Precondition
- [x ] I checked the issues list for existing open or closed reports of the same problem.
Describe the bug
Run Dependency Check with a pnpm file to analyze. For example:
$DEPENDENCY_CHECK/bin/dependency-check.sh --scan ./pnpm-lock.yaml
It will fail with:
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARN] An error occurred while analyzing '/home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml' (Pnpm Audit Analyzer): Failed to parse /home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml file from the NPM Audit API (PnpmAuditAnalyzer).
[INFO] Finished Pnpm Audit Analyzer (1 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: /home/roman/dev/codeowners-mill-experiment/./dependency-check-report.html
[ERROR] Failed to parse /home/roman/dev/codeowners-mill-experiment/pnpm-lock.yaml file from the NPM Audit API (PnpmAuditAnalyzer).
The underlying exception is in PnpmAuditAnalyzer.analyzePackage is a JSONException, because the auditJson is an error from npmjs.org:
{"error":{"code":"ERR_PNPM_AUDIT_BAD_RESPONSE","message":"The audit endpoint (at https:\/\/registry.npmjs.org\/-\/npm\/v1\/security\/audits\/quick) responded with 410: {\"error\":\"This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https:\/\/api-docs.npmjs.com\/#tag\/Audit\"}. Fallback endpoint (at https:\/\/registry.npmjs.org\/-\/npm\/v1\/security\/audits) responded with 410: {\"error\":\"This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https:\/\/api-docs.npmjs.com\/#tag\/Audit\"}"}}
Note, that pnpm itself also has this issue (version 10.33.0). This is a change on the npmjs.org side.
Version of dependency-check used
The problem occurs using version 12.2.0 of the cli.
Expected behavior
A working scan, using the newer API.
Additional context
Add any other context about the problem here.
Precondition
Describe the bug
Run Dependency Check with a pnpm file to analyze. For example:
It will fail with:
The underlying exception is in
PnpmAuditAnalyzer.analyzePackageis aJSONException, because theauditJsonis an error from npmjs.org:Note, that pnpm itself also has this issue (version 10.33.0). This is a change on the npmjs.org side.
Version of dependency-check used
The problem occurs using version 12.2.0 of the cli.
Expected behavior
A working scan, using the newer API.
Additional context
Add any other context about the problem here.