Open
Description
Some context: google/osv-scanner#1861
Currently, I don't believe javascript workspaces are being intentionally handled by our extractors (we don't have any test cases explicitly testing for these).
In yarn.lock, we seem to be extracting workspace dependencies as their declared name (in their package.json) with version 0.0.0-use.local (which is indistinguishable from an upstream package with the same name/version)
In package-lock.json, it seems to use the declared name with an empty version string.
I haven't looked into bun.lock or pnpm-lock.yaml.
I'm not entirely sure what our desired behaviour is for these cases, but they should at least be consistent with one-another.
Metadata
Metadata
Assignees
Labels
No labels