Skip to content

Conversation

@tyler-catlin
Copy link

@tyler-catlin tyler-catlin commented Jan 9, 2026

NOTE: this should be hotfixed into the upcoming release to avoid substantial changes in PNPM users' vulnerability counts after the feature is released. This ticket was the result of realizing that certain PNPM vulnerabilities were not surfacing to users

Pull Request Submission Checklist

  • Follows CONTRIBUTING guidelines
  • Commit messages
    are release-note ready, emphasizing
    what was changed, not how.
  • Includes detailed description of changes
  • Contains risk assessment (Low | Medium | High)
  • Highlights breaking API changes (if applicable)
  • Links to automated tests covering new functionality
  • Includes manual testing instructions (if necessary)
  • Updates relevant GitBook documentation (PR link: ___) (not necessary)
  • Includes product update to be announced in the next stable release notes (not necessary)

What does this PR do?

This PR updates the snyk-docker-plugin version so that we will correctly discover pnpm sub-packages when there is not a package lock.

Where should the reviewer start?

Here is the actual change that was introduced: snyk/snyk-docker-plugin#744

How should this be manually tested?

you can run a snyk container test n8nio/n8n:1.120.3 --print-deps and verify that the following package is discovered:
n8n-nodes-langchain

What's the product update that needs to be communicated to CLI users?

nothing additional, the pnpm functionality is being deployed out for the first time in this release and this is a bug fix to that.

Risk assessment (Low | Medium | High)?

Low

Any background context you want to provide?

This was the outcome of an incident because we were not correctly detecting a CVSS 10.0 vulnerability that was disclosed that day.

What are the relevant tickets?

https://snyksec.atlassian.net/browse/CN-612

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

Warnings
⚠️ There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 1c46720

@tyler-catlin tyler-catlin force-pushed the cn-612-find-pnpm-dependencies branch from c791f70 to 808238e Compare January 9, 2026 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants