lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

Bug: only one file checked #6

Closed DanielRuf closed 4 years ago

DanielRuf commented 5 years ago

Expected Behavior

If there are multiple lockfiles like we use at zurb/foundation-sites, only one will be checked.

Current Behavior

Only one / first found lockfile is checked as it seems.

https://github.com/lirantal/lockfile-lint/blob/master/packages/lockfile-lint-api/src/ParseLockfile.js

Possible Solution

Test all found lockfiles.

Steps to Reproduce (for bugs)

1. 2. 3. 4.

Context

Hard to check all at once. Can be used to change two files and only inject URLs in the second.

Your Environment

lirantal commented 5 years ago

@DanielRuf

  1. What is the use-case of using several lockfiles for a project?
  2. As a workaround you could lint them one by one
DanielRuf commented 5 years ago

What is the use-case of using several lockfiles for a project?

Same setup for all consumers (of the app), see https://github.com/zurb/foundation-sites

lirantal commented 5 years ago

When you say to all consumers do you mean for those using "npm" and also for those using "yarn" ?

DanielRuf commented 5 years ago

And pnpm, Yarn PnP and so on. Yes. We normally update all of them at the same time.

lirantal commented 4 years ago

Closing due to work on this being handled with https://github.com/lirantal/lockfile-lint/issues/47