Snyk: Support for yarn workspaces in snyk-CLI

Created on 27 Nov 2018 · 3Comments · Source: snyk/snyk

Yarn https://yarnpkg.com/lang/en/docs/workspaces feature allows for more than one package.json in the same project. Here is an example of folder structure:

├── package.json
├── packages
│   ├── package1
│   │   ├── package.json
│   │   └── src
│   ├── package2
│   │   ├── package.json
│   │   └── src
│   └── package3
│       ├── package.json
│       └── src
└── yarn.lock

Even though there are multiple package.json, there is only one yarn.lock file located at the the project root. The main package.json contains the path of the other packages, in this case "workspaces": [ "packages/*" ],

Currently, snyk CLI (v1.110.2) does not seem to support this structure. When I run snyk test from the project root folder, it only audits the dependencies that are descendant of dependencies located in the root package.json, even though the target file is yarn.lock. When I run it from one of the subfolder, it doesn't read the yarn.lock anymore, thus ignoring some potential vulnerabilities.

I've found a workaround, that is to copy yarn.lock in every subfolder, and run snyk test once for every package.json during the CI process, but it would be nicer to have this built-in in snyk. Ideally I would like to run snyk test from the project root folder and have it to detect the workspaces.

At the minimum, if you decide to not support this feature, I would recommend to print a warning when a workspaces entry is detected in package.json, to make it explicit only the main package.json will be parsed.

yarn workspaces

Source

digigarlab

Most helpful comment

Hi @digigarlab We are indeed looking at adding some support around Yarn workspaces, we don't have any planned dates yet but stay tuned! I can let you know once we have something solid, at the moment we are working on improving our Yarn support and once the base is there we can look at adding features like this.