You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The "jf audit" for pnpm project scan does not support monorepos. It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
After reviewing the code, it appears that this limitation is due to the fact that the pnpm ls command does not support the -r or --filter parameters, so it is unable to resolve all dependency information.
Current behavior
It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
Describe the bug
The "jf audit" for pnpm project scan does not support monorepos. It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
After reviewing the code, it appears that this limitation is due to the fact that the pnpm ls command does not support the -r or --filter parameters, so it is unable to resolve all dependency information.
Current behavior
It can only scan the dependencies in the root directory and cannot recognize dependencies under other packages.
Reproduction steps
git clone https://github.com/astonishqft/pnpm-monorepo-demo.git
cd pnpm-monorepo-demo
pnpm install
pnpm ls
pnpm ls -r
jf audit --pnpm=true
Expected behavior
It is necessary to scan for vulnerabilities in all packages.
JFrog CLI-Security version
2.73.0
JFrog CLI version (if applicable)
No response
Operating system type and version
ubuntu 22.04
JFrog Xray version
jfrog cloud saas
The text was updated successfully, but these errors were encountered: