pnpm monorepo support

[acherkashin]

Sandworm version
1.29.1

Describe the bug
Does sandworm-audit supports pnpm monorepos?

In the root of my repository there are 2 files:

• pnpm-lock.yaml
• pnpm-workspace.yaml

There is no package.json in the same folder with pnpm-lock.yaml. At the same time, every package of monorepo has a package.json.

When I try to run sandworm-audit in the root of the repository, I get the following error.

TypeError: Cannot read properties of undefined (reading 'name')
    at generatePnpmGraph (/Users/cherkalexander/.nvm/versions/node/v16.15.1/lib/node_modules/@sandworm/audit/src/graph/generatePnpmGraph.js:15:20)
    at generateGraphPromise (/Users/cherkalexander/.nvm/versions/node/v16.15.1/lib/node_modules/@sandworm/audit/src/graph/index.js:37:19)
    at async getReport (/Users/cherkalexander/.nvm/versions/node/v16.15.1/lib/node_modules/@sandworm/audit/src/index.js:41:25)
    at async Object.handler (/Users/cherkalexander/.nvm/versions/node/v16.15.1/lib/node_modules/@sandworm/audit/src/cli/index.js:43:7)

System (please complete the following information):

• Node Version - 16.15.1
• Package Manager - PNPM
• Package Manager Version - 7.17.1
• OS: MacOs

Additional context
I tried to use sandworm in a project where yarn 1 is used, and it works great. Thank you for this cool project 👍

[gabidobo]

Hi @acherkashin!

Thank you for the kind words 😊

You are correct - Sandworm doesn't currently support workspaces. I've added some notes in the docs to make this explicit.
Workspaces are definitely on the roadmap, I just need to understand how that feature would look like. If you have any suggestions they are welcome - as a user, how would you like to use Sandworm to audit workspaces?

[liamjones]

In our case, I'd like to use it at two levels;

1. At the monorepo root to check nothing licensed in a way that will cause us issues from a commercial licensing point of view
2. At an individual project level within the monorepo to help with license attribution info for an individual published artifact (RN apps in our case)

[gabidobo]

Thank you all for the feedback! We've released workspace support in v1.45.0 🎉

You'll need to run sandworm-audit in each individual package directory you want to audit instead of the workspace root.

Let me know if it works for you as well 👍

[acherkashin]

@gabidobo it is good news

I tried to run it on my production project, but sandworm just stuck on Getting vulnerability report from pnpm stage for some reason 🤔

[liamjones]

@gabidobo FYI, still not working here. I've tried running from both the root with -p and from an app package subdirectory itself and it still doesn't seem to be finding the yarn.lock in the repo root:

monorepo on  develop [$⇡]
❯ sandworm-audit -p packages/apps/an-app
Sandworm 🪱
Security and License Compliance Audit
⠋ Building dependency graph...
❌ Failed: No lockfile found

monorepo on  develop [$⇡]
❯ cd packages/apps/an-app

packages/apps/an-app on  develop [$⇡]
❯ sandworm-audit
Sandworm 🪱
Security and License Compliance Audit
⠋ Building dependency graph...
❌ Failed: No lockfile found

packages/apps/an-app on  develop [$⇡]
❯ sandworm-audit -v
1.46.0

[gabidobo]

Thank you so much for taking the time to test this out!

I've opened a couple of issues based on the reports above, will follow-up there:

• Audit hangs on retrieving vulnerabilities for pnpm workspace #130
• Audit can't detect lockfile in workspace root #131