Dependency scanning fails for npm if lockfileVersion equals 3
Summary
Same problem as it was #273651 (closed) but nowdays gemnasium lacks support of lockfileVersion = 3.
Release Post
Dependency Scanning supports NPM projects that utilize lockfile version 3.
Gitalab version
Tested on 14.10 and 15.0
Possible fixes
Add to gemnasium support of lockfileVersion = 3
Implementation
- Update the
scanner/parser/npm/lockfile.go
parser to parse the packages field if parsing a v3 lockfile. - Update the
scanner/parser/npm/lockfile_test.go
tests so that it includes test cases for v3 lockfiles. - Update the Obtaining dependency information by parsing lockfiles table so that the NPM tested versions include and link to 9.x tests.
Testing
Test the NPM project https://gitlab.com/gitlab-org/security-products/tests/js-npm either in the main branch or a FREEZE branch