fix: CN-612 - find pnpm dependencies #6423
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
NOTE: this should be hotfixed into the upcoming release to avoid substantial changes in PNPM users' vulnerability counts after the feature is released. This ticket was the result of realizing that certain PNPM vulnerabilities were not surfacing to users
Pull Request Submission Checklist
are release-note ready, emphasizing
what was changed, not how.
What does this PR do?
This PR updates the snyk-docker-plugin version so that we will correctly discover pnpm sub-packages when there is not a package lock.
Where should the reviewer start?
Here is the actual change that was introduced: snyk/snyk-docker-plugin#744
How should this be manually tested?
you can run a
snyk container test n8nio/n8n:1.120.3 --print-depsand verify that the following package is discovered:n8n-nodes-langchainWhat's the product update that needs to be communicated to CLI users?
nothing additional, the pnpm functionality is being deployed out for the first time in this release and this is a bug fix to that.
Risk assessment (Low | Medium | High)?
Low
Any background context you want to provide?
This was the outcome of an incident because we were not correctly detecting a CVSS 10.0 vulnerability that was disclosed that day.
What are the relevant tickets?
https://snyksec.atlassian.net/browse/CN-612