Add a script to scan this project's own dependencies

liamjd commented

2026-07-27 21:49:05 +01:00

Owner

Trivy reads pnpm-lock.yaml directly, so it reports both an accurate
component list and the vulnerabilities against it. cyclonedx-npm was the
obvious first choice and does not work here: it shells out to npm ls,
which cannot read pnpm's symlinked node_modules and fails outright.

--include-dev-deps is not optional for this repo. Trivy omits dev
dependencies by default, and every dependency here is one, so without it
the scan returns an empty BOM.

The script is sbom:self rather than sbom because pnpm ships a built-in
pnpm sbom command that shadows a script of that name.

The output is ignored: it is a scan result, stale as soon as the lockfile
or Trivy's vulnerability database moves.

Trivy reads pnpm-lock.yaml directly, so it reports both an accurate component list and the vulnerabilities against it. cyclonedx-npm was the obvious first choice and does not work here: it shells out to `npm ls`, which cannot read pnpm's symlinked node_modules and fails outright. --include-dev-deps is not optional for this repo. Trivy omits dev dependencies by default, and every dependency here is one, so without it the scan returns an empty BOM. The script is sbom:self rather than sbom because pnpm ships a built-in `pnpm sbom` command that shadows a script of that name. The output is ignored: it is a scan result, stale as soon as the lockfile or Trivy's vulnerability database moves.

liamjd added 1 commit

2026-07-27 21:49:05 +01:00

Add a script to scan this project's own dependencies 92c10c569c

Trivy reads pnpm-lock.yaml directly, so it reports both an accurate
component list and the vulnerabilities against it. cyclonedx-npm was the
obvious first choice and does not work here: it shells out to `npm ls`,
which cannot read pnpm's symlinked node_modules and fails outright.

--include-dev-deps is not optional for this repo. Trivy omits dev
dependencies by default, and every dependency here is one, so without it
the scan returns an empty BOM.

The script is sbom:self rather than sbom because pnpm ships a built-in
`pnpm sbom` command that shadows a script of that name.

The output is ignored: it is a scan result, stale as soon as the lockfile
or Trivy's vulnerability database moves.

liamjd added 1 commit

2026-07-27 21:49:12 +01:00

Merge branch 'main' into infra ee28f2255c

liamjd merged commit a71435a0d8 into main

2026-07-27 21:49:17 +01:00

liamjd referenced this pull request from a commit

2026-07-27 21:49:19 +01:00

Merge pull request 'Add a script to scan this project's own dependencies' (#4) from infra into main

Rows
Columns

Add a script to scan this project's own dependencies #4