Skip to content

Continue parsing if unmet peer dependencies

Tetiana Chupryna requested to merge 298825-fix-for-unmet-peer-dep into main

What does this MR do?

This is a fix for bug that causes parsing failure if unmet peer dependencies met for npm project.

When an npm package-lock.json contains unmet peer dependencies, the license scanning fails for that file, but the license-scanning job "succeeds".

When there are unmet peer dependencies, the LicenseFinder gem attempts to continue: https://github.com/pivotal/LicenseFinder/blob/master/lib/license_finder/package_managers/npm.rb#L39

The license-finder image monkey patches this class. It ignores the error and returns an empty hash here: https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/blob/main/lib/license/finder/ext/npm.rb#L37

In this MR we continue parsing the package file if code 1 for unmet peer dependencies is met, same as in the LicenseFinder gem.

What are the relevant issue numbers?

gitlab-org/gitlab#298825 (closed)

Does this MR meet the acceptance criteria?

Edited by Tetiana Chupryna

Merge request reports