fix: parse dual-document pnpm v9 lockfiles (bootstrap + project sections)

[Ayush7614]

Summary

Fixes #669 — pnpm v9 lockfiles that contain two YAML documents (----separated bootstrap + project sections) no longer crash CVE Lite with YAML.parseAllDocuments() errors.

Approach

Per @sonukapoor's review on the issue:

• Try YAML.parse() first (single-document lockfiles unchanged)
• On multi-document error, use YAML.parseAllDocuments() and select the project lockfile document by finding the document whose importers include project dependency sections (dependencies / devDependencies / optionalDependencies)
• Fallback to any document with importers, then the last document

Bootstrap documents in v9 also carry an importers block (with packageManagerDependencies only), so the project-section check is more deterministic than document size scoring.

Changes

• src/parsers/pnpm-lock.ts — shared parsePnpmLockContent() used by loadFromPnpmLock and buildPnpmWorkspaceMap
• examples/pnpm-dual-document/ — minimal dual-document fixture (bootstrap + lodash project lockfile)
• tests/parsers/pnpm-lock.test.ts — dual-document parsing regression test
• tests/fixture-scan.test.ts — fixture loads project packages, excludes bootstrap pnpm
• tests/e2e/cve-scanning.test.ts — e2e scan completes with findings on the new fixture

Test plan

• npm run build
• npm test -- tests/parsers/pnpm-lock.test.ts tests/fixture-scan.test.ts
• CI (build, e2e, self-scan)

[Ayush7614]

Thanks @sonukapoor — opened PR implementing your suggested approach from #669.

Document selection: on multi-document pnpm-lock.yaml, use YAML.parseAllDocuments() and pick the document whose importers include project dependency sections (dependencies / devDependencies / optionalDependencies). Bootstrap documents also carry importers (with packageManagerDependencies only), so that check is more deterministic than size scoring. Fallback: any document with importers, then the last document.

Fixture + tests: added examples/pnpm-dual-document/ plus parser, fixture-scan, and e2e regression tests confirming dual-document lockfiles parse and scan without throwing.

Closes #669

[sonukapoor]

The try-first / fall-back pattern is the right approach - single-document lockfiles hit zero overhead, and the three-function decomposition is clean and readable. Two things to address before this merges.

peerDependencies note: hasProjectImporterSections only checks dependencies, devDependencies, and optionalDependencies. A lockfile where importers declare only peerDependencies would miss tier-1 and fall to tier-2 - still correct, just worth knowing.

Fixture note: lodash@4.17.20 being intentionally vulnerable is the right call for the e2e scan test, but a short comment in the fixture package.json or readme.md would help a future contributor who might try to "fix" it.

[sonukapoor]

String matching on the error message is fragile - the yaml library exposes a stable code property on YAMLParseError that is part of its public TypeScript API since v2.0. The message could be reworded in a future release (yaml v3 is already in next) and this catch would silently stop working.

The safe version:

import { YAMLParseError } from "yaml";

} catch (error) {
  if (!(error instanceof YAMLParseError) || error.code !== "MULTIPLE_DOCS") {
    throw error;
  }
}

[sonukapoor]

This fallback has no test coverage and silently returns the last document if neither tier-1 nor tier-2 matched. In all known pnpm v9 files the project section is last, but if that ordering ever changed the scan would use the wrong document with no error or warning.

Prefer throwing explicitly so we know if this case ever fires in the wild:

throw new Error(
  "pnpm-lock.yaml contains multiple YAML documents but none could be identified as the project lockfile. Please open an issue at https://github.com/OWASP/cve-lite-cli/issues"
);

[Ayush7614]

Thanks @sonukapoor — all review items addressed in 9158022:

1. YAMLParseError check — replaced message string matching with error instanceof YAMLParseError && error.code === "MULTIPLE_DOCS".
2. Explicit throw — removed silent last-document fallback; now throws with an issue link when neither tier-1 nor tier-2 can identify the project lockfile (new regression test included).
3. peerDependencies — added to hasProjectImporterSections alongside dependencies/devDependencies/optionalDependencies.
4. Fixture note — documented that lodash@4.17.20 is intentionally vulnerable in examples/pnpm-dual-document/package.json and examples/readme.md.

Rebased onto latest main. Ready for another look.

[sonukapoor]

Both issues addressed: is in the check, and the fixture has the intentionally-vulnerable comment in both the package.json description and the readme. CI is green. Good to go.

[sonukapoor]

Both issues addressed: peerDependencies is in the hasProjectImporterSections check, and the fixture has the intentionally-vulnerable comment in both the package.json description and the readme. CI is green. Good to go.

[sonukapoor]

Merged - thank you @Ayush7614!