search

safedep / vet

Tool to achieve policy driven vetting of open source dependencies
https://safedep.io
Apache License 2.0
226 stars 21 forks source link

npm Graph Parser is Broken for Lockfile Version v3 #191

Open abhisek opened 9 months ago

abhisek commented 9 months ago

vet fails to parse package-lock.json v3 with error:

scan failed due to error: json: cannot unmarshal array into Go struct field npmPackageLockPackage.packages.license of type string

This seems to be because in v3, license is an array instead of a string value.