Add pnpm support?

[GermainBergeron]

We recently switched our package manager from npm to pnpm since it reduce our install time by multiple minutes in our monorepo. Since then our Snyk scans are failing, as we should have expected. We hacked something to generate a package-lock from the pnpm-lock.yaml but we'd like to have a more robust solution.

Can we start working on a PR to add pnpm support? I saw that you already have a parser for yarn that uses yaml and I think we could reuse some logic.

Thanks!

[abdulhannanali]

I would like to work on this.

[GermainBergeron]

I'm sorry to ping you directly @lirantal but the issue was open 12 days ago and I'm still waiting on an answer

[GermainBergeron]

Again I'm sorry and notifying random contributors but can you have a look at this issue @lili2311 ?

[abdulhannanali]

@GermainBergeron 😢

[lili2311]

hi @GermainBergeron apologies for slow response I am not longer directly involved in this plugin, I have however shared this with the relevant team. Is the ask here that you would like to collaborate on the support for the pnpm lockfile?

[steph-herd-snyk-pm]

Hi @GermainBergeron, I am Steph and I am a Product Manager at Snyk. Thank you for your request! Whilst we think this would be a good addition to our current offering due to other priorities we won't be able to work on this anytime soon, sorry about that. I have noted your request down and I will make sure to keep you posted If anything changes.

Kind Regards,
Steph

[GermainBergeron]

If I or @abdulhannanali manage to get it working in this repository, would it be something that you would consider @steph-herd-snyk-pm? Is there any other big piece missing to integrate it in the Snyk CLI?

Thanks

[lili2311]

👋 hi @GermainBergeron @abdulhannanali while we do welcome contributions, in this particular case adding pnpn support would require setting up a new project type in the backend and lots of associated work that comes with it: settings, icons, project type, vulnerabilities, filters. This is why this request would need to be addressed by the team before the any work in the parser can be utilised.

So even if you were to raise the changes needed and they are merged the team would need to complete all the backend work first before the parser is even called for a new project type pnpm.

Could you help us gather some more requirements on this as well while we have you here:

• are you using pnpm workspaces at all?
• do you need the support in CLI or are scanning it in a different way?

I also wanted to share a current Github action we have that was a great contribution snyk-tech-services/github-actions-pnpm-snyk it can convert the pnpm lockfile to an npm one and then run snyk cli. It might help you in the mean time.

[GermainBergeron]

Hey @lili2311, thanks for your response!

This is why I asked, I figured it could be a lot more complex than just adding the parser in here. To answer your questions:

• Yes, we are using pnpm workspaces. We have an open source repository using Snyk and pnpm that you can check if you want but we'd also like to scan some private ones
• Yes, we use the CLI, an example would be in the previously mentioned repository

I'll have a look at the Github action, it's probably better than our current workaround 🙏

[steph-herd-snyk-pm]

Thanks, @lili2311!
@GermainBergeron I am curious, what is your current workaround? if you don't mind sharing of course. Thank you.

[lili2311]

@steph-herd-snyk-pm https://github.com/snyk-tech-services/github-actions-pnpm-snyk

[GermainBergeron]

We have a custom script based on the previously mentioned Github action but it's not working currently since we are in a workspace and the package-lock doesn't match the package.json at the root of our workspace (0 dependencies detected).

We're thinking about different improvements but they all seem hackish:

• generating a package.json with the dependencies of all our packages while we generate the package-lock.json
• adding a postinstall script to generate the package-lock (but dev shouldn't use it)
• converting to a yarn lock file while waiting for support of NPM workspaces in Snyk

[mathild3r]

Hi @GermainBergeron,

I am Mathilde, I am working with @lili2311 on this issue. I have a question on your project. So you have a pnpm-lock, a package.json and a pnpm-workspace.yaml at the base of the project, is that right?
Do you have pnpm-lock.yml in each packages too?

[GermainBergeron]

Hey Mathilde,

We have a single pnpm-lock.yaml at the root folder along with a pnpm-workspace.yaml and a package.json. Our different packages all have a package.json but no pnpm-lock.yaml. It looks like this:

project
├── packages
│   ├── package-one
│   │   └── package.json
│   ├── package-two
│       └── package.json
├── pnpm-lock.yaml
├── pnpm-workspace.yaml
└── package.json

[mathild3r]

Hi @GermainBergeron

Ok thank you.
We are looking at a solution supporting workspaces project atm. I will let you know