Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(nodejs): parse licenses in yarn projects #4652

Merged
merged 51 commits into from
Aug 23, 2023

Conversation

nikpivkin
Copy link
Contributor

@nikpivkin nikpivkin commented Jun 16, 2023

Description

At the moment, dependency licenses in projects with the yarn package manager are not parsed. This pr adds license scanning for packages from the cache folders .yarn (for yarn 2+) and node_modules (yarn classic). The license field is also checked, because it can refer to a file and then it is necessary to classify the license. (npm/npm#8795 (comment), https://docs.npmjs.com/cli/v9/configuring-npm/package-json#license)

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

Sorry, something went wrong.

@knqyf263 knqyf263 requested a review from DmitriyLewen June 19, 2023 02:21
Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work!
I left few small comments.
@nikpivkin take a look, when you have time, please.

@nikpivkin nikpivkin marked this pull request as ready for review July 13, 2023 04:06
@nikpivkin nikpivkin requested a review from knqyf263 as a code owner July 13, 2023 04:06
@knqyf263 knqyf263 requested a review from DmitriyLewen July 13, 2023 07:24
Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have 1 question:
If package is installed in workspace - does yarn still create copy/link of package.json file in node_mosules/.yarn folder?
Can you check this case?

Could you also update nodejs page in docs, please.

@nikpivkin
Copy link
Contributor Author

@DmitriyLewen yarn has only 1 node_modules/.yarn folder in the root of the project, so all the dependencies of the workspaces are there.

@DmitriyLewen
Copy link
Contributor

ok, thanks for the clarification!

Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nikpivkin left some comments

@nikpivkin nikpivkin requested a review from DmitriyLewen August 10, 2023 11:31
Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@nikpivkin I left 1 comment about debug message. Can you take a look?

@nikpivkin nikpivkin requested a review from knqyf263 August 14, 2023 05:46
Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@knqyf263 knqyf263 enabled auto-merge August 22, 2023 19:38
@knqyf263 knqyf263 added this pull request to the merge queue Aug 22, 2023
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Aug 22, 2023
@knqyf263 knqyf263 added this pull request to the merge queue Aug 23, 2023
Merged via the queue into aquasecurity:main with commit ec5d8be Aug 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat(nodejs): parse licenses in yarn projects
4 participants