Skip to content

PnpmAuditAnalyzer stopped working, because npmjs API returns a 410 error now #8421

@roman-stoffel-at-communardo

Description

Precondition

  • [x ] I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
Run Dependency Check with a pnpm file to analyze. For example:

$DEPENDENCY_CHECK/bin/dependency-check.sh --scan ./pnpm-lock.yaml

It will fail with:

[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARN] An error occurred while analyzing '/home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml' (Pnpm Audit Analyzer): Failed to parse /home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml file from the NPM Audit API (PnpmAuditAnalyzer).
[INFO] Finished Pnpm Audit Analyzer (1 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: /home/roman/dev/codeowners-mill-experiment/./dependency-check-report.html
[ERROR] Failed to parse /home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml file from the NPM Audit API (PnpmAuditAnalyzer).

The underlying exception is in PnpmAuditAnalyzer.analyzePackage is a JSONException, because the auditJson is an error from npmjs.org:

{"error":{"code":"ERR_PNPM_AUDIT_BAD_RESPONSE","message":"The audit endpoint (at https:\/\/registry.npmjs.org\/-\/npm\/v1\/security\/audits\/quick) responded with 410: {\"error\":\"This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https:\/\/api-docs.npmjs.com\/#tag\/Audit\"}. Fallback endpoint (at https:\/\/registry.npmjs.org\/-\/npm\/v1\/security\/audits) responded with 410: {\"error\":\"This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https:\/\/api-docs.npmjs.com\/#tag\/Audit\"}"}}

Note, that pnpm itself also has this issue (version 10.33.0). This is a change on the npmjs.org side.

Version of dependency-check used
The problem occurs using version 12.2.0 of the cli.

Expected behavior
A working scan, using the newer API.

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions