🚀 Motivation

A pnpm v9 lockfile that pins pnpm's self-managed node runtime caused the entire scan to return zero packages, so SCA silently skipped every dependency in the repository.

  node@runtime:24.15.0:
    resolution:
      type: variations
      variants:
        - resolution: // <- generated an error during parsing, causing full ignore of the lock file
            archive: tarball
            bin:

📝 Summary

• The pnpm v9 parser now tolerates the nested resolution shape used by pnpm's self-managed node runtime, so these lockfiles parse fully instead of failing.
• A partial YAML decode is now surfaced as a warning while keeping the packages that did parse, instead of discarding the whole lockfile without a trace.

🧪 Testing

• New tests were added for new logic.
• Existing tests were updated for new logic, and not only so that they pass!
• Benchmark results prove that performance is the same or better.

🚧 Staging validation

• Proof that it works as expected, including profiling or UX screenshots.

before

datadog-sbom-generator scan --output='sbom.json' --pretty --verbosity verbose .
Scanning directory '.', resolved absolute path '/<path>/pnpm'
Scanned /<path>/pnpm/pnpm-lock.yaml file and found 0 packages
No package sources found. Use the 'parsers list' command to view supported lockfiles, or use --help for usage information

after

~datadog-sbom-generator/datadog-sbom-generator scan --output='sbom.json' --pretty --verbosity verbose .
Scanning directory '.', resolved absolute path '<path>/pnpm'
Scanned <path>/pnpm/pnpm-lock.yaml file and found 2406 packages
[reachability] Reachability analysis is disabled