Support pnpm-lock.yaml

[knqyf263]

Description

Parse pnpm-lock.yaml so as to extract package names/versions.

Specification:
https://github.com/pnpm/spec/blob/master/lockfile/5.md

Example:
https://github.com/pnpm/pnpm/blob/main/pnpm-lock.yaml

Issue

aquasecurity/trivy#1200

[WorldVirus]

Hi,
I tried to push a branch for resolving this issue, but I have not access to push new branch

[knqyf263]

You can search how to make Pull Request on GitHub.

[WorldVirus]

And for creating new PR, I need to push my branch in repository, but i have

remote: Permission to aquasecurity/go-dep-parser.git denied to WorldVirus.
fatal: unable to access 'https://github.com/aquasecurity/go-dep-parser/': The requested URL returned error: 403

[weyert]

You need fork the repo and then push the branch to your repo and then after you pushed it should be able to make a PR.
See also: https://makeapullrequest.com

[WorldVirus]

I opened new pr, but could not update the reviewers

[eranshapira]

@WorldVirus any intention on taking it further? I might take it if not.

[itaysk]

@eranshapira are you actually going to take it?

[weyert]

In a different project I have been working on a PNPM lock file parsing, you can find it here:
https://gitlab.com/weyert-tapico/gemnasium/-/commit/4fa4879e1fd5f3f8c26e7e3bfd64e5ecb9bf69dc

Feel free to use it

[knqyf263]

Cool! Do you mind if we ask you to contribute?