}
+	}
+	var keepCatalogers []Cataloger
+	for _, cataloger := range catalogers {
+		if contains(enabledCatalogerPatterns, cataloger.Name()) {
+			keepCatalogers = append(keepCatalogers, cataloger)
+			continue
+		}
+		log.Infof("skipping cataloger %q", cataloger.Name())
+	}
+	return keepCatalogers
+}
+
+func contains(enabledPartial []string, catalogerName string) bool {
+	catalogerName = strings.TrimSuffix(catalogerName, "-cataloger")
+	for _, partial := range enabledPartial {
+		partial = strings.TrimSuffix(partial, "-cataloger")
+		if partial == "" {
+			continue
+		}
+		if strings.Contains(catalogerName, partial) {
+			return true
+		}
+	}
+	return false
 }

syft/pkg/cataloger/cataloger_test.go

@@ -0,0 +1,201 @@
+package cataloger
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+var _ Cataloger = (*dummy)(nil)
+
+type dummy struct {
+	name string
+}
+
+func (d dummy) Name() string {
+	return d.name
+}
+
+func (d dummy) Catalog(_ source.FileResolver) ([]pkg.Package, []artifact.Relationship, error) {
+	panic("not implemented")
+}
+
+func Test_filterCatalogers(t *testing.T) {
+	tests := []struct {
+		name       string
+		patterns   []string
+		catalogers []string
+		want       []string
+	}{
+		{
+			name:     "no filtering",
+			patterns: nil,
+			catalogers: []string{
+				"ruby-gemspec-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+			want: []string{
+				"ruby-gemspec-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+		},
+		{
+			name: "exact name match",
+			patterns: []string{
+				"rpmdb-cataloger",
+				"javascript-package-cataloger",
+			},
+			catalogers: []string{
+				"ruby-gemspec-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+			want: []string{
+				"javascript-package-cataloger",
+				"rpmdb-cataloger",
+			},
+		},
+		{
+			name: "partial name match",
+			patterns: []string{
+				"ruby",
+				"installed",
+			},
+			catalogers: []string{
+				"ruby-gemspec-cataloger",
+				"ruby-gemfile-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+			want: []string{
+				"php-composer-installed-cataloger",
+				"ruby-gemspec-cataloger",
+				"ruby-gemfile-cataloger",
+			},
+		},
+		{
+			name: "ignore 'cataloger' keyword",
+			patterns: []string{
+				"cataloger",
+			},
+			catalogers: []string{
+				"ruby-gemspec-cataloger",
+				"ruby-gemfile-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+			want: []string{},
+		},
+		{
+			name: "only some patterns match",
+			patterns: []string{
+				"cataloger",
+				"go-module",
+			},
+			catalogers: []string{
+				"ruby-gemspec-cataloger",
+				"ruby-gemfile-cataloger",
+				"python-package-cataloger",
+				"php-composer-installed-cataloger",
+				"javascript-package-cataloger",
+				"dpkgdb-cataloger",
+				"rpmdb-cataloger",
+				"java-cataloger",
+				"apkdb-cataloger",
+				"go-module-binary-cataloger",
+			},
+			want: []string{
+				"go-module-binary-cataloger",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var catalogers []Cataloger
+			for _, n := range tt.catalogers {
+				catalogers = append(catalogers, dummy{name: n})
+			}
+			got := filterCatalogers(catalogers, tt.patterns)
+			var gotNames []string
+			for _, g := range got {
+				gotNames = append(gotNames, g.Name())
+			}
+			assert.ElementsMatch(t, tt.want, gotNames)
+		})
+	}
+}
+
+func Test_contains(t *testing.T) {
+	type args struct {
+	}
+	tests := []struct {
+		name              string
+		enabledCatalogers []string
+		catalogerName     string
+		want              bool
+	}{
+		{
+			name: "keep exact match",
+			enabledCatalogers: []string{
+				"php-composer-installed-cataloger",
+			},
+			catalogerName: "php-composer-installed-cataloger",
+			want:          true,
+		},
+		{
+			name: "match substring",
+			enabledCatalogers: []string{
+				"python",
+			},
+			catalogerName: "python-package-cataloger",
+			want:          true,
+		},
+		{
+			name: "dont match on 'cataloger'",
+			enabledCatalogers: []string{
+				"cataloger",
+			},
+			catalogerName: "python-package-cataloger",
+			want:          false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, contains(tt.enabledCatalogers, tt.catalogerName))
+		})
+	}
+}

syft/pkg/cataloger/config.go

@@ -5,7 +5,8 @@ import (
 )
 
 type Config struct {
-	Search SearchConfig
+	Search     SearchConfig
+	Catalogers []string
 }
 
 func DefaultConfig() Config {

syft/pkg/cataloger/cpp/cataloger.go

@@ -0,0 +1,14 @@
+package cpp
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewConanfileCataloger returns a new C++ Conanfile cataloger object.
+func NewConanfileCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/conanfile.txt": parseConanfile,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "conan-cataloger")
+}

syft/pkg/cataloger/cpp/parse_conanfile.go

@@ -0,0 +1,60 @@
+package cpp
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// integrity check
+var _ common.ParserFn = parseConanfile
+
+type Conanfile struct {
+	Requires []string `toml:"requires"`
+}
+
+// parseConanfile is a parser function for conanfile.txt contents, returning all packages discovered.
+func parseConanfile(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	r := bufio.NewReader(reader)
+	inRequirements := false
+	pkgs := []*pkg.Package{}
+	for {
+		line, err := r.ReadString('\n')
+		switch {
+		case errors.Is(io.EOF, err):
+			return pkgs, nil, nil
+		case err != nil:
+			return nil, nil, fmt.Errorf("failed to parse conanfile.txt file: %w", err)
+		}
+
+		switch {
+		case strings.Contains(line, "[requires]"):
+			inRequirements = true
+		case strings.ContainsAny(line, "[]#"):
+			inRequirements = false
+		}
+
+		splits := strings.Split(strings.TrimSpace(line), "/")
+		if len(splits) < 2 || !inRequirements {
+			continue
+		}
+		pkgName, pkgVersion := splits[0], splits[1]
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         pkgName,
+			Version:      pkgVersion,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    pkgName,
+				Version: pkgVersion,
+			},
+		})
+	}
+}

syft/pkg/cataloger/cpp/parse_conanfile_test.go

@@ -0,0 +1,96 @@
+package cpp
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseConanfile(t *testing.T) {
+	expected := []*pkg.Package{
+		{
+			Name:         "catch2",
+			Version:      "2.13.8",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "catch2",
+				Version: "2.13.8",
+			},
+		},
+		{
+			Name:         "docopt.cpp",
+			Version:      "0.6.3",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "docopt.cpp",
+				Version: "0.6.3",
+			},
+		},
+		{
+			Name:         "fmt",
+			Version:      "8.1.1",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "fmt",
+				Version: "8.1.1",
+			},
+		},
+		{
+			Name:         "spdlog",
+			Version:      "1.9.2",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "spdlog",
+				Version: "1.9.2",
+			},
+		},
+		{
+			Name:         "sdl",
+			Version:      "2.0.20",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "sdl",
+				Version: "2.0.20",
+			},
+		},
+		{
+			Name:         "fltk",
+			Version:      "1.3.8",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "fltk",
+				Version: "1.3.8",
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/conanfile.txt")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parseConanfile(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}

syft/pkg/cataloger/cpp/test-fixtures/conanfile.txt

@@ -0,0 +1,12 @@
+# Docs at https://docs.conan.io/en/latest/reference/conanfile_txt.html
+
+[requires]
+catch2/2.13.8
+docopt.cpp/0.6.3
+fmt/8.1.1
+spdlog/1.9.2
+sdl/2.0.20
+fltk/1.3.8
+
+[generators]
+cmake_find_package_multi

syft/pkg/cataloger/golang/parse_go_bin.go

@@ -10,11 +10,13 @@ import (
 	"io"
 	"runtime/debug"
 	"strings"
+	"time"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang/internal/xcoff"
 	"github.com/anchore/syft/syft/source"
+	"golang.org/x/mod/module"
 )
 
 const GOARCH = "GOARCH"
@@ -24,14 +26,30 @@ var (
 	// appear to be in a known format, or it breaks the rules of that format,
 	// or when there are I/O errors reading the file.
 	errUnrecognizedFormat = errors.New("unrecognized file format")
+	// devel is used to recognize the current default version when a golang main distribution is built
+	// https://github.com/golang/go/issues/29228 this issue has more details on the progress of being able to
+	// inject the correct version into the main module of the build process
 )
 
+const devel = "(devel)"
+
 func makeGoMainPackage(mod *debug.BuildInfo, arch string, location source.Location) pkg.Package {
 	gbs := getBuildSettings(mod.Settings)
 	main := newGoBinaryPackage(&mod.Main, mod.Main.Path, mod.GoVersion, arch, location, gbs)
-
-	if v, ok := gbs["vcs.revision"]; ok {
-		main.Version = v
+	if main.Version == devel {
+		if version, ok := gbs["vcs.revision"]; ok {
+			if timestamp, ok := gbs["vcs.time"]; ok {
+				//NOTE: err is ignored, because if parsing fails
+				// we still use the empty Time{} struct to generate an empty date, like 00010101000000
+				// for consistency with the pseudo-version format: https://go.dev/ref/mod#pseudo-versions
+				ts, _ := time.Parse(time.RFC3339, timestamp)
+				if len(version) >= 12 {
+					version = version[:12]
+				}
+				version = module.PseudoVersion("", "", ts, version)
+			}
+			main.Version = version
+		}
 	}
 
 	return main

syft/pkg/cataloger/java/archive_parser.go

@@ -335,7 +335,7 @@ func pomProjectByParentPath(archivePath, virtualPath string, extractPaths []stri
 
 	projectByParentPath := make(map[string]pkg.PomProject)
 	for filePath, fileContents := range contentsOfMavenProjectFiles {
-		pomProject, err := parsePomXML(filePath, strings.NewReader(fileContents))
+		pomProject, err := parsePomXMLProject(filePath, strings.NewReader(fileContents))
 		if err != nil {
 			log.Warnf("failed to parse pom.xml virtualPath=%q path=%q: %+v", virtualPath, filePath, err)
 			continue

syft/pkg/cataloger/java/parse_pom_xml.go

@@ -6,34 +6,84 @@ import (
 	"io"
 	"strings"
 
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/vifraa/gopom"
 	"golang.org/x/net/html/charset"
 )
 
 const pomXMLGlob = "*pom.xml"
+const pomXMLDirGlob = "**/pom.xml"
 
-func parsePomXML(path string, reader io.Reader) (*pkg.PomProject, error) {
-	var project gopom.Project
-
-	decoder := xml.NewDecoder(reader)
-	// prevent against warnings for "xml: encoding "iso-8859-1" declared but Decoder.CharsetReader is nil"
-	decoder.CharsetReader = charset.NewReaderLabel
-
-	if err := decoder.Decode(&project); err != nil {
-		return nil, fmt.Errorf("unable to unmarshal pom.xml: %w", err)
+func parserPomXML(path string, content io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	pom, err := decodePomXML(content)
+	if err != nil {
+		return nil, nil, err
 	}
 
+	var pkgs []*pkg.Package
+	for _, dep := range pom.Dependencies {
+		p := newPackageFromPom(dep)
+		if p.Name == "" {
+			continue
+		}
+
+		pkgs = append(pkgs, p)
+	}
+
+	return pkgs, nil, nil
+}
+
+func parsePomXMLProject(path string, reader io.Reader) (*pkg.PomProject, error) {
+	project, err := decodePomXML(reader)
+	if err != nil {
+		return nil, err
+	}
+	return newPomProject(path, project), nil
+}
+
+func newPomProject(path string, p gopom.Project) *pkg.PomProject {
 	return &pkg.PomProject{
 		Path:        path,
-		Parent:      pomParent(project.Parent),
-		GroupID:     project.GroupID,
-		ArtifactID:  project.ArtifactID,
-		Version:     project.Version,
-		Name:        project.Name,
-		Description: cleanDescription(project.Description),
-		URL:         project.URL,
-	}, nil
+		Parent:      pomParent(p.Parent),
+		GroupID:     p.GroupID,
+		ArtifactID:  p.ArtifactID,
+		Version:     p.Version,
+		Name:        p.Name,
+		Description: cleanDescription(p.Description),
+		URL:         p.URL,
+	}
+}
+
+func newPackageFromPom(dep gopom.Dependency) *pkg.Package {
+	p := &pkg.Package{
+		Name:         dep.ArtifactID,
+		Version:      dep.Version,
+		Language:     pkg.Java,
+		Type:         pkg.JavaPkg, // TODO: should we differentiate between packages from jar/war/zip versus packages from a pom.xml that were not installed yet?
+		MetadataType: pkg.JavaMetadataType,
+		FoundBy:      javaPomCataloger,
+		Metadata: pkg.JavaMetadata{
+			PomProperties: &pkg.PomProperties{
+				GroupID: dep.GroupID,
+			},
+		},
+	}
+
+	p.Metadata = pkg.JavaMetadata{PURL: packageURL(*p)}
+
+	return p
+}
+
+func decodePomXML(content io.Reader) (project gopom.Project, err error) {
+	decoder := xml.NewDecoder(content)
+	// prevent against warnings for "xml: encoding "iso-8859-1" declared but Decoder.CharsetReader is nil"
+	decoder.CharsetReader = charset.NewReaderLabel
+	if err := decoder.Decode(&project); err != nil {
+		return project, fmt.Errorf("unable to unmarshal pom.xml: %w", err)
+	}
+
+	return project, nil
 }
 
 func pomParent(parent gopom.Parent) (result *pkg.PomParent) {

syft/pkg/cataloger/java/parse_pom_xml_test.go

@@ -10,7 +10,54 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_parsePomXML(t *testing.T) {
+func Test_parserPomXML(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected []*pkg.Package
+	}{
+		{
+			input: "test-fixtures/pom/pom.xml",
+			expected: []*pkg.Package{
+				{
+					Name:         "joda-time",
+					Version:      "2.9.2",
+					FoundBy:      javaPomCataloger,
+					Language:     pkg.Java,
+					Type:         pkg.JavaPkg,
+					MetadataType: pkg.JavaMetadataType,
+					Metadata: pkg.JavaMetadata{
+						PURL: "pkg:maven/com.joda/joda-time@2.9.2",
+					},
+				},
+				{
+					Name:         "junit",
+					Version:      "4.12",
+					FoundBy:      "java-pom-cataloger",
+					Language:     pkg.Java,
+					Type:         pkg.JavaPkg,
+					MetadataType: pkg.JavaMetadataType,
+					Metadata: pkg.JavaMetadata{
+						PURL: "pkg:maven/junit/junit@4.12",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			fixture, err := os.Open(test.input)
+			assert.NoError(t, err)
+
+			actual, relationships, err := parserPomXML(fixture.Name(), fixture)
+			assert.NoError(t, err)
+			assert.Nil(t, relationships)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func Test_parsePomXMLProject(t *testing.T) {
 	tests := []struct {
 		expected pkg.PomProject
 	}{
@@ -37,7 +84,7 @@ func Test_parsePomXML(t *testing.T) {
 			fixture, err := os.Open(test.expected.Path)
 			assert.NoError(t, err)
 
-			actual, err := parsePomXML(fixture.Name(), fixture)
+			actual, err := parsePomXMLProject(fixture.Name(), fixture)
 			assert.NoError(t, err)
 
 			assert.Equal(t, &test.expected, actual)

syft/pkg/cataloger/java/pom_cataloger.go

@@ -0,0 +1,17 @@
+package java
+
+import "github.com/anchore/syft/syft/pkg/cataloger/common"
+
+const javaPomCataloger = "java-pom-cataloger"
+
+// NewJavaPomCataloger returns a cataloger capable of parsing
+// dependencies from a pom.xml file.
+// Pom files list dependencies that maybe not be locally installed yet.
+func NewJavaPomCataloger() *common.GenericCataloger {
+	globParsers := make(map[string]common.ParserFn)
+
+	// java project files
+	globParsers[pomXMLDirGlob] = parserPomXML
+
+	return common.NewGenericCataloger(nil, globParsers, javaPomCataloger)
+}

syft/pkg/cataloger/java/test-fixtures/pom/pom.xml

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+
+	<groupId>org.anchore</groupId>
+	<artifactId>example-java-app-maven</artifactId>
+	<packaging>jar</packaging>
+	<version>0.1.0</version>
+
+	<properties>
+		<maven.compiler.source>1.8</maven.compiler.source>
+		<maven.compiler.target>1.8</maven.compiler.target>
+	</properties>
+
+	<dependencies>
+		<!-- tag::joda[] -->
+		<dependency>
+			<groupId>com.joda</groupId>
+			<artifactId>joda-time</artifactId>
+			<version>2.9.2</version>
+		</dependency>
+		<!-- end::joda[] -->
+		<!-- tag::junit[] -->
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.12</version>
+			<scope>test</scope>
+		</dependency>
+		<!-- end::junit[] -->
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-shade-plugin</artifactId>
+				<version>2.1</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>shade</goal>
+						</goals>
+						<configuration>
+							<transformers>
+								<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+									<mainClass>hello.HelloWorld</mainClass>
+								</transformer>
+							</transformers>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+
+</project>

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -25,6 +25,16 @@ var (
 	// versionExp matches the "version" line of a yarn.lock entry and captures the version value.
 	// For example: version "4.10.1" (...and the value "4.10.1" is captured)
 	versionExp = regexp.MustCompile(`^\W+version(?:\W+"|:\W+)([\w-_.]+)"?`)
+
+	// packageURLExp matches the name and version of the dependency in yarn.lock
+	// from the resolved URL, including scope/namespace prefix if any.
+	// For example:
+	//		`resolved "https://registry.yarnpkg.com/async/-/async-3.2.3.tgz#ac53dafd3f4720ee9e8a160628f18ea91df196c9"`
+	//			would return "async" and "3.2.3"
+	//
+	//		`resolved "https://registry.yarnpkg.com/@4lolo/resize-observer-polyfill/-/resize-observer-polyfill-1.5.2.tgz#58868fc7224506236b5550d0c68357f0a874b84b"`
+	//			would return "@4lolo/resize-observer-polyfill" and "1.5.2"
+	packageURLExp = regexp.MustCompile(`^\s+resolved\s+"https://registry\.(?:yarnpkg\.com|npmjs\.org)/(.+?)/-/(?:.+?)-(\d+\..+?)\.tgz`)
 )
 
 const (
@@ -43,39 +53,37 @@ func parseYarnLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 	scanner := bufio.NewScanner(reader)
 	parsedPackages := internal.NewStringSet()
 	currentPackage := noPackage
+	currentVersion := noVersion
 
 	for scanner.Scan() {
 		line := scanner.Text()
 
-		if currentPackage == noPackage {
-			// Scan until we find the next package
-
-			packageName := findPackageName(line)
-			if packageName == noPackage {
-				continue
-			}
-
-			if parsedPackages.Contains(packageName) {
-				// We don't parse repeated package declarations.
-				continue
+		if packageName := findPackageName(line); packageName != noPackage {
+			// When we find a new package, check if we have unsaved identifiers
+			if currentPackage != noPackage && currentVersion != noVersion && !parsedPackages.Contains(currentPackage+"@"+currentVersion) {
+				packages = append(packages, newYarnLockPackage(currentPackage, currentVersion))
+				parsedPackages.Add(currentPackage + "@" + currentVersion)
 			}
 
 			currentPackage = packageName
-			parsedPackages.Add(currentPackage)
+		} else if version := findPackageVersion(line); version != noVersion {
+			currentVersion = version
+		} else if packageName, version := findPackageAndVersion(line); packageName != noPackage && version != noVersion && !parsedPackages.Contains(packageName+"@"+version) {
+			packages = append(packages, newYarnLockPackage(packageName, version))
+			parsedPackages.Add(packageName + "@" + version)
 
-			continue
-		}
-
-		// We've found the package entry, now we just need the version
-
-		if version := findPackageVersion(line); version != noVersion {
-			packages = append(packages, newYarnLockPackage(currentPackage, version))
+			// Cleanup to indicate no unsaved identifiers
 			currentPackage = noPackage
-
-			continue
+			currentVersion = noVersion
 		}
 	}
 
+	// check if we have valid unsaved data after end-of-file has reached
+	if currentPackage != noPackage && currentVersion != noVersion && !parsedPackages.Contains(currentPackage+"@"+currentVersion) {
+		packages = append(packages, newYarnLockPackage(currentPackage, currentVersion))
+		parsedPackages.Add(currentPackage + "@" + currentVersion)
+	}
+
 	if err := scanner.Err(); err != nil {
 		return nil, nil, fmt.Errorf("failed to parse yarn.lock file: %w", err)
 	}
@@ -99,6 +107,14 @@ func findPackageVersion(line string) string {
 	return noVersion
 }
 
+func findPackageAndVersion(line string) (string, string) {
+	if matches := packageURLExp.FindStringSubmatch(line); len(matches) >= 2 {
+		return matches[1], matches[2]
+	}
+
+	return noPackage, noVersion
+}
+
 func newYarnLockPackage(name, version string) *pkg.Package {
 	return &pkg.Package{
 		Name:     name,

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestParseYarnLock(t *testing.T) {
+func TestParseYarnBerry(t *testing.T) {
 	expected := map[string]pkg.Package{
 		"@babel/code-frame": {
 			Name:     "@babel/code-frame",
@@ -66,10 +66,87 @@ func TestParseYarnLock(t *testing.T) {
 			Type:     pkg.NpmPkg,
 		},
 	}
+	testFixtures := []string{
+		"test-fixtures/yarn-berry/yarn.lock",
+	}
+
+	for _, file := range testFixtures {
+		file := file
+		t.Run(file, func(t *testing.T) {
+			t.Parallel()
+
+			fixture, err := os.Open(file)
+			require.NoError(t, err)
+
+			// TODO: no relationships are under test yet
+			actual, _, err := parseYarnLock(fixture.Name(), fixture)
+			require.NoError(t, err)
+
+			assertPkgsEqual(t, actual, expected)
+		})
+	}
+}
+
+func TestParseYarnLock(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"@babel/code-frame": {
+			Name:     "@babel/code-frame",
+			Version:  "7.10.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"@types/minimatch": {
+			Name:     "@types/minimatch",
+			Version:  "3.0.3",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"@types/qs": {
+			Name:     "@types/qs",
+			Version:  "6.9.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"ajv": {
+			Name:     "ajv",
+			Version:  "6.12.3",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"atob": {
+			Name:     "atob",
+			Version:  "2.1.2",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"aws-sdk": {
+			Name:     "aws-sdk",
+			Version:  "2.706.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"jhipster-core": {
+			Name:     "jhipster-core",
+			Version:  "7.3.4",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"asn1.js": {
+			Name:     "asn1.js",
+			Version:  "4.10.1",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"something-i-made-up": {
+			Name:     "something-i-made-up",
+			Version:  "7.7.7",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+	}
 
 	testFixtures := []string{
 		"test-fixtures/yarn/yarn.lock",
-		"test-fixtures/yarn-berry/yarn.lock",
 	}
 
 	for _, file := range testFixtures {

syft/pkg/cataloger/rpmdb/cataloger.go

@@ -49,5 +49,27 @@ func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []arti
 
 		pkgs = append(pkgs, discoveredPkgs...)
 	}
+
+	// Additionally look for RPM manifest files to detect packages in CBL-Mariner distroless images
+	manifestFileMatches, err := resolver.FilesByGlob(pkg.RpmManifestGlob)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to find rpm manifests by glob: %w", err)
+	}
+
+	for _, location := range manifestFileMatches {
+		reader, err := resolver.FileContentsByLocation(location)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		discoveredPkgs, err := parseRpmManifest(location, reader)
+		internal.CloseAndLogError(reader, location.VirtualPath)
+		if err != nil {
+			return nil, nil, fmt.Errorf("unable to catalog rpm manifest=%+v: %w", location.RealPath, err)
+		}
+
+		pkgs = append(pkgs, discoveredPkgs...)
+	}
+
 	return pkgs, nil, nil
 }

syft/pkg/cataloger/rpmdb/parse_rpmdb.go

@@ -14,7 +14,7 @@ import (
 	rpmdb "github.com/knqyf263/go-rpmdb/pkg"
 )
 
-// parseApkDb parses an "Packages" RPM DB and returns the Packages listed within it.
+// parseRpmDb parses an "Packages" RPM DB and returns the Packages listed within it.
 func parseRpmDB(resolver source.FilePathResolver, dbLocation source.Location, reader io.Reader) ([]pkg.Package, error) {
 	f, err := ioutil.TempFile("", internal.ApplicationName+"-rpmdb")
 	if err != nil {

syft/pkg/cataloger/rpmdb/parse_rpmmanifest.go

@@ -0,0 +1,104 @@
+package rpmdb
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Parses an entry in an RPM manifest file as used in Mariner distroless containers
+// Each line is the output of :
+// rpm --query --all --query-format "%{NAME}\t%{VERSION}-%{RELEASE}\t%{INSTALLTIME}\t%{BUILDTIME}\t%{VENDOR}\t%{EPOCH}\t%{SIZE}\t%{ARCH}\t%{EPOCHNUM}\t%{SOURCERPM}\n"
+// https://github.com/microsoft/CBL-Mariner/blob/3df18fac373aba13a54bd02466e64969574f13af/toolkit/docs/how_it_works/5_misc.md?plain=1#L150
+func parseRpmManifestEntry(entry string, location source.Location) (*pkg.Package, error) {
+	parts := strings.Split(entry, "\t")
+	if len(parts) < 10 {
+		return nil, fmt.Errorf("unexpected number of fields in line: %s", entry)
+	}
+
+	versionParts := strings.Split(parts[1], "-")
+	if len(versionParts) != 2 {
+		return nil, fmt.Errorf("unexpected version field: %s", parts[1])
+	}
+	version := versionParts[0]
+	release := versionParts[1]
+
+	converted, err := strconv.Atoi(parts[8])
+	var epoch *int
+	if err != nil || parts[5] == "(none)" {
+		epoch = nil
+	} else {
+		epoch = &converted
+	}
+
+	converted, err = strconv.Atoi(parts[6])
+	var size int
+	if err == nil {
+		size = converted
+	}
+
+	metadata := pkg.RpmdbMetadata{
+		Name:      parts[0],
+		Version:   version,
+		Epoch:     epoch,
+		Arch:      parts[7],
+		Release:   release,
+		SourceRpm: parts[9],
+		Vendor:    parts[4],
+		Size:      size,
+	}
+
+	p := pkg.Package{
+		Name:         parts[0],
+		Version:      toELVersion(metadata),
+		Locations:    source.NewLocationSet(location),
+		FoundBy:      catalogerName,
+		Type:         pkg.RpmPkg,
+		MetadataType: pkg.RpmdbMetadataType,
+		Metadata:     metadata,
+	}
+
+	p.SetID()
+	return &p, nil
+}
+
+// Parses an RPM manifest file, as used in Mariner distroless containers, and returns the Packages listed
+func parseRpmManifest(dbLocation source.Location, reader io.Reader) ([]pkg.Package, error) {
+	r := bufio.NewReader(reader)
+	allPkgs := make([]pkg.Package, 0)
+
+	for {
+		line, err := r.ReadString('\n')
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, err
+		}
+
+		if line == "" {
+			continue
+		}
+
+		p, err := parseRpmManifestEntry(strings.TrimSuffix(line, "\n"), dbLocation)
+		if err != nil {
+			log.Warnf("unable to parse RPM manifest entry: %w", err)
+			continue
+		}
+
+		if !pkg.IsValid(p) {
+			continue
+		}
+
+		p.SetID()
+		allPkgs = append(allPkgs, *p)
+	}
+
+	return allPkgs, nil
+}

syft/pkg/cataloger/rpmdb/parse_rpmmanifest_test.go

@@ -0,0 +1,117 @@
+package rpmdb
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/go-test/deep"
+)
+
+func TestParseRpmManifest(t *testing.T) {
+	location := source.NewLocation("test-path")
+
+	fixture_path := "test-fixtures/container-manifest-2"
+	expected := map[string]pkg.Package{
+		"mariner-release": {
+			Name:         "mariner-release",
+			Version:      "2.0-12.cm2",
+			Locations:    source.NewLocationSet(location),
+			FoundBy:      catalogerName,
+			Type:         pkg.RpmPkg,
+			MetadataType: pkg.RpmdbMetadataType,
+			Metadata: pkg.RpmdbMetadata{
+				Name:      "mariner-release",
+				Epoch:     nil,
+				Arch:      "noarch",
+				Release:   "12.cm2",
+				Version:   "2.0",
+				SourceRpm: "mariner-release-2.0-12.cm2.src.rpm",
+				Size:      580,
+				Vendor:    "Microsoft Corporation",
+			},
+		},
+		"filesystem": {
+			Name:         "filesystem",
+			Version:      "1.1-9.cm2",
+			Locations:    source.NewLocationSet(location),
+			FoundBy:      catalogerName,
+			Type:         pkg.RpmPkg,
+			MetadataType: pkg.RpmdbMetadataType,
+			Metadata: pkg.RpmdbMetadata{
+				Name:      "filesystem",
+				Epoch:     nil,
+				Arch:      "x86_64",
+				Release:   "9.cm2",
+				Version:   "1.1",
+				SourceRpm: "filesystem-1.1-9.cm2.src.rpm",
+				Size:      7596,
+				Vendor:    "Microsoft Corporation",
+			},
+		},
+		"glibc": {
+			Name:         "glibc",
+			Version:      "2.35-2.cm2",
+			Locations:    source.NewLocationSet(location),
+			FoundBy:      catalogerName,
+			Type:         pkg.RpmPkg,
+			MetadataType: pkg.RpmdbMetadataType,
+			Metadata: pkg.RpmdbMetadata{
+				Name:      "glibc",
+				Epoch:     nil,
+				Arch:      "x86_64",
+				Release:   "2.cm2",
+				Version:   "2.35",
+				SourceRpm: "glibc-2.35-2.cm2.src.rpm",
+				Size:      10855265,
+				Vendor:    "Microsoft Corporation",
+			},
+		},
+		"openssl-libs": {
+			Name:         "openssl-libs",
+			Version:      "1.1.1k-15.cm2",
+			Locations:    source.NewLocationSet(location),
+			FoundBy:      catalogerName,
+			Type:         pkg.RpmPkg,
+			MetadataType: pkg.RpmdbMetadataType,
+			Metadata: pkg.RpmdbMetadata{
+				Name:      "openssl-libs",
+				Epoch:     nil,
+				Arch:      "x86_64",
+				Release:   "15.cm2",
+				Version:   "1.1.1k",
+				SourceRpm: "openssl-1.1.1k-15.cm2.src.rpm",
+				Size:      4365048,
+				Vendor:    "Microsoft Corporation",
+			},
+		},
+	}
+
+	fixture, err := os.Open(fixture_path)
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseRpmManifest(location, fixture)
+	if err != nil {
+		t.Fatalf("failed to parse rpm manifest: %+v", err)
+	}
+
+	if len(actual) != 12 {
+		for _, a := range actual {
+			t.Log("   ", a)
+		}
+		t.Fatalf("unexpected package count: %d!=%d", len(actual), len(expected))
+	}
+
+	for _, a := range actual[0:4] {
+		e := expected[a.Name]
+		diffs := deep.Equal(a, e)
+		if len(diffs) > 0 {
+			for _, d := range diffs {
+				t.Errorf("diff: %+v", d)
+			}
+		}
+	}
+}

syft/pkg/cataloger/rpmdb/test-fixtures/container-manifest-2

@@ -0,0 +1,12 @@
+mariner-release	2.0-12.cm2	1653816591	1653753130	Microsoft Corporation	(none)	580	noarch	0	mariner-release-2.0-12.cm2.src.rpm
+filesystem	1.1-9.cm2	1653816591	1653628924	Microsoft Corporation	(none)	7596	x86_64	0	filesystem-1.1-9.cm2.src.rpm
+glibc	2.35-2.cm2	1653816591	1653628955	Microsoft Corporation	(none)	10855265	x86_64	0	glibc-2.35-2.cm2.src.rpm
+openssl-libs	1.1.1k-15.cm2	1653816591	1653631609	Microsoft Corporation	(none)	4365048	x86_64	0	openssl-1.1.1k-15.cm2.src.rpm
+libgcc	11.2.0-2.cm2	1653816591	1650702349	Microsoft Corporation	(none)	103960	x86_64	0	gcc-11.2.0-2.cm2.src.rpm
+openssl	1.1.1k-15.cm2	1653816591	1653631609	Microsoft Corporation	(none)	1286337	x86_64	0	openssl-1.1.1k-15.cm2.src.rpm
+glibc-iconv	2.35-2.cm2	1653816591	1653628955	Microsoft Corporation	(none)	8397230	x86_64	0	glibc-2.35-2.cm2.src.rpm
+iana-etc	20211115-1.cm2	1653816591	1650711959	Microsoft Corporation	(none)	4380680	noarch	0	iana-etc-20211115-1.cm2.src.rpm
+tzdata	2022a-1.cm2	1653816591	1653752882	Microsoft Corporation	(none)	1535764	noarch	0	tzdata-2022a-1.cm2.src.rpm
+prebuilt-ca-certificates-base	2.0.0-3.cm2	1653816591	1653771776	Microsoft Corporation	(none)	65684	noarch	1	prebuilt-ca-certificates-base-2.0.0-3.cm2.src.rpm
+distroless-packages-minimal	0.1-2.cm2	1653816591	1650712132	Microsoft Corporation	(none)	0	x86_64	0	distroless-packages-0.1-2.cm2.src.rpm
+distroless-packages-base	0.1-2.cm2	1653816591	1650712132	Microsoft Corporation	(none)	0	x86_64	0	distroless-packages-0.1-2.cm2.src.rpm

syft/pkg/cataloger/rpmdb/test-fixtures/generate-fixture.sh

@@ -21,3 +21,9 @@ docker exec -i --tty=false generate-rpmdb-fixture bash <<-EOF
 EOF
 
 docker cp generate-rpmdb-fixture:/scratch/Packages .
+
+docker build -o . - <<EOF
+FROM mcr.microsoft.com/cbl-mariner/distroless/base:2.0 as base
+FROM scratch
+COPY --from=base /var/lib/rpmmanifest/container-manifest-2 .
+EOF

syft/pkg/conan_metadata.go

@@ -0,0 +1,24 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+type ConanMetadata struct {
+	Name    string `mapstructure:"name" json:"name"`
+	Version string `mapstructure:"version" json:"version"`
+}
+
+func (m ConanMetadata) PackageURL(_ *linux.Release) string {
+	var qualifiers packageurl.Qualifiers
+
+	return packageurl.NewPackageURL(
+		packageurl.TypeConan,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}

syft/pkg/language.go

@@ -21,6 +21,7 @@ const (
 	Rust            Language = "rust"
 	Dart            Language = "dart"
 	Dotnet          Language = "dotnet"
+	CPP             Language = "c++"
 )
 
 // AllLanguages is a set of all programming languages detected by syft.
@@ -34,6 +35,7 @@ var AllLanguages = []Language{
 	Rust,
 	Dart,
 	Dotnet,
+	CPP,
 }
 
 // String returns the string representation of the language.
@@ -58,7 +60,7 @@ func LanguageByName(name string) Language {
 		return PHP
 	case packageurl.TypeGolang, string(GoModulePkg), string(Go):
 		return Go
-	case packageurl.TypeNPM, string(JavaScript):
+	case packageurl.TypeNPM, string(JavaScript), "nodejs", "node.js":
 		return JavaScript
 	case packageurl.TypePyPi, string(Python):
 		return Python
@@ -70,6 +72,8 @@ func LanguageByName(name string) Language {
 		return Dart
 	case packageurl.TypeDotnet:
 		return Dotnet
+	case packageurl.TypeConan, string(CPP):
+		return CPP
 	default:
 		return UnknownLanguage
 	}

syft/pkg/language_test.go

@@ -50,6 +50,10 @@ func TestLanguageFromPURL(t *testing.T) {
 			purl: "pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?type=zip&classifier=dist",
 			want: Java,
 		},
+		{
+			purl: "pkg:conan/catch2@2.13.8",
+			want: CPP,
+		},
 	}
 
 	var languages []string
@@ -127,6 +131,14 @@ func TestLanguageByName(t *testing.T) {
 			name:     "javascript",
 			language: JavaScript,
 		},
+		{
+			name:     "node.js",
+			language: JavaScript,
+		},
+		{
+			name:     "nodejs",
+			language: JavaScript,
+		},
 		{
 			name:     "pypi",
 			language: Python,
@@ -175,6 +187,14 @@ func TestLanguageByName(t *testing.T) {
 			name:     "unknown",
 			language: UnknownLanguage,
 		},
+		{
+			name:     "conan",
+			language: CPP,
+		},
+		{
+			name:     "c++",
+			language: CPP,
+		},
 	}
 
 	for _, test := range tests {

syft/pkg/metadata.go

@@ -25,6 +25,7 @@ const (
 	KbPackageMetadataType        MetadataType = "KbPackageMetadata"
 	GolangBinMetadataType        MetadataType = "GolangBinMetadata"
 	PhpComposerJSONMetadataType  MetadataType = "PhpComposerJsonMetadata"
+	ConanaMetadataType           MetadataType = "ConanaMetadataType"
 )
 
 var AllMetadataTypes = []MetadataType{
@@ -42,6 +43,7 @@ var AllMetadataTypes = []MetadataType{
 	KbPackageMetadataType,
 	GolangBinMetadataType,
 	PhpComposerJSONMetadataType,
+	ConanaMetadataType,
 }
 
 var MetadataTypeByName = map[MetadataType]reflect.Type{
@@ -59,4 +61,5 @@ var MetadataTypeByName = map[MetadataType]reflect.Type{
 	KbPackageMetadataType:        reflect.TypeOf(KbPackageMetadata{}),
 	GolangBinMetadataType:        reflect.TypeOf(GolangBinMetadata{}),
 	PhpComposerJSONMetadataType:  reflect.TypeOf(PhpComposerJSONMetadata{}),
+	ConanaMetadataType:           reflect.TypeOf(ConanMetadata{}),
 }

syft/pkg/relationships_by_file_ownership.go

@@ -7,12 +7,17 @@ import (
 	"github.com/scylladb/go-set/strset"
 )
 
+// AltRpmDBGlob allows db matches against new locations introduced in fedora:{36,37}
+// See https://github.com/anchore/syft/issues/1077 for larger context
+const AltRpmDBGlob = "**/rpm/{Packages,Packages.db,rpmdb.sqlite}"
+
 var globsForbiddenFromBeingOwned = []string{
 	// any OS DBs should automatically be ignored to prevent cyclic issues (e.g. the "rpm" RPM owns the path to the
 	// RPM DB, so if not ignored that package would own all other packages on the system).
 	ApkDBGlob,
 	DpkgDBGlob,
 	RpmDBGlob,
+	AltRpmDBGlob,
 	// DEB packages share common copyright info between, this does not mean that sharing these paths implies ownership.
 	"/usr/share/doc/**/copyright",
 }

syft/pkg/rpmdb_metadata.go

@@ -16,6 +16,9 @@ import (
 // rpmdb.sqlite is the sqlite format used in fedora + derivates
 const RpmDBGlob = "**/var/lib/rpm/{Packages,Packages.db,rpmdb.sqlite}"
 
+// Used in CBL-Mariner distroless images
+const RpmManifestGlob = "**/var/lib/rpmmanifest/container-manifest-2"
+
 var (
 	_ FileOwner     = (*RpmdbMetadata)(nil)
 	_ urlIdentifier = (*RpmdbMetadata)(nil)

syft/pkg/type.go

@@ -23,6 +23,7 @@ const (
 	KbPkg            Type = "msrc-kb"
 	DartPubPkg       Type = "dart-pub"
 	DotnetPkg        Type = "dotnet"
+	ConanPkg         Type = "conan"
 )
 
 // AllPkgs represents all supported package types
@@ -42,6 +43,7 @@ var AllPkgs = []Type{
 	KbPkg,
 	DartPubPkg,
 	DotnetPkg,
+	ConanPkg,
 }
 
 // PackageURLType returns the PURL package type for the current package.
@@ -73,6 +75,8 @@ func (t Type) PackageURLType() string {
 		return packageurl.TypePub
 	case DotnetPkg:
 		return packageurl.TypeDotnet
+	case ConanPkg:
+		return packageurl.TypeConan
 	default:
 		// TODO: should this be a "generic" purl type instead?
 		return ""
@@ -116,6 +120,8 @@ func TypeByName(name string) Type {
 		return DartPubPkg
 	case packageurl.TypeDotnet:
 		return DotnetPkg
+	case packageurl.TypeConan:
+		return ConanPkg
 	default:
 		return UnknownPkg
 	}

syft/pkg/type_test.go

@@ -68,6 +68,10 @@ func TestTypeFromPURL(t *testing.T) {
 			purl:     "pkg:alpm/arch/linux@5.10.0?arch=x86_64&distro=arch",
 			expected: AlpmPkg,
 		},
+		{
+			purl:     "pkg:conan/catch2@2.13.8",
+			expected: ConanPkg,
+		},
 	}
 
 	var pkgTypes []string

syft/pkg/url_test.go

@@ -208,6 +208,21 @@ func TestPackageURL(t *testing.T) {
 
 			expected: "pkg:alpm/arch/linux@5.10.0?distro=arch-rolling",
 		},
+		{
+			name: "conan",
+			pkg: Package{
+				Name:         "catch2",
+				Version:      "2.13.8",
+				Type:         ConanPkg,
+				Language:     CPP,
+				MetadataType: ConanaMetadataType,
+				Metadata: ConanMetadata{
+					Name:    "catch2",
+					Version: "2.13.8",
+				},
+			},
+			expected: "pkg:conan/catch2@2.13.8",
+		},
 	}
 
 	var pkgTypes []string

test/cli/all_formats_expressible_test.go

@@ -2,10 +2,12 @@ package cli
 
 import (
 	"fmt"
-	"github.com/stretchr/testify/require"
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/syft"
 )
 
@@ -23,7 +25,12 @@ func TestAllFormatsExpressible(t *testing.T) {
 	require.NotEmpty(t, formats)
 	for _, o := range formats {
 		t.Run(fmt.Sprintf("format:%s", o), func(t *testing.T) {
-			cmd, stdout, stderr := runSyft(t, nil, "dir:./test-fixtures/image-pkg-coverage", "-o", string(o))
+			args := []string{"dir:./test-fixtures/image-pkg-coverage", "-o", string(o)}
+			if o == template.ID {
+				args = append(args, "-t", "test-fixtures/csv.template")
+			}
+
+			cmd, stdout, stderr := runSyft(t, nil, args...)
 			for _, traitFn := range commonAssertions {
 				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
 			}

test/cli/packages_cmd_test.go

@@ -227,6 +227,14 @@ func TestPackagesCmdFlags(t *testing.T) {
 				),
 			},
 		},
+		{
+			name: "catalogers-option",
+			args: []string{"packages", "-o", "json", "--catalogers", "python,ruby-gemspec", coverageImage},
+			assertions: []traitAssertion{
+				assertPackageCount(6),
+				assertSuccessfulReturnCode,
+			},
+		},
 	}
 
 	for _, test := range tests {

test/cli/test-fixtures/csv.template

@@ -0,0 +1,4 @@
+"Package","Version Installed", "Found by"
+{{- range .Artifacts}}
+"{{.Name}}","{{.Version}}","{{.FoundBy}}"
+{{- end}}

test/integration/catalog_packages_cases_test.go

@@ -60,6 +60,15 @@ var imageOnlyTestCases = []testCase{
 			"libc-utils": "0.7.2-r0",
 		},
 	},
+	{
+		name:        "find java packages excluding pom.xml", // image scans can not include packages that have yet to be installed
+		pkgType:     pkg.JavaPkg,
+		pkgLanguage: pkg.Java,
+		pkgInfo: map[string]string{
+			"example-java-app-maven": "0.1.0",
+			"joda-time":              "2.9.2",
+		},
+	},
 }
 
 var dirOnlyTestCases = []testCase{
@@ -158,6 +167,19 @@ var dirOnlyTestCases = []testCase{
 			"github.com/bmatcuk/doublestar": "v1.3.1",
 		},
 	},
+	{
+		name:        "find conan packages",
+		pkgType:     pkg.ConanPkg,
+		pkgLanguage: pkg.CPP,
+		pkgInfo: map[string]string{
+			"catch2":     "2.13.8",
+			"docopt.cpp": "0.6.3",
+			"fmt":        "8.1.1",
+			"spdlog":     "1.9.2",
+			"sdl":        "2.0.20",
+			"fltk":       "1.3.8",
+		},
+	},
 	{
 		name:        "find rust crates",
 		pkgType:     pkg.RustPkg,
@@ -218,6 +240,17 @@ var dirOnlyTestCases = []testCase{
 			"System.Runtime.CompilerServices.Unsafe":                "6.0.0",
 		},
 	},
+	{
+		name:        "find java packages including pom.xml", // directory scans can include packages that have yet to be installed
+		pkgType:     pkg.JavaPkg,
+		pkgLanguage: pkg.Java,
+		duplicates:  1, // joda-time is included in both pom.xml AND the .jar collection
+		pkgInfo: map[string]string{
+			"example-java-app-maven": "0.1.0",
+			"joda-time":              "2.9.2",
+			"junit":                  "4.12",
+		},
+	},
 }
 
 var commonTestCases = []testCase{
@@ -244,15 +277,6 @@ var commonTestCases = []testCase{
 			"netbase": "5.4",
 		},
 	},
-	{
-		name:        "find java packages",
-		pkgType:     pkg.JavaPkg,
-		pkgLanguage: pkg.Java,
-		pkgInfo: map[string]string{
-			"example-java-app-maven": "0.1.0",
-			"joda-time":              "2.9.2",
-		},
-	},
 	{
 		name:        "find jenkins plugins",
 		pkgType:     pkg.JenkinsPluginPkg,

test/integration/catalog_packages_test.go

@@ -67,6 +67,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedLanguages.Remove(pkg.Rust.String())
 	definedLanguages.Remove(pkg.Dart.String())
 	definedLanguages.Remove(pkg.Dotnet.String())
+	definedLanguages.Remove(pkg.CPP.String())
 
 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
@@ -80,6 +81,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.RustPkg))
 	definedPkgs.Remove(string(pkg.DartPubPkg))
 	definedPkgs.Remove(string(pkg.DotnetPkg))
+	definedPkgs.Remove(string(pkg.ConanPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)

test/integration/mariner_distroless_test.go

@@ -0,0 +1,22 @@
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestMarinerDistroless(t *testing.T) {
+	sbom, _ := catalogFixtureImage(t, "image-mariner-distroless", source.SquashedScope)
+
+	expectedPkgs := 12
+	actualPkgs := 0
+	for range sbom.Artifacts.PackageCatalog.Enumerate(pkg.RpmPkg) {
+		actualPkgs += 1
+	}
+
+	if actualPkgs != expectedPkgs {
+		t.Errorf("unexpected number of RPM packages: %d != %d", expectedPkgs, actualPkgs)
+	}
+}

test/integration/node_packages_test.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"reflect"
 	"strings"
 	"testing"
 
@@ -33,6 +34,7 @@ func TestYarnPackageLockDirectory(t *testing.T) {
 	sbom, _ := catalogDirectory(t, "test-fixtures/yarn-lock")
 
 	foundPackages := internal.NewStringSet()
+	expectedPackages := internal.NewStringSet("async@0.9.2", "async@3.2.3", "merge-objects@1.0.5", "should-type@1.3.0", "@4lolo/resize-observer-polyfill@1.5.2")
 
 	for actualPkg := range sbom.Artifacts.PackageCatalog.Enumerate(pkg.NpmPkg) {
 		for _, actualLocation := range actualPkg.Locations.ToSlice() {
@@ -40,12 +42,13 @@ func TestYarnPackageLockDirectory(t *testing.T) {
 				t.Errorf("found packages from yarn.lock in node_modules: %s", actualLocation)
 			}
 		}
-		foundPackages.Add(actualPkg.Name)
+		foundPackages.Add(actualPkg.Name + "@" + actualPkg.Version)
 	}
 
 	// ensure that integration test commonTestCases stay in sync with the available catalogers
-	const expectedPackageCount = 5
-	if len(foundPackages) != expectedPackageCount {
-		t.Errorf("found the wrong set of yarn.lock packages (expected: %d, actual: %d)", expectedPackageCount, len(foundPackages))
+	if len(foundPackages) != len(expectedPackages) {
+		t.Errorf("found the wrong set of yarn.lock packages (expected: %d, actual: %d)", len(expectedPackages), len(foundPackages))
+	} else if !reflect.DeepEqual(foundPackages, expectedPackages) {
+		t.Errorf("found the wrong set of yarn.lock packages (expected: %+q, actual: %+q)", expectedPackages.ToSlice(), foundPackages.ToSlice())
 	}
 }

test/integration/test-fixtures/image-mariner-distroless/Dockerfile

@@ -0,0 +1 @@
+FROM mcr.microsoft.com/cbl-mariner/distroless/base:2.0.202205275@sha256:f550c5428df17b145851ad75983aca6d613ad4b51ca7983b2a83e67d0ac91a5d

test/integration/test-fixtures/image-pkg-coverage/conan/conanfile.txt

@@ -0,0 +1,12 @@
+# Docs at https://docs.conan.io/en/latest/reference/conanfile_txt.html
+
+[requires]
+catch2/2.13.8
+docopt.cpp/0.6.3
+fmt/8.1.1
+spdlog/1.9.2
+sdl/2.0.20
+fltk/1.3.8
+
+[generators]
+cmake_find_package_multi

test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+
+	<groupId>org.anchore</groupId>
+	<artifactId>example-java-app-maven</artifactId>
+	<packaging>jar</packaging>
+	<version>0.1.0</version>
+
+	<properties>
+		<maven.compiler.source>1.8</maven.compiler.source>
+		<maven.compiler.target>1.8</maven.compiler.target>
+	</properties>
+
+	<dependencies>
+		<!-- tag::joda[] -->
+		<dependency>
+			<groupId>joda-time</groupId>
+			<artifactId>joda-time</artifactId>
+			<version>2.9.2</version>
+		</dependency>
+		<!-- end::joda[] -->
+		<!-- tag::junit[] -->
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.12</version>
+			<scope>test</scope>
+		</dependency>
+		<!-- end::junit[] -->
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-shade-plugin</artifactId>
+				<version>2.1</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>shade</goal>
+						</goals>
+						<configuration>
+							<transformers>
+								<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+									<mainClass>hello.HelloWorld</mainClass>
+								</transformer>
+							</transformers>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+
+</project>

test/integration/test-fixtures/yarn-lock/node_modules/.bin/semver

@@ -1 +0,0 @@
-../semver/bin/semver.js

test/integration/test-fixtures/yarn-lock/node_modules/.yarn-integrity

@@ -1,22 +0,0 @@
-{
-  "systemParams": "darwin-x64-83",
-  "modulesFolders": [
-    "node_modules"
-  ],
-  "flags": [],
-  "linkedModules": [],
-  "topLevelPatterns": [
-    "collapse-white-space@^2.0.0",
-    "merge-objects@^1.0.5",
-    "semver@^7.3.5"
-  ],
-  "lockfileEntries": {
-    "collapse-white-space@^2.0.0": "https://registry.yarnpkg.com/collapse-white-space/-/collapse-white-space-2.0.0.tgz#37d8521344cdd36635db180a7c83e9d515ac281b",
-    "lru-cache@^6.0.0": "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz#6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94",
-    "merge-objects@^1.0.5": "https://registry.yarnpkg.com/merge-objects/-/merge-objects-1.0.5.tgz#ad923ff3910091acc1438f53eb75b8f37d862a86",
-    "semver@^7.3.5": "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz#0b621c879348d8998e4b0e4be94b3f12e6018ef7",
-    "yallist@^4.0.0": "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
-  },
-  "files": [],
-  "artifacts": {}
-}

test/integration/test-fixtures/yarn-lock/node_modules/async/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2010-2018 Caolan McMahon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

test/integration/test-fixtures/yarn-lock/node_modules/async/bower.json

@@ -0,0 +1,17 @@
+{
+  "name": "async",
+  "main": "dist/async.js",
+  "ignore": [
+    "bower_components",
+    "lib",
+    "test",
+    "node_modules",
+    "perf",
+    "support",
+    "**/.*",
+    "*.config.js",
+    "*.json",
+    "index.js",
+    "Makefile"
+  ]
+}

test/integration/test-fixtures/yarn-lock/node_modules/async/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "async",
+  "description": "Higher-order functions and common patterns for asynchronous code",
+  "version": "3.2.3",
+  "main": "dist/async.js",
+  "author": "Caolan McMahon",
+  "homepage": "https://caolan.github.io/async/",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/caolan/async.git"
+  },
+  "bugs": {
+    "url": "https://github.com/caolan/async/issues"
+  },
+  "keywords": [
+    "async",
+    "callback",
+    "module",
+    "utility"
+  ],
+  "devDependencies": {
+    "babel-core": "^6.26.3",
+    "babel-eslint": "^8.2.6",
+    "babel-minify": "^0.5.0",
+    "babel-plugin-add-module-exports": "^0.2.1",
+    "babel-plugin-istanbul": "^5.1.4",
+    "babel-plugin-syntax-async-generators": "^6.13.0",
+    "babel-plugin-transform-es2015-modules-commonjs": "^6.26.2",
+    "babel-preset-es2015": "^6.3.13",
+    "babel-preset-es2017": "^6.22.0",
+    "babel-register": "^6.26.0",
+    "babelify": "^8.0.0",
+    "benchmark": "^2.1.1",
+    "bluebird": "^3.4.6",
+    "browserify": "^16.2.3",
+    "chai": "^4.2.0",
+    "cheerio": "^0.22.0",
+    "coveralls": "^3.0.4",
+    "es6-promise": "^2.3.0",
+    "eslint": "^6.0.1",
+    "eslint-plugin-prefer-arrow": "^1.1.5",
+    "fs-extra": "^0.26.7",
+    "jsdoc": "^3.6.2",
+    "karma": "^4.1.0",
+    "karma-browserify": "^5.3.0",
+    "karma-edge-launcher": "^0.4.2",
+    "karma-firefox-launcher": "^1.1.0",
+    "karma-junit-reporter": "^1.2.0",
+    "karma-mocha": "^1.2.0",
+    "karma-mocha-reporter": "^2.2.0",
+    "karma-safari-launcher": "^1.0.0",
+    "mocha": "^6.1.4",
+    "mocha-junit-reporter": "^1.18.0",
+    "native-promise-only": "^0.8.0-a",
+    "nyc": "^14.1.1",
+    "rollup": "^0.63.4",
+    "rollup-plugin-node-resolve": "^2.0.0",
+    "rollup-plugin-npm": "^2.0.0",
+    "rsvp": "^3.0.18",
+    "semver": "^5.5.0",
+    "yargs": "^11.0.0"
+  },
+  "scripts": {
+    "coverage": "nyc npm run mocha-node-test -- --grep @nycinvalid --invert",
+    "coveralls": "npm run coverage && nyc report --reporter=text-lcov | coveralls",
+    "jsdoc": "jsdoc -c ./support/jsdoc/jsdoc.json && node support/jsdoc/jsdoc-fix-html.js",
+    "lint": "eslint --fix lib/ test/ perf/memory.js perf/suites.js perf/benchmark.js support/build/ support/*.js karma.conf.js",
+    "mocha-browser-test": "karma start",
+    "mocha-node-test": "mocha",
+    "mocha-test": "npm run mocha-node-test && npm run mocha-browser-test",
+    "test": "npm run lint && npm run mocha-node-test"
+  },
+  "license": "MIT",
+  "nyc": {
+    "exclude": [
+      "test"
+    ]
+  },
+  "module": "dist/async.mjs"
+}

test/integration/test-fixtures/yarn-lock/node_modules/collapse-white-space/index.d.ts

@@ -1,7 +0,0 @@
-/**
- * Collapse whitespace to a single space.
- *
- * @param {string} value
- * @returns {string}
- */
-export function collapseWhiteSpace(value: string): string;

test/integration/test-fixtures/yarn-lock/node_modules/collapse-white-space/index.js

@@ -1,9 +0,0 @@
-/**
- * Collapse whitespace to a single space.
- *
- * @param {string} value
- * @returns {string}
- */
-export function collapseWhiteSpace(value) {
-  return String(value).replace(/\s+/g, ' ')
-}

test/integration/test-fixtures/yarn-lock/node_modules/collapse-white-space/license

@@ -1,22 +0,0 @@
-(The MIT License)
-
-Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

test/integration/test-fixtures/yarn-lock/node_modules/collapse-white-space/package.json

@@ -1,69 +0,0 @@
-{
-  "name": "collapse-white-space",
-  "version": "2.0.0",
-  "description": "Replace multiple white space characters with a single space",
-  "license": "MIT",
-  "keywords": [
-    "collapse",
-    "white",
-    "space"
-  ],
-  "repository": "wooorm/collapse-white-space",
-  "bugs": "https://github.com/wooorm/collapse-white-space/issues",
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/sponsors/wooorm"
-  },
-  "author": "Titus Wormer <tituswormer@gmail.com> (https://wooorm.com)",
-  "contributors": [
-    "Titus Wormer <tituswormer@gmail.com> (https://wooorm.com)"
-  ],
-  "sideEffects": false,
-  "type": "module",
-  "main": "index.js",
-  "types": "index.d.ts",
-  "files": [
-    "index.d.ts",
-    "index.js"
-  ],
-  "devDependencies": {
-    "@types/tape": "^4.0.0",
-    "c8": "^7.0.0",
-    "prettier": "^2.0.0",
-    "remark-cli": "^9.0.0",
-    "remark-preset-wooorm": "^8.0.0",
-    "rimraf": "^3.0.0",
-    "tape": "^5.0.0",
-    "typescript": "^4.0.0",
-    "xo": "^0.38.0"
-  },
-  "scripts": {
-    "prepublishOnly": "npm run build",
-    "format": "remark . -qfo && prettier . -w --loglevel warn && xo --fix",
-    "prebuild": "rimraf \"*.d.ts\"",
-    "build": "tsc",
-    "test-api": "node test",
-    "test-coverage": "c8 --check-coverage --branches 100 --functions 100 --lines 100 --statements 100 --reporter lcov node test.js",
-    "test": "npm run format && npm run build && npm run test-coverage"
-  },
-  "prettier": {
-    "tabWidth": 2,
-    "useTabs": false,
-    "singleQuote": true,
-    "bracketSpacing": false,
-    "semi": false,
-    "trailingComma": "none"
-  },
-  "xo": {
-    "prettier": true,
-    "rules": {
-      "no-var": "off",
-      "prefer-arrow-callback": "off"
-    }
-  },
-  "remarkConfig": {
-    "plugins": [
-      "preset-wooorm"
-    ]
-  }
-}

test/integration/test-fixtures/yarn-lock/node_modules/collapse-white-space/readme.md

@@ -1,65 +0,0 @@
-# collapse-white-space
-
-[![Build][build-badge]][build]
-[![Coverage][coverage-badge]][coverage]
-[![Downloads][downloads-badge]][downloads]
-[![Size][size-badge]][size]
-
-Replace multiple whitespace characters with a single space.
-
-## Install
-
-This package is ESM only: Node 12+ is needed to use it and it must be `import`ed
-instead of `require`d.
-
-[npm][]:
-
-```sh
-npm install collapse-white-space
-```
-
-## Use
-
-```js
-import {collapseWhiteSpace} from 'collapse-white-space'
-
-collapseWhiteSpace('\tfoo \n\tbar  \t\r\nbaz') //=> ' foo bar baz'
-```
-
-## API
-
-This package exports the following identifiers: `collapseWhiteSpace`.
-There is no default export.
-
-### `collapseWhiteSpace(value)`
-
-Replace multiple whitespace characters in `value` (`string`) with a single
-space.
-
-## License
-
-[MIT][license] © [Titus Wormer][author]
-
-<!-- Definitions -->
-
-[build-badge]: https://github.com/wooorm/collapse-white-space/workflows/main/badge.svg
-
-[build]: https://github.com/wooorm/collapse-white-space/actions
-
-[coverage-badge]: https://img.shields.io/codecov/c/github/wooorm/collapse-white-space.svg
-
-[coverage]: https://codecov.io/github/wooorm/collapse-white-space
-
-[downloads-badge]: https://img.shields.io/npm/dm/collapse-white-space.svg
-
-[downloads]: https://www.npmjs.com/package/collapse-white-space
-
-[size-badge]: https://img.shields.io/bundlephobia/minzip/collapse-white-space.svg
-
-[size]: https://bundlephobia.com/result?p=collapse-white-space
-
-[npm]: https://docs.npmjs.com/cli/install
-
-[license]: license
-
-[author]: https://wooorm.com

test/integration/test-fixtures/yarn-lock/node_modules/lru-cache/LICENSE

@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

test/integration/test-fixtures/yarn-lock/node_modules/lru-cache/README.md

@@ -1,166 +0,0 @@
-# lru cache
-
-A cache object that deletes the least-recently-used items.
-
-[![Build Status](https://travis-ci.org/isaacs/node-lru-cache.svg?branch=master)](https://travis-ci.org/isaacs/node-lru-cache) [![Coverage Status](https://coveralls.io/repos/isaacs/node-lru-cache/badge.svg?service=github)](https://coveralls.io/github/isaacs/node-lru-cache)
-
-## Installation:
-
-```javascript
-npm install lru-cache --save
-```
-
-## Usage:
-
-```javascript
-var LRU = require("lru-cache")
-  , options = { max: 500
-              , length: function (n, key) { return n * 2 + key.length }
-              , dispose: function (key, n) { n.close() }
-              , maxAge: 1000 * 60 * 60 }
-  , cache = new LRU(options)
-  , otherCache = new LRU(50) // sets just the max size
-
-cache.set("key", "value")
-cache.get("key") // "value"
-
-// non-string keys ARE fully supported
-// but note that it must be THE SAME object, not
-// just a JSON-equivalent object.
-var someObject = { a: 1 }
-cache.set(someObject, 'a value')
-// Object keys are not toString()-ed
-cache.set('[object Object]', 'a different value')
-assert.equal(cache.get(someObject), 'a value')
-// A similar object with same keys/values won't work,
-// because it's a different object identity
-assert.equal(cache.get({ a: 1 }), undefined)
-
-cache.reset()    // empty the cache
-```
-
-If you put more stuff in it, then items will fall out.
-
-If you try to put an oversized thing in it, then it'll fall out right
-away.
-
-## Options
-
-* `max` The maximum size of the cache, checked by applying the length
-  function to all values in the cache.  Not setting this is kind of
-  silly, since that's the whole purpose of this lib, but it defaults
-  to `Infinity`.  Setting it to a non-number or negative number will
-  throw a `TypeError`.  Setting it to 0 makes it be `Infinity`.
-* `maxAge` Maximum age in ms.  Items are not pro-actively pruned out
-  as they age, but if you try to get an item that is too old, it'll
-  drop it and return undefined instead of giving it to you.
-  Setting this to a negative value will make everything seem old!
-  Setting it to a non-number will throw a `TypeError`.
-* `length` Function that is used to calculate the length of stored
-  items.  If you're storing strings or buffers, then you probably want
-  to do something like `function(n, key){return n.length}`.  The default is
-  `function(){return 1}`, which is fine if you want to store `max`
-  like-sized things.  The item is passed as the first argument, and
-  the key is passed as the second argumnet.
-* `dispose` Function that is called on items when they are dropped
-  from the cache.  This can be handy if you want to close file
-  descriptors or do other cleanup tasks when items are no longer
-  accessible.  Called with `key, value`.  It's called *before*
-  actually removing the item from the internal cache, so if you want
-  to immediately put it back in, you'll have to do that in a
-  `nextTick` or `setTimeout` callback or it won't do anything.
-* `stale` By default, if you set a `maxAge`, it'll only actually pull
-  stale items out of the cache when you `get(key)`.  (That is, it's
-  not pre-emptively doing a `setTimeout` or anything.)  If you set
-  `stale:true`, it'll return the stale value before deleting it.  If
-  you don't set this, then it'll return `undefined` when you try to
-  get a stale entry, as if it had already been deleted.
-* `noDisposeOnSet` By default, if you set a `dispose()` method, then
-  it'll be called whenever a `set()` operation overwrites an existing
-  key.  If you set this option, `dispose()` will only be called when a
-  key falls out of the cache, not when it is overwritten.
-* `updateAgeOnGet` When using time-expiring entries with `maxAge`,
-  setting this to `true` will make each item's effective time update
-  to the current time whenever it is retrieved from cache, causing it
-  to not expire.  (It can still fall out of cache based on recency of
-  use, of course.)
-
-## API
-
-* `set(key, value, maxAge)`
-* `get(key) => value`
-
-    Both of these will update the "recently used"-ness of the key.
-    They do what you think. `maxAge` is optional and overrides the
-    cache `maxAge` option if provided.
-
-    If the key is not found, `get()` will return `undefined`.
-
-    The key and val can be any value.
-
-* `peek(key)`
-
-    Returns the key value (or `undefined` if not found) without
-    updating the "recently used"-ness of the key.
-
-    (If you find yourself using this a lot, you *might* be using the
-    wrong sort of data structure, but there are some use cases where
-    it's handy.)
-
-* `del(key)`
-
-    Deletes a key out of the cache.
-
-* `reset()`
-
-    Clear the cache entirely, throwing away all values.
-
-* `has(key)`
-
-    Check if a key is in the cache, without updating the recent-ness
-    or deleting it for being stale.
-
-* `forEach(function(value,key,cache), [thisp])`
-
-    Just like `Array.prototype.forEach`.  Iterates over all the keys
-    in the cache, in order of recent-ness.  (Ie, more recently used
-    items are iterated over first.)
-
-* `rforEach(function(value,key,cache), [thisp])`
-
-    The same as `cache.forEach(...)` but items are iterated over in
-    reverse order.  (ie, less recently used items are iterated over
-    first.)
-
-* `keys()`
-
-    Return an array of the keys in the cache.
-
-* `values()`
-
-    Return an array of the values in the cache.
-
-* `length`
-
-    Return total length of objects in cache taking into account
-    `length` options function.
-
-* `itemCount`
-
-    Return total quantity of objects currently in cache. Note, that
-    `stale` (see options) items are returned as part of this item
-    count.
-
-* `dump()`
-
-    Return an array of the cache entries ready for serialization and usage
-    with 'destinationCache.load(arr)`.
-
-* `load(cacheEntriesArray)`
-
-    Loads another cache entries array, obtained with `sourceCache.dump()`,
-    into the cache. The destination cache is reset before loading new entries
-
-* `prune()`
-
-    Manually iterates over the entire cache proactively pruning old entries

test/integration/test-fixtures/yarn-lock/node_modules/lru-cache/index.js

@@ -1,334 +0,0 @@
-'use strict'
-
-// A linked list to keep track of recently-used-ness
-const Yallist = require('yallist')
-
-const MAX = Symbol('max')
-const LENGTH = Symbol('length')
-const LENGTH_CALCULATOR = Symbol('lengthCalculator')
-const ALLOW_STALE = Symbol('allowStale')
-const MAX_AGE = Symbol('maxAge')
-const DISPOSE = Symbol('dispose')
-const NO_DISPOSE_ON_SET = Symbol('noDisposeOnSet')
-const LRU_LIST = Symbol('lruList')
-const CACHE = Symbol('cache')
-const UPDATE_AGE_ON_GET = Symbol('updateAgeOnGet')
-
-const naiveLength = () => 1
-
-// lruList is a yallist where the head is the youngest
-// item, and the tail is the oldest.  the list contains the Hit
-// objects as the entries.
-// Each Hit object has a reference to its Yallist.Node.  This
-// never changes.
-//
-// cache is a Map (or PseudoMap) that matches the keys to
-// the Yallist.Node object.
-class LRUCache {
-  constructor (options) {
-    if (typeof options === 'number')
-      options = { max: options }
-
-    if (!options)
-      options = {}
-
-    if (options.max && (typeof options.max !== 'number' || options.max < 0))
-      throw new TypeError('max must be a non-negative number')
-    // Kind of weird to have a default max of Infinity, but oh well.
-    const max = this[MAX] = options.max || Infinity
-
-    const lc = options.length || naiveLength
-    this[LENGTH_CALCULATOR] = (typeof lc !== 'function') ? naiveLength : lc
-    this[ALLOW_STALE] = options.stale || false
-    if (options.maxAge && typeof options.maxAge !== 'number')
-      throw new TypeError('maxAge must be a number')
-    this[MAX_AGE] = options.maxAge || 0
-    this[DISPOSE] = options.dispose
-    this[NO_DISPOSE_ON_SET] = options.noDisposeOnSet || false
-    this[UPDATE_AGE_ON_GET] = options.updateAgeOnGet || false
-    this.reset()
-  }
-
-  // resize the cache when the max changes.
-  set max (mL) {
-    if (typeof mL !== 'number' || mL < 0)
-      throw new TypeError('max must be a non-negative number')
-
-    this[MAX] = mL || Infinity
-    trim(this)
-  }
-  get max () {
-    return this[MAX]
-  }
-
-  set allowStale (allowStale) {
-    this[ALLOW_STALE] = !!allowStale
-  }
-  get allowStale () {
-    return this[ALLOW_STALE]
-  }
-
-  set maxAge (mA) {
-    if (typeof mA !== 'number')
-      throw new TypeError('maxAge must be a non-negative number')
-
-    this[MAX_AGE] = mA
-    trim(this)
-  }
-  get maxAge () {
-    return this[MAX_AGE]
-  }
-
-  // resize the cache when the lengthCalculator changes.
-  set lengthCalculator (lC) {
-    if (typeof lC !== 'function')
-      lC = naiveLength
-
-    if (lC !== this[LENGTH_CALCULATOR]) {
-      this[LENGTH_CALCULATOR] = lC
-      this[LENGTH] = 0
-      this[LRU_LIST].forEach(hit => {
-        hit.length = this[LENGTH_CALCULATOR](hit.value, hit.key)
-        this[LENGTH] += hit.length
-      })
-    }
-    trim(this)
-  }
-  get lengthCalculator () { return this[LENGTH_CALCULATOR] }
-
-  get length () { return this[LENGTH] }
-  get itemCount () { return this[LRU_LIST].length }
-
-  rforEach (fn, thisp) {
-    thisp = thisp || this
-    for (let walker = this[LRU_LIST].tail; walker !== null;) {
-      const prev = walker.prev
-      forEachStep(this, fn, walker, thisp)
-      walker = prev
-    }
-  }
-
-  forEach (fn, thisp) {
-    thisp = thisp || this
-    for (let walker = this[LRU_LIST].head; walker !== null;) {
-      const next = walker.next
-      forEachStep(this, fn, walker, thisp)
-      walker = next
-    }
-  }
-
-  keys () {
-    return this[LRU_LIST].toArray().map(k => k.key)
-  }
-
-  values () {
-    return this[LRU_LIST].toArray().map(k => k.value)
-  }
-
-  reset () {
-    if (this[DISPOSE] &&
-        this[LRU_LIST] &&
-        this[LRU_LIST].length) {
-      this[LRU_LIST].forEach(hit => this[DISPOSE](hit.key, hit.value))
-    }
-
-    this[CACHE] = new Map() // hash of items by key
-    this[LRU_LIST] = new Yallist() // list of items in order of use recency
-    this[LENGTH] = 0 // length of items in the list
-  }
-
-  dump () {
-    return this[LRU_LIST].map(hit =>
-      isStale(this, hit) ? false : {
-        k: hit.key,
-        v: hit.value,
-        e: hit.now + (hit.maxAge || 0)
-      }).toArray().filter(h => h)
-  }
-
-  dumpLru () {
-    return this[LRU_LIST]
-  }
-
-  set (key, value, maxAge) {
-    maxAge = maxAge || this[MAX_AGE]
-
-    if (maxAge && typeof maxAge !== 'number')
-      throw new TypeError('maxAge must be a number')
-
-    const now = maxAge ? Date.now() : 0
-    const len = this[LENGTH_CALCULATOR](value, key)
-
-    if (this[CACHE].has(key)) {
-      if (len > this[MAX]) {
-        del(this, this[CACHE].get(key))
-        return false
-      }
-
-      const node = this[CACHE].get(key)
-      const item = node.value
-
-      // dispose of the old one before overwriting
-      // split out into 2 ifs for better coverage tracking
-      if (this[DISPOSE]) {
-        if (!this[NO_DISPOSE_ON_SET])
-          this[DISPOSE](key, item.value)
-      }
-
-      item.now = now
-      item.maxAge = maxAge
-      item.value = value
-      this[LENGTH] += len - item.length
-      item.length = len
-      this.get(key)
-      trim(this)
-      return true
-    }
-
-    const hit = new Entry(key, value, len, now, maxAge)
-
-    // oversized objects fall out of cache automatically.
-    if (hit.length > this[MAX]) {
-      if (this[DISPOSE])
-        this[DISPOSE](key, value)
-
-      return false
-    }
-
-    this[LENGTH] += hit.length
-    this[LRU_LIST].unshift(hit)
-    this[CACHE].set(key, this[LRU_LIST].head)
-    trim(this)
-    return true
-  }
-
-  has (key) {
-    if (!this[CACHE].has(key)) return false
-    const hit = this[CACHE].get(key).value
-    return !isStale(this, hit)
-  }
-
-  get (key) {
-    return get(this, key, true)
-  }
-
-  peek (key) {
-    return get(this, key, false)
-  }
-
-  pop () {
-    const node = this[LRU_LIST].tail
-    if (!node)
-      return null
-
-    del(this, node)
-    return node.value
-  }
-
-  del (key) {
-    del(this, this[CACHE].get(key))
-  }
-
-  load (arr) {
-    // reset the cache
-    this.reset()
-
-    const now = Date.now()
-    // A previous serialized cache has the most recent items first
-    for (let l = arr.length - 1; l >= 0; l--) {
-      const hit = arr[l]
-      const expiresAt = hit.e || 0
-      if (expiresAt === 0)
-        // the item was created without expiration in a non aged cache
-        this.set(hit.k, hit.v)
-      else {
-        const maxAge = expiresAt - now
-        // dont add already expired items
-        if (maxAge > 0) {
-          this.set(hit.k, hit.v, maxAge)
-        }
-      }
-    }
-  }
-
-  prune () {
-    this[CACHE].forEach((value, key) => get(this, key, false))
-  }
-}
-
-const get = (self, key, doUse) => {
-  const node = self[CACHE].get(key)
-  if (node) {
-    const hit = node.value
-    if (isStale(self, hit)) {
-      del(self, node)
-      if (!self[ALLOW_STALE])
-        return undefined
-    } else {
-      if (doUse) {
-        if (self[UPDATE_AGE_ON_GET])
-          node.value.now = Date.now()
-        self[LRU_LIST].unshiftNode(node)
-      }
-    }
-    return hit.value
-  }
-}
-
-const isStale = (self, hit) => {
-  if (!hit || (!hit.maxAge && !self[MAX_AGE]))
-    return false
-
-  const diff = Date.now() - hit.now
-  return hit.maxAge ? diff > hit.maxAge
-    : self[MAX_AGE] && (diff > self[MAX_AGE])
-}
-
-const trim = self => {
-  if (self[LENGTH] > self[MAX]) {
-    for (let walker = self[LRU_LIST].tail;
-      self[LENGTH] > self[MAX] && walker !== null;) {
-      // We know that we're about to delete this one, and also
-      // what the next least recently used key will be, so just
-      // go ahead and set it now.
-      const prev = walker.prev
-      del(self, walker)
-      walker = prev
-    }
-  }
-}
-
-const del = (self, node) => {
-  if (node) {
-    const hit = node.value
-    if (self[DISPOSE])
-      self[DISPOSE](hit.key, hit.value)
-
-    self[LENGTH] -= hit.length
-    self[CACHE].delete(hit.key)
-    self[LRU_LIST].removeNode(node)
-  }
-}
-
-class Entry {
-  constructor (key, value, length, now, maxAge) {
-    this.key = key
-    this.value = value
-    this.length = length
-    this.now = now
-    this.maxAge = maxAge || 0
-  }
-}
-
-const forEachStep = (self, fn, node, thisp) => {
-  let hit = node.value
-  if (isStale(self, hit)) {
-    del(self, node)
-    if (!self[ALLOW_STALE])
-      hit = undefined
-  }
-  if (hit)
-    fn.call(thisp, hit.value, hit.key, self)
-}
-
-module.exports = LRUCache

test/integration/test-fixtures/yarn-lock/node_modules/lru-cache/package.json

@@ -1,34 +0,0 @@
-{
-  "name": "lru-cache",
-  "description": "A cache object that deletes the least-recently-used items.",
-  "version": "6.0.0",
-  "author": "Isaac Z. Schlueter <i@izs.me>",
-  "keywords": [
-    "mru",
-    "lru",
-    "cache"
-  ],
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "prepublishOnly": "git push origin --follow-tags"
-  },
-  "main": "index.js",
-  "repository": "git://github.com/isaacs/node-lru-cache.git",
-  "devDependencies": {
-    "benchmark": "^2.1.4",
-    "tap": "^14.10.7"
-  },
-  "license": "ISC",
-  "dependencies": {
-    "yallist": "^4.0.0"
-  },
-  "files": [
-    "index.js"
-  ],
-  "engines": {
-    "node": ">=10"
-  }
-}

test/integration/test-fixtures/yarn-lock/node_modules/merge-objects/.npmignore

@@ -1,2 +0,0 @@
-*.log
-.DS_Store

test/integration/test-fixtures/yarn-lock/node_modules/merge-objects/.travis.yml

@@ -1,9 +0,0 @@
-language: node_js
-node_js: 
-  - 4.0
-  - 0.12
-  - 0.11
-  - 0.10
-  - 0.9
-  - 0.8
-  - 0.6

test/integration/test-fixtures/yarn-lock/node_modules/merge-objects/README.md

@@ -1,24 +0,0 @@
-# node-merge-objects
-
-Merge two objects and concatenate arrays that are values of the same object key.
-
-Similar to extend in JQuery, but with arrays concatenation. Does deep merging too.
-
-[![Build Status](https://secure.travis-ci.org/shevaroller/node-merge-objects.png)](http://travis-ci.org/shevaroller/node-merge-objects)
-
-
-## Installation
-	npm install merge-objects --save
-
-## Usage
-	var merge = require('merge-objects');
-
-	var object1 = {a: 1, b: [2, 3]};
-	var object2 = {b: [4, 5], c: 6};
-
-	var result = merge(object1, object2);
-	console.log(result); //logs {a: 1, b: [2, 3, 4, 5], c: 6}
-
-## License
-
-MIT

test/integration/test-fixtures/yarn-lock/node_modules/merge-objects/lib/merge-objects.js

@@ -1,42 +0,0 @@
-/**
- * Merge two objects and concatenate arrays that are values of the same object key
- *
- * @author Oleksii Shevchenko <shevaroller@gmail.com> (http://shevaroller.me)
- * @since  6 September 2015
- */
-
-var mergeObjects;
-
-mergeObjects = function(object1, object2) {
-  var key;
-
-  // concatenate not objects into arrays
-  if (typeof object1 !== 'object') {
-    if (typeof object2 !== 'object') {
-      return [object1, object2];
-    }
-    return object2.concat(object1);
-  }
-  if (typeof object2 !== 'object') {
-    return object1.concat(object2);
-  }
-
-  // merge object2 into object1
-  for (key in object2) {
-    if ((Array.isArray(object1[key])) && (Array.isArray(object2[key]))) {
-      // concatenate arrays that are values of the same object key
-      object1[key] = object1[key].concat(object2[key]);
-    } else if (typeof object1[key] === 'object' && typeof object2[key] === 'object') {
-      // deep merge object2 into object1
-      object1[key] = mergeObjects(object1[key], object2[key]);
-    } else {
-      object1[key] = object2[key];
-    }
-  }
-  return object1;
-};
-
-/**
- * Exports Module mergeObjects
- */
-module.exports = mergeObjects;

test/integration/test-fixtures/yarn-lock/node_modules/merge-objects/test/test.js

@@ -1,53 +0,0 @@
-var merge  = require('../lib/merge-objects');
-var assert = require('assert');
-
-var object1, object2, result;
-
-/* Test not objects */
-object1 = 0;
-object2 = 'a string';
-result = merge(object1, object2);
-
-assert.deepEqual(result, [0, 'a string'], 'two not objects');
-
-/* Test one object and one not object */
-object1 = [0, 1];
-object2 = 'a string';
-result = merge(object1, object2);
-
-assert.deepEqual(result, [0, 1, 'a string'], 'one object and one not object');
-
-/* Test one not object and one object */
-object1 = 0;
-object2 = ['a string', 'string2'];
-result = merge(object1, object2);
-
-assert.deepEqual(result, ['a string', 'string2', 0], 'one not object and one object');
-
-/* Test two objects with no depth */
-object1 = {a: 1};
-object2 = {b: 2};
-result = merge(object1, object2);
-
-assert.deepEqual(result, {a: 1, b: 2}, 'two objects with no depth');
-
-/* Test two objects with equal keys */
-object1 = {a: 1};
-object2 = {a: 2};
-result = merge(object1, object2);
-
-assert.deepEqual(result, {a: 2}, 'two objects with equal keys');
-
-/* Test array concatenation inside objects */
-object1 = {a: 1, b: [2, 3]};
-object2 = {b: [4, 5], c: 6};
-result = merge(object1, object2);
-
-assert.deepEqual(result, {a: 1, b: [2, 3, 4, 5], c: 6}, 'array concatenation inside objects');
-
-/* Test two objects with depth and equal keys */
-object1 = {a: {b: [0, 1], c: 'a'}};
-object2 = {a: {b: [2, 3], c: 'b'}};
-result = merge(object1, object2);
-
-assert.deepEqual(result, {a: {b: [0, 1, 2, 3], c: 'b'}}, 'two objects with depth and equal keys');

test/integration/test-fixtures/yarn-lock/node_modules/resize-observer-polyfill/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Denis Rul
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

test/integration/test-fixtures/yarn-lock/node_modules/resize-observer-polyfill/package.json

@@ -0,0 +1,64 @@
+{
+    "name": "@4lolo/resize-observer-polyfill",
+    "author": "Denis Rul <que.etc@gmail.com>",
+    "version": "1.5.2",
+    "description": "A polyfill for the Resize Observer API",
+    "main": "dist/ResizeObserver.js",
+    "module": "dist/ResizeObserver.es.js",
+    "scripts": {
+        "build": "rollup -c && cpy src/index.js.flow dist --rename=ResizeObserver.js.flow",
+        "test": "npm run test:lint && npm run test:spec",
+        "test:ci": "npm run test:lint && npm run test:spec:sauce && npm run test:spec:node",
+        "test:ci:pull": "npm run test:lint && karma start --browsers Firefox && npm run test:spec:node",
+        "test:lint": "node ./node_modules/eslint/bin/eslint.js \"**/*.js\" --ignore-pattern \"/dist/\"",
+        "test:spec": "karma start --browsers Chrome && npm run test:spec:node",
+        "test:spec:sauce": "karma start --sauce=windows && karma start --sauce=linux && karma start --sauce=osx",
+        "test:spec:node": "npm run build && node tests/node/index.js",
+        "test:spec:custom": "karma start --no-browsers",
+        "test:spec:native": "karma start --no-browsers --native"
+    },
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/que-etc/resize-observer-polyfill.git"
+    },
+    "license": "MIT",
+    "bugs": {
+        "url": "https://github.com/que-etc/resize-observer-polyfill/issues"
+    },
+    "types": "src/index.d.ts",
+    "files": [
+        "src/",
+        "dist/"
+    ],
+    "keywords": [
+        "ResizeObserver",
+        "resize",
+        "observer",
+        "util",
+        "client",
+        "browser",
+        "polyfill",
+        "ponyfill"
+    ],
+    "homepage": "https://github.com/que-etc/resize-observer-polyfill",
+    "devDependencies": {
+        "babel-eslint": "10.0.1",
+        "cpy-cli": "2.0.0",
+        "eslint": "5.10.0",
+        "jasmine": "2.8.0",
+        "jasmine-core": "2.8.0",
+        "karma": "3.1.3",
+        "karma-chrome-launcher": "2.2.0",
+        "karma-firefox-launcher": "1.1.0",
+        "karma-jasmine": "1.1.2",
+        "karma-jasmine-html-reporter": "0.2.2",
+        "karma-rollup-preprocessor": "6.1.1",
+        "karma-sauce-launcher": "1.2.0",
+        "karma-sourcemap-loader": "0.3.7",
+        "karma-spec-reporter": "0.0.32",
+        "promise-polyfill": "8.1.0",
+        "rollup": "0.67.4",
+        "rollup-plugin-typescript": "1.0.0",
+        "typescript": "3.2.2"
+    }
+}

test/integration/test-fixtures/yarn-lock/node_modules/semver/LICENSE

@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

test/integration/test-fixtures/yarn-lock/node_modules/semver/README.md

@@ -1,566 +0,0 @@
-semver(1) -- The semantic versioner for npm
-===========================================
-
-## Install
-
-```bash
-npm install semver
-````
-
-## Usage
-
-As a node module:
-
-```js
-const semver = require('semver')
-
-semver.valid('1.2.3') // '1.2.3'
-semver.valid('a.b.c') // null
-semver.clean('  =v1.2.3   ') // '1.2.3'
-semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true
-semver.gt('1.2.3', '9.8.7') // false
-semver.lt('1.2.3', '9.8.7') // true
-semver.minVersion('>=1.0.0') // '1.0.0'
-semver.valid(semver.coerce('v2')) // '2.0.0'
-semver.valid(semver.coerce('42.6.7.9.3-alpha')) // '42.6.7'
-```
-
-You can also just load the module for the function that you care about, if
-you'd like to minimize your footprint.
-
-```js
-// load the whole API at once in a single object
-const semver = require('semver')
-
-// or just load the bits you need
-// all of them listed here, just pick and choose what you want
-
-// classes
-const SemVer = require('semver/classes/semver')
-const Comparator = require('semver/classes/comparator')
-const Range = require('semver/classes/range')
-
-// functions for working with versions
-const semverParse = require('semver/functions/parse')
-const semverValid = require('semver/functions/valid')
-const semverClean = require('semver/functions/clean')
-const semverInc = require('semver/functions/inc')
-const semverDiff = require('semver/functions/diff')
-const semverMajor = require('semver/functions/major')
-const semverMinor = require('semver/functions/minor')
-const semverPatch = require('semver/functions/patch')
-const semverPrerelease = require('semver/functions/prerelease')
-const semverCompare = require('semver/functions/compare')
-const semverRcompare = require('semver/functions/rcompare')
-const semverCompareLoose = require('semver/functions/compare-loose')
-const semverCompareBuild = require('semver/functions/compare-build')
-const semverSort = require('semver/functions/sort')
-const semverRsort = require('semver/functions/rsort')
-
-// low-level comparators between versions
-const semverGt = require('semver/functions/gt')
-const semverLt = require('semver/functions/lt')
-const semverEq = require('semver/functions/eq')
-const semverNeq = require('semver/functions/neq')
-const semverGte = require('semver/functions/gte')
-const semverLte = require('semver/functions/lte')
-const semverCmp = require('semver/functions/cmp')
-const semverCoerce = require('semver/functions/coerce')
-
-// working with ranges
-const semverSatisfies = require('semver/functions/satisfies')
-const semverMaxSatisfying = require('semver/ranges/max-satisfying')
-const semverMinSatisfying = require('semver/ranges/min-satisfying')
-const semverToComparators = require('semver/ranges/to-comparators')
-const semverMinVersion = require('semver/ranges/min-version')
-const semverValidRange = require('semver/ranges/valid')
-const semverOutside = require('semver/ranges/outside')
-const semverGtr = require('semver/ranges/gtr')
-const semverLtr = require('semver/ranges/ltr')
-const semverIntersects = require('semver/ranges/intersects')
-const simplifyRange = require('semver/ranges/simplify')
-const rangeSubset = require('semver/ranges/subset')
-```
-
-As a command-line utility:
-
-```
-$ semver -h
-
-A JavaScript implementation of the https://semver.org/ specification
-Copyright Isaac Z. Schlueter
-
-Usage: semver [options] <version> [<version> [...]]
-Prints valid versions sorted by SemVer precedence
-
-Options:
--r --range <range>
-        Print versions that match the specified range.
-
--i --increment [<level>]
-        Increment a version by the specified level.  Level can
-        be one of: major, minor, patch, premajor, preminor,
-        prepatch, or prerelease.  Default level is 'patch'.
-        Only one version may be specified.
-
---preid <identifier>
-        Identifier to be used to prefix premajor, preminor,
-        prepatch or prerelease version increments.
-
--l --loose
-        Interpret versions and ranges loosely
-
--p --include-prerelease
-        Always include prerelease versions in range matching
-
--c --coerce
-        Coerce a string into SemVer if possible
-        (does not imply --loose)
-
---rtl
-        Coerce version strings right to left
-
---ltr
-        Coerce version strings left to right (default)
-
-Program exits successfully if any valid version satisfies
-all supplied ranges, and prints all satisfying versions.
-
-If no satisfying versions are found, then exits failure.
-
-Versions are printed in ascending order, so supplying
-multiple versions to the utility will just sort them.
-```
-
-## Versions
-
-A "version" is described by the `v2.0.0` specification found at
-<https://semver.org/>.
-
-A leading `"="` or `"v"` character is stripped off and ignored.
-
-## Ranges
-
-A `version range` is a set of `comparators` which specify versions
-that satisfy the range.
-
-A `comparator` is composed of an `operator` and a `version`.  The set
-of primitive `operators` is:
-
-* `<` Less than
-* `<=` Less than or equal to
-* `>` Greater than
-* `>=` Greater than or equal to
-* `=` Equal.  If no operator is specified, then equality is assumed,
-  so this operator is optional, but MAY be included.
-
-For example, the comparator `>=1.2.7` would match the versions
-`1.2.7`, `1.2.8`, `2.5.3`, and `1.3.9`, but not the versions `1.2.6`
-or `1.1.0`.
-
-Comparators can be joined by whitespace to form a `comparator set`,
-which is satisfied by the **intersection** of all of the comparators
-it includes.
-
-A range is composed of one or more comparator sets, joined by `||`.  A
-version matches a range if and only if every comparator in at least
-one of the `||`-separated comparator sets is satisfied by the version.
-
-For example, the range `>=1.2.7 <1.3.0` would match the versions
-`1.2.7`, `1.2.8`, and `1.2.99`, but not the versions `1.2.6`, `1.3.0`,
-or `1.1.0`.
-
-The range `1.2.7 || >=1.2.9 <2.0.0` would match the versions `1.2.7`,
-`1.2.9`, and `1.4.6`, but not the versions `1.2.8` or `2.0.0`.
-
-### Prerelease Tags
-
-If a version has a prerelease tag (for example, `1.2.3-alpha.3`) then
-it will only be allowed to satisfy comparator sets if at least one
-comparator with the same `[major, minor, patch]` tuple also has a
-prerelease tag.
-
-For example, the range `>1.2.3-alpha.3` would be allowed to match the
-version `1.2.3-alpha.7`, but it would *not* be satisfied by
-`3.4.5-alpha.9`, even though `3.4.5-alpha.9` is technically "greater
-than" `1.2.3-alpha.3` according to the SemVer sort rules.  The version
-range only accepts prerelease tags on the `1.2.3` version.  The
-version `3.4.5` *would* satisfy the range, because it does not have a
-prerelease flag, and `3.4.5` is greater than `1.2.3-alpha.7`.
-
-The purpose for this behavior is twofold.  First, prerelease versions
-frequently are updated very quickly, and contain many breaking changes
-that are (by the author's design) not yet fit for public consumption.
-Therefore, by default, they are excluded from range matching
-semantics.
-
-Second, a user who has opted into using a prerelease version has
-clearly indicated the intent to use *that specific* set of
-alpha/beta/rc versions.  By including a prerelease tag in the range,
-the user is indicating that they are aware of the risk.  However, it
-is still not appropriate to assume that they have opted into taking a
-similar risk on the *next* set of prerelease versions.
-
-Note that this behavior can be suppressed (treating all prerelease
-versions as if they were normal versions, for the purpose of range
-matching) by setting the `includePrerelease` flag on the options
-object to any
-[functions](https://github.com/npm/node-semver#functions) that do
-range matching.
-
-#### Prerelease Identifiers
-
-The method `.inc` takes an additional `identifier` string argument that
-will append the value of the string as a prerelease identifier:
-
-```javascript
-semver.inc('1.2.3', 'prerelease', 'beta')
-// '1.2.4-beta.0'
-```
-
-command-line example:
-
-```bash
-$ semver 1.2.3 -i prerelease --preid beta
-1.2.4-beta.0
-```
-
-Which then can be used to increment further:
-
-```bash
-$ semver 1.2.4-beta.0 -i prerelease
-1.2.4-beta.1
-```
-
-### Advanced Range Syntax
-
-Advanced range syntax desugars to primitive comparators in
-deterministic ways.
-
-Advanced ranges may be combined in the same way as primitive
-comparators using white space or `||`.
-
-#### Hyphen Ranges `X.Y.Z - A.B.C`
-
-Specifies an inclusive set.
-
-* `1.2.3 - 2.3.4` := `>=1.2.3 <=2.3.4`
-
-If a partial version is provided as the first version in the inclusive
-range, then the missing pieces are replaced with zeroes.
-
-* `1.2 - 2.3.4` := `>=1.2.0 <=2.3.4`
-
-If a partial version is provided as the second version in the
-inclusive range, then all versions that start with the supplied parts
-of the tuple are accepted, but nothing that would be greater than the
-provided tuple parts.
-
-* `1.2.3 - 2.3` := `>=1.2.3 <2.4.0-0`
-* `1.2.3 - 2` := `>=1.2.3 <3.0.0-0`
-
-#### X-Ranges `1.2.x` `1.X` `1.2.*` `*`
-
-Any of `X`, `x`, or `*` may be used to "stand in" for one of the
-numeric values in the `[major, minor, patch]` tuple.
-
-* `*` := `>=0.0.0` (Any version satisfies)
-* `1.x` := `>=1.0.0 <2.0.0-0` (Matching major version)
-* `1.2.x` := `>=1.2.0 <1.3.0-0` (Matching major and minor versions)
-
-A partial version range is treated as an X-Range, so the special
-character is in fact optional.
-
-* `""` (empty string) := `*` := `>=0.0.0`
-* `1` := `1.x.x` := `>=1.0.0 <2.0.0-0`
-* `1.2` := `1.2.x` := `>=1.2.0 <1.3.0-0`
-
-#### Tilde Ranges `~1.2.3` `~1.2` `~1`
-
-Allows patch-level changes if a minor version is specified on the
-comparator.  Allows minor-level changes if not.
-
-* `~1.2.3` := `>=1.2.3 <1.(2+1).0` := `>=1.2.3 <1.3.0-0`
-* `~1.2` := `>=1.2.0 <1.(2+1).0` := `>=1.2.0 <1.3.0-0` (Same as `1.2.x`)
-* `~1` := `>=1.0.0 <(1+1).0.0` := `>=1.0.0 <2.0.0-0` (Same as `1.x`)
-* `~0.2.3` := `>=0.2.3 <0.(2+1).0` := `>=0.2.3 <0.3.0-0`
-* `~0.2` := `>=0.2.0 <0.(2+1).0` := `>=0.2.0 <0.3.0-0` (Same as `0.2.x`)
-* `~0` := `>=0.0.0 <(0+1).0.0` := `>=0.0.0 <1.0.0-0` (Same as `0.x`)
-* `~1.2.3-beta.2` := `>=1.2.3-beta.2 <1.3.0-0` Note that prereleases in
-  the `1.2.3` version will be allowed, if they are greater than or
-  equal to `beta.2`.  So, `1.2.3-beta.4` would be allowed, but
-  `1.2.4-beta.2` would not, because it is a prerelease of a
-  different `[major, minor, patch]` tuple.
-
-#### Caret Ranges `^1.2.3` `^0.2.5` `^0.0.4`
-
-Allows changes that do not modify the left-most non-zero element in the
-`[major, minor, patch]` tuple.  In other words, this allows patch and
-minor updates for versions `1.0.0` and above, patch updates for
-versions `0.X >=0.1.0`, and *no* updates for versions `0.0.X`.
-
-Many authors treat a `0.x` version as if the `x` were the major
-"breaking-change" indicator.
-
-Caret ranges are ideal when an author may make breaking changes
-between `0.2.4` and `0.3.0` releases, which is a common practice.
-However, it presumes that there will *not* be breaking changes between
-`0.2.4` and `0.2.5`.  It allows for changes that are presumed to be
-additive (but non-breaking), according to commonly observed practices.
-
-* `^1.2.3` := `>=1.2.3 <2.0.0-0`
-* `^0.2.3` := `>=0.2.3 <0.3.0-0`
-* `^0.0.3` := `>=0.0.3 <0.0.4-0`
-* `^1.2.3-beta.2` := `>=1.2.3-beta.2 <2.0.0-0` Note that prereleases in
-  the `1.2.3` version will be allowed, if they are greater than or
-  equal to `beta.2`.  So, `1.2.3-beta.4` would be allowed, but
-  `1.2.4-beta.2` would not, because it is a prerelease of a
-  different `[major, minor, patch]` tuple.
-* `^0.0.3-beta` := `>=0.0.3-beta <0.0.4-0`  Note that prereleases in the
-  `0.0.3` version *only* will be allowed, if they are greater than or
-  equal to `beta`.  So, `0.0.3-pr.2` would be allowed.
-
-When parsing caret ranges, a missing `patch` value desugars to the
-number `0`, but will allow flexibility within that value, even if the
-major and minor versions are both `0`.
-
-* `^1.2.x` := `>=1.2.0 <2.0.0-0`
-* `^0.0.x` := `>=0.0.0 <0.1.0-0`
-* `^0.0` := `>=0.0.0 <0.1.0-0`
-
-A missing `minor` and `patch` values will desugar to zero, but also
-allow flexibility within those values, even if the major version is
-zero.
-
-* `^1.x` := `>=1.0.0 <2.0.0-0`
-* `^0.x` := `>=0.0.0 <1.0.0-0`
-
-### Range Grammar
-
-Putting all this together, here is a Backus-Naur grammar for ranges,
-for the benefit of parser authors:
-
-```bnf
-range-set  ::= range ( logical-or range ) *
-logical-or ::= ( ' ' ) * '||' ( ' ' ) *
-range      ::= hyphen | simple ( ' ' simple ) * | ''
-hyphen     ::= partial ' - ' partial
-simple     ::= primitive | partial | tilde | caret
-primitive  ::= ( '<' | '>' | '>=' | '<=' | '=' ) partial
-partial    ::= xr ( '.' xr ( '.' xr qualifier ? )? )?
-xr         ::= 'x' | 'X' | '*' | nr
-nr         ::= '0' | ['1'-'9'] ( ['0'-'9'] ) *
-tilde      ::= '~' partial
-caret      ::= '^' partial
-qualifier  ::= ( '-' pre )? ( '+' build )?
-pre        ::= parts
-build      ::= parts
-parts      ::= part ( '.' part ) *
-part       ::= nr | [-0-9A-Za-z]+
-```
-
-## Functions
-
-All methods and classes take a final `options` object argument.  All
-options in this object are `false` by default.  The options supported
-are:
-
-- `loose`  Be more forgiving about not-quite-valid semver strings.
-  (Any resulting output will always be 100% strict compliant, of
-  course.)  For backwards compatibility reasons, if the `options`
-  argument is a boolean value instead of an object, it is interpreted
-  to be the `loose` param.
-- `includePrerelease`  Set to suppress the [default
-  behavior](https://github.com/npm/node-semver#prerelease-tags) of
-  excluding prerelease tagged versions from ranges unless they are
-  explicitly opted into.
-
-Strict-mode Comparators and Ranges will be strict about the SemVer
-strings that they parse.
-
-* `valid(v)`: Return the parsed version, or null if it's not valid.
-* `inc(v, release)`: Return the version incremented by the release
-  type (`major`,   `premajor`, `minor`, `preminor`, `patch`,
-  `prepatch`, or `prerelease`), or null if it's not valid
-  * `premajor` in one call will bump the version up to the next major
-    version and down to a prerelease of that major version.
-    `preminor`, and `prepatch` work the same way.
-  * If called from a non-prerelease version, the `prerelease` will work the
-    same as `prepatch`. It increments the patch version, then makes a
-    prerelease. If the input version is already a prerelease it simply
-    increments it.
-* `prerelease(v)`: Returns an array of prerelease components, or null
-  if none exist. Example: `prerelease('1.2.3-alpha.1') -> ['alpha', 1]`
-* `major(v)`: Return the major version number.
-* `minor(v)`: Return the minor version number.
-* `patch(v)`: Return the patch version number.
-* `intersects(r1, r2, loose)`: Return true if the two supplied ranges
-  or comparators intersect.
-* `parse(v)`: Attempt to parse a string as a semantic version, returning either
-  a `SemVer` object or `null`.
-
-### Comparison
-
-* `gt(v1, v2)`: `v1 > v2`
-* `gte(v1, v2)`: `v1 >= v2`
-* `lt(v1, v2)`: `v1 < v2`
-* `lte(v1, v2)`: `v1 <= v2`
-* `eq(v1, v2)`: `v1 == v2` This is true if they're logically equivalent,
-  even if they're not the exact same string.  You already know how to
-  compare strings.
-* `neq(v1, v2)`: `v1 != v2` The opposite of `eq`.
-* `cmp(v1, comparator, v2)`: Pass in a comparison string, and it'll call
-  the corresponding function above.  `"==="` and `"!=="` do simple
-  string comparison, but are included for completeness.  Throws if an
-  invalid comparison string is provided.
-* `compare(v1, v2)`: Return `0` if `v1 == v2`, or `1` if `v1` is greater, or `-1` if
-  `v2` is greater.  Sorts in ascending order if passed to `Array.sort()`.
-* `rcompare(v1, v2)`: The reverse of compare.  Sorts an array of versions
-  in descending order when passed to `Array.sort()`.
-* `compareBuild(v1, v2)`: The same as `compare` but considers `build` when two versions
-  are equal.  Sorts in ascending order if passed to `Array.sort()`.
-  `v2` is greater.  Sorts in ascending order if passed to `Array.sort()`.
-* `diff(v1, v2)`: Returns difference between two versions by the release type
-  (`major`, `premajor`, `minor`, `preminor`, `patch`, `prepatch`, or `prerelease`),
-  or null if the versions are the same.
-
-### Comparators
-
-* `intersects(comparator)`: Return true if the comparators intersect
-
-### Ranges
-
-* `validRange(range)`: Return the valid range or null if it's not valid
-* `satisfies(version, range)`: Return true if the version satisfies the
-  range.
-* `maxSatisfying(versions, range)`: Return the highest version in the list
-  that satisfies the range, or `null` if none of them do.
-* `minSatisfying(versions, range)`: Return the lowest version in the list
-  that satisfies the range, or `null` if none of them do.
-* `minVersion(range)`: Return the lowest version that can possibly match
-  the given range.
-* `gtr(version, range)`: Return `true` if version is greater than all the
-  versions possible in the range.
-* `ltr(version, range)`: Return `true` if version is less than all the
-  versions possible in the range.
-* `outside(version, range, hilo)`: Return true if the version is outside
-  the bounds of the range in either the high or low direction.  The
-  `hilo` argument must be either the string `'>'` or `'<'`.  (This is
-  the function called by `gtr` and `ltr`.)
-* `intersects(range)`: Return true if any of the ranges comparators intersect
-* `simplifyRange(versions, range)`: Return a "simplified" range that
-  matches the same items in `versions` list as the range specified.  Note
-  that it does *not* guarantee that it would match the same versions in all
-  cases, only for the set of versions provided.  This is useful when
-  generating ranges by joining together multiple versions with `||`
-  programmatically, to provide the user with something a bit more
-  ergonomic.  If the provided range is shorter in string-length than the
-  generated range, then that is returned.
-* `subset(subRange, superRange)`: Return `true` if the `subRange` range is
-  entirely contained by the `superRange` range.
-
-Note that, since ranges may be non-contiguous, a version might not be
-greater than a range, less than a range, *or* satisfy a range!  For
-example, the range `1.2 <1.2.9 || >2.0.0` would have a hole from `1.2.9`
-until `2.0.0`, so the version `1.2.10` would not be greater than the
-range (because `2.0.1` satisfies, which is higher), nor less than the
-range (since `1.2.8` satisfies, which is lower), and it also does not
-satisfy the range.
-
-If you want to know if a version satisfies or does not satisfy a
-range, use the `satisfies(version, range)` function.
-
-### Coercion
-
-* `coerce(version, options)`: Coerces a string to semver if possible
-
-This aims to provide a very forgiving translation of a non-semver string to
-semver. It looks for the first digit in a string, and consumes all
-remaining characters which satisfy at least a partial semver (e.g., `1`,
-`1.2`, `1.2.3`) up to the max permitted length (256 characters).  Longer
-versions are simply truncated (`4.6.3.9.2-alpha2` becomes `4.6.3`).  All
-surrounding text is simply ignored (`v3.4 replaces v3.3.1` becomes
-`3.4.0`).  Only text which lacks digits will fail coercion (`version one`
-is not valid).  The maximum  length for any semver component considered for
-coercion is 16 characters; longer components will be ignored
-(`10000000000000000.4.7.4` becomes `4.7.4`).  The maximum value for any
-semver component is `Number.MAX_SAFE_INTEGER || (2**53 - 1)`; higher value
-components are invalid (`9999999999999999.4.7.4` is likely invalid).
-
-If the `options.rtl` flag is set, then `coerce` will return the right-most
-coercible tuple that does not share an ending index with a longer coercible
-tuple.  For example, `1.2.3.4` will return `2.3.4` in rtl mode, not
-`4.0.0`.  `1.2.3/4` will return `4.0.0`, because the `4` is not a part of
-any other overlapping SemVer tuple.
-
-### Clean
-
-* `clean(version)`: Clean a string to be a valid semver if possible
-
-This will return a cleaned and trimmed semver version. If the provided
-version is not valid a null will be returned. This does not work for
-ranges.
-
-ex.
-* `s.clean(' = v 2.1.5foo')`: `null`
-* `s.clean(' = v 2.1.5foo', { loose: true })`: `'2.1.5-foo'`
-* `s.clean(' = v 2.1.5-foo')`: `null`
-* `s.clean(' = v 2.1.5-foo', { loose: true })`: `'2.1.5-foo'`
-* `s.clean('=v2.1.5')`: `'2.1.5'`
-* `s.clean('  =v2.1.5')`: `2.1.5`
-* `s.clean('      2.1.5   ')`: `'2.1.5'`
-* `s.clean('~1.0.0')`: `null`
-
-## Exported Modules
-
-<!--
-TODO: Make sure that all of these items are documented (classes aren't,
-eg), and then pull the module name into the documentation for that specific
-thing.
--->
-
-You may pull in just the part of this semver utility that you need, if you
-are sensitive to packing and tree-shaking concerns.  The main
-`require('semver')` export uses getter functions to lazily load the parts
-of the API that are used.
-
-The following modules are available:
-
-* `require('semver')`
-* `require('semver/classes')`
-* `require('semver/classes/comparator')`
-* `require('semver/classes/range')`
-* `require('semver/classes/semver')`
-* `require('semver/functions/clean')`
-* `require('semver/functions/cmp')`
-* `require('semver/functions/coerce')`
-* `require('semver/functions/compare')`
-* `require('semver/functions/compare-build')`
-* `require('semver/functions/compare-loose')`
-* `require('semver/functions/diff')`
-* `require('semver/functions/eq')`
-* `require('semver/functions/gt')`
-* `require('semver/functions/gte')`
-* `require('semver/functions/inc')`
-* `require('semver/functions/lt')`
-* `require('semver/functions/lte')`
-* `require('semver/functions/major')`
-* `require('semver/functions/minor')`
-* `require('semver/functions/neq')`
-* `require('semver/functions/parse')`
-* `require('semver/functions/patch')`
-* `require('semver/functions/prerelease')`
-* `require('semver/functions/rcompare')`
-* `require('semver/functions/rsort')`
-* `require('semver/functions/satisfies')`
-* `require('semver/functions/sort')`
-* `require('semver/functions/valid')`
-* `require('semver/ranges/gtr')`
-* `require('semver/ranges/intersects')`
-* `require('semver/ranges/ltr')`
-* `require('semver/ranges/max-satisfying')`
-* `require('semver/ranges/min-satisfying')`
-* `require('semver/ranges/min-version')`
-* `require('semver/ranges/outside')`
-* `require('semver/ranges/to-comparators')`
-* `require('semver/ranges/valid')`

test/integration/test-fixtures/yarn-lock/node_modules/semver/bin/semver.js

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-// Standalone semver comparison program.
-// Exits successfully and prints matching version(s) if
-// any supplied version is valid and passes all tests.
-
-const argv = process.argv.slice(2)
-
-let versions = []
-
-const range = []
-
-let inc = null
-
-const version = require('../package.json').version
-
-let loose = false
-
-let includePrerelease = false
-
-let coerce = false
-
-let rtl = false
-
-let identifier
-
-const semver = require('../')
-
-let reverse = false
-
-const options = {}
-
-const main = () => {
-  if (!argv.length) return help()
-  while (argv.length) {
-    let a = argv.shift()
-    const indexOfEqualSign = a.indexOf('=')
-    if (indexOfEqualSign !== -1) {
-      a = a.slice(0, indexOfEqualSign)
-      argv.unshift(a.slice(indexOfEqualSign + 1))
-    }
-    switch (a) {
-      case '-rv': case '-rev': case '--rev': case '--reverse':
-        reverse = true
-        break
-      case '-l': case '--loose':
-        loose = true
-        break
-      case '-p': case '--include-prerelease':
-        includePrerelease = true
-        break
-      case '-v': case '--version':
-        versions.push(argv.shift())
-        break
-      case '-i': case '--inc': case '--increment':
-        switch (argv[0]) {
-          case 'major': case 'minor': case 'patch': case 'prerelease':
-          case 'premajor': case 'preminor': case 'prepatch':
-            inc = argv.shift()
-            break
-          default:
-            inc = 'patch'
-            break
-        }
-        break
-      case '--preid':
-        identifier = argv.shift()
-        break
-      case '-r': case '--range':
-        range.push(argv.shift())
-        break
-      case '-c': case '--coerce':
-        coerce = true
-        break
-      case '--rtl':
-        rtl = true
-        break
-      case '--ltr':
-        rtl = false
-        break
-      case '-h': case '--help': case '-?':
-        return help()
-      default:
-        versions.push(a)
-        break
-    }
-  }
-
-  const options = { loose: loose, includePrerelease: includePrerelease, rtl: rtl }
-
-  versions = versions.map((v) => {
-    return coerce ? (semver.coerce(v, options) || { version: v }).version : v
-  }).filter((v) => {
-    return semver.valid(v)
-  })
-  if (!versions.length) return fail()
-  if (inc && (versions.length !== 1 || range.length)) { return failInc() }
-
-  for (let i = 0, l = range.length; i < l; i++) {
-    versions = versions.filter((v) => {
-      return semver.satisfies(v, range[i], options)
-    })
-    if (!versions.length) return fail()
-  }
-  return success(versions)
-}
-
-
-const failInc = () => {
-  console.error('--inc can only be used on a single version with no range')
-  fail()
-}
-
-const fail = () => process.exit(1)
-
-const success = () => {
-  const compare = reverse ? 'rcompare' : 'compare'
-  versions.sort((a, b) => {
-    return semver[compare](a, b, options)
-  }).map((v) => {
-    return semver.clean(v, options)
-  }).map((v) => {
-    return inc ? semver.inc(v, inc, options, identifier) : v
-  }).forEach((v, i, _) => { console.log(v) })
-}
-
-const help = () => console.log(
-`SemVer ${version}
-
-A JavaScript implementation of the https://semver.org/ specification
-Copyright Isaac Z. Schlueter
-
-Usage: semver [options] <version> [<version> [...]]
-Prints valid versions sorted by SemVer precedence
-
-Options:
--r --range <range>
-        Print versions that match the specified range.
-
--i --increment [<level>]
-        Increment a version by the specified level.  Level can
-        be one of: major, minor, patch, premajor, preminor,
-        prepatch, or prerelease.  Default level is 'patch'.
-        Only one version may be specified.
-
---preid <identifier>
-        Identifier to be used to prefix premajor, preminor,
-        prepatch or prerelease version increments.
-
--l --loose
-        Interpret versions and ranges loosely
-
--p --include-prerelease
-        Always include prerelease versions in range matching
-
--c --coerce
-        Coerce a string into SemVer if possible
-        (does not imply --loose)
-
---rtl
-        Coerce version strings right to left
-
---ltr
-        Coerce version strings left to right (default)
-
-Program exits successfully if any valid version satisfies
-all supplied ranges, and prints all satisfying versions.
-
-If no satisfying versions are found, then exits failure.
-
-Versions are printed in ascending order, so supplying
-multiple versions to the utility will just sort them.`)
-
-main()

test/integration/test-fixtures/yarn-lock/node_modules/semver/classes/comparator.js

@@ -1,135 +0,0 @@
-const ANY = Symbol('SemVer ANY')
-// hoisted class for cyclic dependency
-class Comparator {
-  static get ANY () {
-    return ANY
-  }
-  constructor (comp, options) {
-    options = parseOptions(options)
-
-    if (comp instanceof Comparator) {
-      if (comp.loose === !!options.loose) {
-        return comp
-      } else {
-        comp = comp.value
-      }
-    }
-
-    debug('comparator', comp, options)
-    this.options = options
-    this.loose = !!options.loose
-    this.parse(comp)
-
-    if (this.semver === ANY) {
-      this.value = ''
-    } else {
-      this.value = this.operator + this.semver.version
-    }
-
-    debug('comp', this)
-  }
-
-  parse (comp) {
-    const r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
-    const m = comp.match(r)
-
-    if (!m) {
-      throw new TypeError(`Invalid comparator: ${comp}`)
-    }
-
-    this.operator = m[1] !== undefined ? m[1] : ''
-    if (this.operator === '=') {
-      this.operator = ''
-    }
-
-    // if it literally is just '>' or '' then allow anything.
-    if (!m[2]) {
-      this.semver = ANY
-    } else {
-      this.semver = new SemVer(m[2], this.options.loose)
-    }
-  }
-
-  toString () {
-    return this.value
-  }
-
-  test (version) {
-    debug('Comparator.test', version, this.options.loose)
-
-    if (this.semver === ANY || version === ANY) {
-      return true
-    }
-
-    if (typeof version === 'string') {
-      try {
-        version = new SemVer(version, this.options)
-      } catch (er) {
-        return false
-      }
-    }
-
-    return cmp(version, this.operator, this.semver, this.options)
-  }
-
-  intersects (comp, options) {
-    if (!(comp instanceof Comparator)) {
-      throw new TypeError('a Comparator is required')
-    }
-
-    if (!options || typeof options !== 'object') {
-      options = {
-        loose: !!options,
-        includePrerelease: false
-      }
-    }
-
-    if (this.operator === '') {
-      if (this.value === '') {
-        return true
-      }
-      return new Range(comp.value, options).test(this.value)
-    } else if (comp.operator === '') {
-      if (comp.value === '') {
-        return true
-      }
-      return new Range(this.value, options).test(comp.semver)
-    }
-
-    const sameDirectionIncreasing =
-      (this.operator === '>=' || this.operator === '>') &&
-      (comp.operator === '>=' || comp.operator === '>')
-    const sameDirectionDecreasing =
-      (this.operator === '<=' || this.operator === '<') &&
-      (comp.operator === '<=' || comp.operator === '<')
-    const sameSemVer = this.semver.version === comp.semver.version
-    const differentDirectionsInclusive =
-      (this.operator === '>=' || this.operator === '<=') &&
-      (comp.operator === '>=' || comp.operator === '<=')
-    const oppositeDirectionsLessThan =
-      cmp(this.semver, '<', comp.semver, options) &&
-      (this.operator === '>=' || this.operator === '>') &&
-        (comp.operator === '<=' || comp.operator === '<')
-    const oppositeDirectionsGreaterThan =
-      cmp(this.semver, '>', comp.semver, options) &&
-      (this.operator === '<=' || this.operator === '<') &&
-        (comp.operator === '>=' || comp.operator === '>')
-
-    return (
-      sameDirectionIncreasing ||
-      sameDirectionDecreasing ||
-      (sameSemVer && differentDirectionsInclusive) ||
-      oppositeDirectionsLessThan ||
-      oppositeDirectionsGreaterThan
-    )
-  }
-}
-
-module.exports = Comparator
-
-const parseOptions = require('../internal/parse-options')
-const {re, t} = require('../internal/re')
-const cmp = require('../functions/cmp')
-const debug = require('../internal/debug')
-const SemVer = require('./semver')
-const Range = require('./range')

test/integration/test-fixtures/yarn-lock/node_modules/semver/classes/index.js

@@ -1,5 +0,0 @@
-module.exports = {
-  SemVer: require('./semver.js'),
-  Range: require('./range.js'),
-  Comparator: require('./comparator.js')
-}

test/integration/test-fixtures/yarn-lock/node_modules/semver/classes/range.js

@@ -1,510 +0,0 @@
-// hoisted class for cyclic dependency
-class Range {
-  constructor (range, options) {
-    options = parseOptions(options)
-
-    if (range instanceof Range) {
-      if (
-        range.loose === !!options.loose &&
-        range.includePrerelease === !!options.includePrerelease
-      ) {
-        return range
-      } else {
-        return new Range(range.raw, options)
-      }
-    }
-
-    if (range instanceof Comparator) {
-      // just put it in the set and return
-      this.raw = range.value
-      this.set = [[range]]
-      this.format()
-      return this
-    }
-
-    this.options = options
-    this.loose = !!options.loose
-    this.includePrerelease = !!options.includePrerelease
-
-    // First, split based on boolean or ||
-    this.raw = range
-    this.set = range
-      .split(/\s*\|\|\s*/)
-      // map the range to a 2d array of comparators
-      .map(range => this.parseRange(range.trim()))
-      // throw out any comparator lists that are empty
-      // this generally means that it was not a valid range, which is allowed
-      // in loose mode, but will still throw if the WHOLE range is invalid.
-      .filter(c => c.length)
-
-    if (!this.set.length) {
-      throw new TypeError(`Invalid SemVer Range: ${range}`)
-    }
-
-    // if we have any that are not the null set, throw out null sets.
-    if (this.set.length > 1) {
-      // keep the first one, in case they're all null sets
-      const first = this.set[0]
-      this.set = this.set.filter(c => !isNullSet(c[0]))
-      if (this.set.length === 0)
-        this.set = [first]
-      else if (this.set.length > 1) {
-        // if we have any that are *, then the range is just *
-        for (const c of this.set) {
-          if (c.length === 1 && isAny(c[0])) {
-            this.set = [c]
-            break
-          }
-        }
-      }
-    }
-
-    this.format()
-  }
-
-  format () {
-    this.range = this.set
-      .map((comps) => {
-        return comps.join(' ').trim()
-      })
-      .join('||')
-      .trim()
-    return this.range
-  }
-
-  toString () {
-    return this.range
-  }
-
-  parseRange (range) {
-    range = range.trim()
-
-    // memoize range parsing for performance.
-    // this is a very hot path, and fully deterministic.
-    const memoOpts = Object.keys(this.options).join(',')
-    const memoKey = `parseRange:${memoOpts}:${range}`
-    const cached = cache.get(memoKey)
-    if (cached)
-      return cached
-
-    const loose = this.options.loose
-    // `1.2.3 - 1.2.4` => `>=1.2.3 <=1.2.4`
-    const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
-    range = range.replace(hr, hyphenReplace(this.options.includePrerelease))
-    debug('hyphen replace', range)
-    // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
-    range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
-    debug('comparator trim', range, re[t.COMPARATORTRIM])
-
-    // `~ 1.2.3` => `~1.2.3`
-    range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
-
-    // `^ 1.2.3` => `^1.2.3`
-    range = range.replace(re[t.CARETTRIM], caretTrimReplace)
-
-    // normalize spaces
-    range = range.split(/\s+/).join(' ')
-
-    // At this point, the range is completely trimmed and
-    // ready to be split into comparators.
-
-    const compRe = loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
-    const rangeList = range
-      .split(' ')
-      .map(comp => parseComparator(comp, this.options))
-      .join(' ')
-      .split(/\s+/)
-      // >=0.0.0 is equivalent to *
-      .map(comp => replaceGTE0(comp, this.options))
-      // in loose mode, throw out any that are not valid comparators
-      .filter(this.options.loose ? comp => !!comp.match(compRe) : () => true)
-      .map(comp => new Comparator(comp, this.options))
-
-    // if any comparators are the null set, then replace with JUST null set
-    // if more than one comparator, remove any * comparators
-    // also, don't include the same comparator more than once
-    const l = rangeList.length
-    const rangeMap = new Map()
-    for (const comp of rangeList) {
-      if (isNullSet(comp))
-        return [comp]
-      rangeMap.set(comp.value, comp)
-    }
-    if (rangeMap.size > 1 && rangeMap.has(''))
-      rangeMap.delete('')
-
-    const result = [...rangeMap.values()]
-    cache.set(memoKey, result)
-    return result
-  }
-
-  intersects (range, options) {
-    if (!(range instanceof Range)) {
-      throw new TypeError('a Range is required')
-    }
-
-    return this.set.some((thisComparators) => {
-      return (
-        isSatisfiable(thisComparators, options) &&
-        range.set.some((rangeComparators) => {
-          return (
-            isSatisfiable(rangeComparators, options) &&
-            thisComparators.every((thisComparator) => {
-              return rangeComparators.every((rangeComparator) => {
-                return thisComparator.intersects(rangeComparator, options)
-              })
-            })
-          )
-        })
-      )
-    })
-  }
-
-  // if ANY of the sets match ALL of its comparators, then pass
-  test (version) {
-    if (!version) {
-      return false
-    }
-
-    if (typeof version === 'string') {
-      try {
-        version = new SemVer(version, this.options)
-      } catch (er) {
-        return false
-      }
-    }
-
-    for (let i = 0; i < this.set.length; i++) {
-      if (testSet(this.set[i], version, this.options)) {
-        return true
-      }
-    }
-    return false
-  }
-}
-module.exports = Range
-
-const LRU = require('lru-cache')
-const cache = new LRU({ max: 1000 })
-
-const parseOptions = require('../internal/parse-options')
-const Comparator = require('./comparator')
-const debug = require('../internal/debug')
-const SemVer = require('./semver')
-const {
-  re,
-  t,
-  comparatorTrimReplace,
-  tildeTrimReplace,
-  caretTrimReplace
-} = require('../internal/re')
-
-const isNullSet = c => c.value === '<0.0.0-0'
-const isAny = c => c.value === ''
-
-// take a set of comparators and determine whether there
-// exists a version which can satisfy it
-const isSatisfiable = (comparators, options) => {
-  let result = true
-  const remainingComparators = comparators.slice()
-  let testComparator = remainingComparators.pop()
-
-  while (result && remainingComparators.length) {
-    result = remainingComparators.every((otherComparator) => {
-      return testComparator.intersects(otherComparator, options)
-    })
-
-    testComparator = remainingComparators.pop()
-  }
-
-  return result
-}
-
-// comprised of xranges, tildes, stars, and gtlt's at this point.
-// already replaced the hyphen ranges
-// turn into a set of JUST comparators.
-const parseComparator = (comp, options) => {
-  debug('comp', comp, options)
-  comp = replaceCarets(comp, options)
-  debug('caret', comp)
-  comp = replaceTildes(comp, options)
-  debug('tildes', comp)
-  comp = replaceXRanges(comp, options)
-  debug('xrange', comp)
-  comp = replaceStars(comp, options)
-  debug('stars', comp)
-  return comp
-}
-
-const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
-
-// ~, ~> --> * (any, kinda silly)
-// ~2, ~2.x, ~2.x.x, ~>2, ~>2.x ~>2.x.x --> >=2.0.0 <3.0.0-0
-// ~2.0, ~2.0.x, ~>2.0, ~>2.0.x --> >=2.0.0 <2.1.0-0
-// ~1.2, ~1.2.x, ~>1.2, ~>1.2.x --> >=1.2.0 <1.3.0-0
-// ~1.2.3, ~>1.2.3 --> >=1.2.3 <1.3.0-0
-// ~1.2.0, ~>1.2.0 --> >=1.2.0 <1.3.0-0
-const replaceTildes = (comp, options) =>
-  comp.trim().split(/\s+/).map((comp) => {
-    return replaceTilde(comp, options)
-  }).join(' ')
-
-const replaceTilde = (comp, options) => {
-  const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
-  return comp.replace(r, (_, M, m, p, pr) => {
-    debug('tilde', comp, _, M, m, p, pr)
-    let ret
-
-    if (isX(M)) {
-      ret = ''
-    } else if (isX(m)) {
-      ret = `>=${M}.0.0 <${+M + 1}.0.0-0`
-    } else if (isX(p)) {
-      // ~1.2 == >=1.2.0 <1.3.0-0
-      ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`
-    } else if (pr) {
-      debug('replaceTilde pr', pr)
-      ret = `>=${M}.${m}.${p}-${pr
-      } <${M}.${+m + 1}.0-0`
-    } else {
-      // ~1.2.3 == >=1.2.3 <1.3.0-0
-      ret = `>=${M}.${m}.${p
-      } <${M}.${+m + 1}.0-0`
-    }
-
-    debug('tilde return', ret)
-    return ret
-  })
-}
-
-// ^ --> * (any, kinda silly)
-// ^2, ^2.x, ^2.x.x --> >=2.0.0 <3.0.0-0
-// ^2.0, ^2.0.x --> >=2.0.0 <3.0.0-0
-// ^1.2, ^1.2.x --> >=1.2.0 <2.0.0-0
-// ^1.2.3 --> >=1.2.3 <2.0.0-0
-// ^1.2.0 --> >=1.2.0 <2.0.0-0
-const replaceCarets = (comp, options) =>
-  comp.trim().split(/\s+/).map((comp) => {
-    return replaceCaret(comp, options)
-  }).join(' ')
-
-const replaceCaret = (comp, options) => {
-  debug('caret', comp, options)
-  const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET]
-  const z = options.includePrerelease ? '-0' : ''
-  return comp.replace(r, (_, M, m, p, pr) => {
-    debug('caret', comp, _, M, m, p, pr)
-    let ret
-
-    if (isX(M)) {
-      ret = ''
-    } else if (isX(m)) {
-      ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`
-    } else if (isX(p)) {
-      if (M === '0') {
-        ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`
-      } else {
-        ret = `>=${M}.${m}.0${z} <${+M + 1}.0.0-0`
-      }
-    } else if (pr) {
-      debug('replaceCaret pr', pr)
-      if (M === '0') {
-        if (m === '0') {
-          ret = `>=${M}.${m}.${p}-${pr
-          } <${M}.${m}.${+p + 1}-0`
-        } else {
-          ret = `>=${M}.${m}.${p}-${pr
-          } <${M}.${+m + 1}.0-0`
-        }
-      } else {
-        ret = `>=${M}.${m}.${p}-${pr
-        } <${+M + 1}.0.0-0`
-      }
-    } else {
-      debug('no pr')
-      if (M === '0') {
-        if (m === '0') {
-          ret = `>=${M}.${m}.${p
-          }${z} <${M}.${m}.${+p + 1}-0`
-        } else {
-          ret = `>=${M}.${m}.${p
-          }${z} <${M}.${+m + 1}.0-0`
-        }
-      } else {
-        ret = `>=${M}.${m}.${p
-        } <${+M + 1}.0.0-0`
-      }
-    }
-
-    debug('caret return', ret)
-    return ret
-  })
-}
-
-const replaceXRanges = (comp, options) => {
-  debug('replaceXRanges', comp, options)
-  return comp.split(/\s+/).map((comp) => {
-    return replaceXRange(comp, options)
-  }).join(' ')
-}
-
-const replaceXRange = (comp, options) => {
-  comp = comp.trim()
-  const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
-  return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
-    debug('xRange', comp, ret, gtlt, M, m, p, pr)
-    const xM = isX(M)
-    const xm = xM || isX(m)
-    const xp = xm || isX(p)
-    const anyX = xp
-
-    if (gtlt === '=' && anyX) {
-      gtlt = ''
-    }
-
-    // if we're including prereleases in the match, then we need
-    // to fix this to -0, the lowest possible prerelease value
-    pr = options.includePrerelease ? '-0' : ''
-
-    if (xM) {
-      if (gtlt === '>' || gtlt === '<') {
-        // nothing is allowed
-        ret = '<0.0.0-0'
-      } else {
-        // nothing is forbidden
-        ret = '*'
-      }
-    } else if (gtlt && anyX) {
-      // we know patch is an x, because we have any x at all.
-      // replace X with 0
-      if (xm) {
-        m = 0
-      }
-      p = 0
-
-      if (gtlt === '>') {
-        // >1 => >=2.0.0
-        // >1.2 => >=1.3.0
-        gtlt = '>='
-        if (xm) {
-          M = +M + 1
-          m = 0
-          p = 0
-        } else {
-          m = +m + 1
-          p = 0
-        }
-      } else if (gtlt === '<=') {
-        // <=0.7.x is actually <0.8.0, since any 0.7.x should
-        // pass.  Similarly, <=7.x is actually <8.0.0, etc.
-        gtlt = '<'
-        if (xm) {
-          M = +M + 1
-        } else {
-          m = +m + 1
-        }
-      }
-
-      if (gtlt === '<')
-        pr = '-0'
-
-      ret = `${gtlt + M}.${m}.${p}${pr}`
-    } else if (xm) {
-      ret = `>=${M}.0.0${pr} <${+M + 1}.0.0-0`
-    } else if (xp) {
-      ret = `>=${M}.${m}.0${pr
-      } <${M}.${+m + 1}.0-0`
-    }
-
-    debug('xRange return', ret)
-
-    return ret
-  })
-}
-
-// Because * is AND-ed with everything else in the comparator,
-// and '' means "any version", just remove the *s entirely.
-const replaceStars = (comp, options) => {
-  debug('replaceStars', comp, options)
-  // Looseness is ignored here.  star is always as loose as it gets!
-  return comp.trim().replace(re[t.STAR], '')
-}
-
-const replaceGTE0 = (comp, options) => {
-  debug('replaceGTE0', comp, options)
-  return comp.trim()
-    .replace(re[options.includePrerelease ? t.GTE0PRE : t.GTE0], '')
-}
-
-// This function is passed to string.replace(re[t.HYPHENRANGE])
-// M, m, patch, prerelease, build
-// 1.2 - 3.4.5 => >=1.2.0 <=3.4.5
-// 1.2.3 - 3.4 => >=1.2.0 <3.5.0-0 Any 3.4.x will do
-// 1.2 - 3.4 => >=1.2.0 <3.5.0-0
-const hyphenReplace = incPr => ($0,
-  from, fM, fm, fp, fpr, fb,
-  to, tM, tm, tp, tpr, tb) => {
-  if (isX(fM)) {
-    from = ''
-  } else if (isX(fm)) {
-    from = `>=${fM}.0.0${incPr ? '-0' : ''}`
-  } else if (isX(fp)) {
-    from = `>=${fM}.${fm}.0${incPr ? '-0' : ''}`
-  } else if (fpr) {
-    from = `>=${from}`
-  } else {
-    from = `>=${from}${incPr ? '-0' : ''}`
-  }
-
-  if (isX(tM)) {
-    to = ''
-  } else if (isX(tm)) {
-    to = `<${+tM + 1}.0.0-0`
-  } else if (isX(tp)) {
-    to = `<${tM}.${+tm + 1}.0-0`
-  } else if (tpr) {
-    to = `<=${tM}.${tm}.${tp}-${tpr}`
-  } else if (incPr) {
-    to = `<${tM}.${tm}.${+tp + 1}-0`
-  } else {
-    to = `<=${to}`
-  }
-
-  return (`${from} ${to}`).trim()
-}
-
-const testSet = (set, version, options) => {
-  for (let i = 0; i < set.length; i++) {
-    if (!set[i].test(version)) {
-      return false
-    }
-  }
-
-  if (version.prerelease.length && !options.includePrerelease) {
-    // Find the set of versions that are allowed to have prereleases
-    // For example, ^1.2.3-pr.1 desugars to >=1.2.3-pr.1 <2.0.0
-    // That should allow `1.2.3-pr.2` to pass.
-    // However, `1.2.4-alpha.notready` should NOT be allowed,
-    // even though it's within the range set by the comparators.
-    for (let i = 0; i < set.length; i++) {
-      debug(set[i].semver)
-      if (set[i].semver === Comparator.ANY) {
-        continue
-      }
-
-      if (set[i].semver.prerelease.length > 0) {
-        const allowed = set[i].semver
-        if (allowed.major === version.major &&
-            allowed.minor === version.minor &&
-            allowed.patch === version.patch) {
-          return true
-        }
-      }
-    }
-
-    // Version has a -pre, but it's not one of the ones we like.
-    return false
-  }
-
-  return true
-}

test/integration/test-fixtures/yarn-lock/node_modules/semver/classes/semver.js

@@ -1,287 +0,0 @@
-const debug = require('../internal/debug')
-const { MAX_LENGTH, MAX_SAFE_INTEGER } = require('../internal/constants')
-const { re, t } = require('../internal/re')
-
-const parseOptions = require('../internal/parse-options')
-const { compareIdentifiers } = require('../internal/identifiers')
-class SemVer {
-  constructor (version, options) {
-    options = parseOptions(options)
-
-    if (version instanceof SemVer) {
-      if (version.loose === !!options.loose &&
-          version.includePrerelease === !!options.includePrerelease) {
-        return version
-      } else {
-        version = version.version
-      }
-    } else if (typeof version !== 'string') {
-      throw new TypeError(`Invalid Version: ${version}`)
-    }
-
-    if (version.length > MAX_LENGTH) {
-      throw new TypeError(
-        `version is longer than ${MAX_LENGTH} characters`
-      )
-    }
-
-    debug('SemVer', version, options)
-    this.options = options
-    this.loose = !!options.loose
-    // this isn't actually relevant for versions, but keep it so that we
-    // don't run into trouble passing this.options around.
-    this.includePrerelease = !!options.includePrerelease
-
-    const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL])
-
-    if (!m) {
-      throw new TypeError(`Invalid Version: ${version}`)
-    }
-
-    this.raw = version
-
-    // these are actually numbers
-    this.major = +m[1]
-    this.minor = +m[2]
-    this.patch = +m[3]
-
-    if (this.major > MAX_SAFE_INTEGER || this.major < 0) {
-      throw new TypeError('Invalid major version')
-    }
-
-    if (this.minor > MAX_SAFE_INTEGER || this.minor < 0) {
-      throw new TypeError('Invalid minor version')
-    }
-
-    if (this.patch > MAX_SAFE_INTEGER || this.patch < 0) {
-      throw new TypeError('Invalid patch version')
-    }
-
-    // numberify any prerelease numeric ids
-    if (!m[4]) {
-      this.prerelease = []
-    } else {
-      this.prerelease = m[4].split('.').map((id) => {
-        if (/^[0-9]+$/.test(id)) {
-          const num = +id
-          if (num >= 0 && num < MAX_SAFE_INTEGER) {
-            return num
-          }
-        }
-        return id
-      })
-    }
-
-    this.build = m[5] ? m[5].split('.') : []
-    this.format()
-  }
-
-  format () {
-    this.version = `${this.major}.${this.minor}.${this.patch}`
-    if (this.prerelease.length) {
-      this.version += `-${this.prerelease.join('.')}`
-    }
-    return this.version
-  }
-
-  toString () {
-    return this.version
-  }
-
-  compare (other) {
-    debug('SemVer.compare', this.version, this.options, other)
-    if (!(other instanceof SemVer)) {
-      if (typeof other === 'string' && other === this.version) {
-        return 0
-      }
-      other = new SemVer(other, this.options)
-    }
-
-    if (other.version === this.version) {
-      return 0
-    }
-
-    return this.compareMain(other) || this.comparePre(other)
-  }
-
-  compareMain (other) {
-    if (!(other instanceof SemVer)) {
-      other = new SemVer(other, this.options)
-    }
-
-    return (
-      compareIdentifiers(this.major, other.major) ||
-      compareIdentifiers(this.minor, other.minor) ||
-      compareIdentifiers(this.patch, other.patch)
-    )
-  }
-
-  comparePre (other) {
-    if (!(other instanceof SemVer)) {
-      other = new SemVer(other, this.options)
-    }
-
-    // NOT having a prerelease is > having one
-    if (this.prerelease.length && !other.prerelease.length) {
-      return -1
-    } else if (!this.prerelease.length && other.prerelease.length) {
-      return 1
-    } else if (!this.prerelease.length && !other.prerelease.length) {
-      return 0
-    }
-
-    let i = 0
-    do {
-      const a = this.prerelease[i]
-      const b = other.prerelease[i]
-      debug('prerelease compare', i, a, b)
-      if (a === undefined && b === undefined) {
-        return 0
-      } else if (b === undefined) {
-        return 1
-      } else if (a === undefined) {
-        return -1
-      } else if (a === b) {
-        continue
-      } else {
-        return compareIdentifiers(a, b)
-      }
-    } while (++i)
-  }
-
-  compareBuild (other) {
-    if (!(other instanceof SemVer)) {
-      other = new SemVer(other, this.options)
-    }
-
-    let i = 0
-    do {
-      const a = this.build[i]
-      const b = other.build[i]
-      debug('prerelease compare', i, a, b)
-      if (a === undefined && b === undefined) {
-        return 0
-      } else if (b === undefined) {
-        return 1
-      } else if (a === undefined) {
-        return -1
-      } else if (a === b) {
-        continue
-      } else {
-        return compareIdentifiers(a, b)
-      }
-    } while (++i)
-  }
-
-  // preminor will bump the version up to the next minor release, and immediately
-  // down to pre-release. premajor and prepatch work the same way.
-  inc (release, identifier) {
-    switch (release) {
-      case 'premajor':
-        this.prerelease.length = 0
-        this.patch = 0
-        this.minor = 0
-        this.major++
-        this.inc('pre', identifier)
-        break
-      case 'preminor':
-        this.prerelease.length = 0
-        this.patch = 0
-        this.minor++
-        this.inc('pre', identifier)
-        break
-      case 'prepatch':
-        // If this is already a prerelease, it will bump to the next version
-        // drop any prereleases that might already exist, since they are not
-        // relevant at this point.
-        this.prerelease.length = 0
-        this.inc('patch', identifier)
-        this.inc('pre', identifier)
-        break
-      // If the input is a non-prerelease version, this acts the same as
-      // prepatch.
-      case 'prerelease':
-        if (this.prerelease.length === 0) {
-          this.inc('patch', identifier)
-        }
-        this.inc('pre', identifier)
-        break
-
-      case 'major':
-        // If this is a pre-major version, bump up to the same major version.
-        // Otherwise increment major.
-        // 1.0.0-5 bumps to 1.0.0
-        // 1.1.0 bumps to 2.0.0
-        if (
-          this.minor !== 0 ||
-          this.patch !== 0 ||
-          this.prerelease.length === 0
-        ) {
-          this.major++
-        }
-        this.minor = 0
-        this.patch = 0
-        this.prerelease = []
-        break
-      case 'minor':
-        // If this is a pre-minor version, bump up to the same minor version.
-        // Otherwise increment minor.
-        // 1.2.0-5 bumps to 1.2.0
-        // 1.2.1 bumps to 1.3.0
-        if (this.patch !== 0 || this.prerelease.length === 0) {
-          this.minor++
-        }
-        this.patch = 0
-        this.prerelease = []
-        break
-      case 'patch':
-        // If this is not a pre-release version, it will increment the patch.
-        // If it is a pre-release it will bump up to the same patch version.
-        // 1.2.0-5 patches to 1.2.0
-        // 1.2.0 patches to 1.2.1
-        if (this.prerelease.length === 0) {
-          this.patch++
-        }
-        this.prerelease = []
-        break
-      // This probably shouldn't be used publicly.
-      // 1.0.0 'pre' would become 1.0.0-0 which is the wrong direction.
-      case 'pre':
-        if (this.prerelease.length === 0) {
-          this.prerelease = [0]
-        } else {
-          let i = this.prerelease.length
-          while (--i >= 0) {
-            if (typeof this.prerelease[i] === 'number') {
-              this.prerelease[i]++
-              i = -2
-            }
-          }
-          if (i === -1) {
-            // didn't increment anything
-            this.prerelease.push(0)
-          }
-        }
-        if (identifier) {
-          // 1.2.0-beta.1 bumps to 1.2.0-beta.2,
-          // 1.2.0-beta.fooblz or 1.2.0-beta bumps to 1.2.0-beta.0
-          if (this.prerelease[0] === identifier) {
-            if (isNaN(this.prerelease[1])) {
-              this.prerelease = [identifier, 0]
-            }
-          } else {
-            this.prerelease = [identifier, 0]
-          }
-        }
-        break
-
-      default:
-        throw new Error(`invalid increment argument: ${release}`)
-    }
-    this.format()
-    this.raw = this.version
-    return this
-  }
-}
-
-module.exports = SemVer

test/integration/test-fixtures/yarn-lock/node_modules/semver/functions/clean.js

@@ -1,6 +0,0 @@
-const parse = require('./parse')
-const clean = (version, options) => {
-  const s = parse(version.trim().replace(/^[=v]+/, ''), options)
-  return s ? s.version : null
-}
-module.exports = clean

test/integration/test-fixtures/yarn-lock/node_modules/semver/functions/cmp.js

@@ -1,48 +0,0 @@
-const eq = require('./eq')
-const neq = require('./neq')
-const gt = require('./gt')
-const gte = require('./gte')
-const lt = require('./lt')
-const lte = require('./lte')
-
-const cmp = (a, op, b, loose) => {
-  switch (op) {
-    case '===':
-      if (typeof a === 'object')
-        a = a.version
-      if (typeof b === 'object')
-        b = b.version
-      return a === b
-
-    case '!==':
-      if (typeof a === 'object')
-        a = a.version
-      if (typeof b === 'object')
-        b = b.version
-      return a !== b
-
-    case '':
-    case '=':
-    case '==':
-      return eq(a, b, loose)
-
-    case '!=':
-      return neq(a, b, loose)
-
-    case '>':
-      return gt(a, b, loose)
-
-    case '>=':
-      return gte(a, b, loose)
-
-    case '<':
-      return lt(a, b, loose)
-
-    case '<=':
-      return lte(a, b, loose)
-
-    default:
-      throw new TypeError(`Invalid operator: ${op}`)
-  }
-}
-module.exports = cmp

test/integration/test-fixtures/yarn-lock/node_modules/semver/functions/coerce.js

@@ -1,51 +0,0 @@
-const SemVer = require('../classes/semver')
-const parse = require('./parse')
-const {re, t} = require('../internal/re')
-
-const coerce = (version, options) => {
-  if (version instanceof SemVer) {
-    return version
-  }
-
-  if (typeof version === 'number') {
-    version = String(version)
-  }
-
-  if (typeof version !== 'string') {
-    return null
-  }
-
-  options = options || {}
-
-  let match = null
-  if (!options.rtl) {
-    match = version.match(re[t.COERCE])
-  } else {
-    // Find the right-most coercible string that does not share
-    // a terminus with a more left-ward coercible string.
-    // Eg, '1.2.3.4' wants to coerce '2.3.4', not '3.4' or '4'
-    //
-    // Walk through the string checking with a /g regexp
-    // Manually set the index so as to pick up overlapping matches.
-    // Stop when we get a match that ends at the string end, since no
-    // coercible string can be more right-ward without the same terminus.
-    let next
-    while ((next = re[t.COERCERTL].exec(version)) &&
-        (!match || match.index + match[0].length !== version.length)
-    ) {
-      if (!match ||
-            next.index + next[0].length !== match.index + match[0].length) {
-        match = next
-      }
-      re[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
-    }
-    // leave it in a clean state
-    re[t.COERCERTL].lastIndex = -1
-  }
-
-  if (match === null)
-    return null
-
-  return parse(`${match[2]}.${match[3] || '0'}.${match[4] || '0'}`, options)
-}
-module.exports = coerce

test/integration/test-fixtures/yarn-lock/node_modules/semver/functions/compare-build.js

@@ -1,7 +0,0 @@
-const SemVer = require('../classes/semver')
-const compareBuild = (a, b, loose) => {
-  const versionA = new SemVer(a, loose)
-  const versionB = new SemVer(b, loose)
-  return versionA.compare(versionB) || versionA.compareBuild(versionB)
-}
-module.exports = compareBuild