search

awslabs / automated-security-helper

https://awslabs.github.io/automated-security-helper/
Apache License 2.0
361 stars 44 forks source link

Bug in case of that pnpm project is in nested form #99

Open Kang3498 opened 1 month ago

Kang3498 commented 1 month ago

Hello, ENOLOCK error occurs if pnpm project is in nested form. I didn't use the pnpm workspace.

ex) root
├── package.json
├── pnpm-lock.yaml ├── sub-folder │      ├── package.json │      └── pnpm-lock.yaml <- ENOLOCK error. `

bestickley commented 1 month ago

I've run into this issue as well. Here is the output from my aggregated_results.txt:

>>>>>> Begin pnpm audit output for /tmp/ash-run-scan.etIU >>>>>>

No known vulnerabilities found

<<<<<< End pnpm audit output for /tmp/ash-run-scan.etIU <<<<<<

>>>>>> Begin npm audit output for /tmp/ash-run-scan.etIU >>>>>>

npm error code ENOLOCK
npm error audit This command requires an existing lockfile.
npm error audit Try creating one first with: npm i --package-lock-only
npm error audit Original error: loadVirtual requires existing shrinkwrap file
npm error A complete log of this run can be found in: /root/.npm/_logs/2024-07-18T11_28_38_330Z-debug-0.log

<<<<<< End npm audit output for /tmp/ash-run-scan.etIU <<<<<<

I'll have open source repository to reproduce soon.