Skip to content

Dependency scanning fails for npm if lockfileVersion equals 3

Summary

Same problem as it was #273651 (closed) but nowdays gemnasium lacks support of lockfileVersion = 3.

Release Post

Dependency Scanning supports NPM projects that utilize lockfile version 3.

Gitalab version

Tested on 14.10 and 15.0

Possible fixes

Add to gemnasium support of lockfileVersion = 3

Implementation

  1. Update the scanner/parser/npm/lockfile.go parser to parse the packages field if parsing a v3 lockfile.
  2. Update the scanner/parser/npm/lockfile_test.go tests so that it includes test cases for v3 lockfiles.
  3. Update the Obtaining dependency information by parsing lockfiles table so that the NPM tested versions include and link to 9.x tests.

Testing

Test the NPM project https://gitlab.com/gitlab-org/security-products/tests/js-npm either in the main branch or a FREEZE branch

Edited by Will Meek