fix: exclude deprecations from Yarn Berry audit results (#8380)

Signed-off-by: Chad Wilson <[email protected]>

Author: chadlwilson

.github/workflows/build-pull-requests.yml

@@ -43,9 +43,10 @@ jobs:
           check-latest: true
           cache: 'maven'
           cache-dependency-path: '**/pom.xml'
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          version: 6.0.2
+          node-version: 24
+      - run: npm install -g corepack && corepack enable
       - name: Build/Test with Maven
         id: build
         run: >
@@ -132,9 +133,10 @@ jobs:
           check-latest: true
           cache: 'maven'
           cache-dependency-path: '**/pom.xml'
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          version: 6.0.2
+          node-version: 24
+      - run: npm install -g corepack && corepack enable
       - name: Regression Test Maven Plugin
         id: build
         env:

.github/workflows/build-release.yml

@@ -54,9 +54,10 @@ jobs:
           server-id: central
           server-username: ${{ secrets.CENTRAL_USER }}
           server-password: ${{ secrets.CENTRAL_PASSWORD }}
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          version: 6.0.2
+          node-version: 24
+      - run: npm install -g corepack && corepack enable
       - name: Configure Git user
         run: |
           git config user.email "[email protected]"

.github/workflows/build.yml

@@ -59,9 +59,10 @@ jobs:
           server-id: central
           server-username: ${{ secrets.CENTRAL_USER }}
           server-password: ${{ secrets.CENTRAL_PASSWORD }}
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          version: 6.0.2
+          node-version: 24
+      - run: npm install -g corepack && corepack enable
       - name: Build/Test Snapshot with Maven${{ steps.install-gpg-key.outcome == 'success' && ' (then Deploy)' || '' }}
         id: build-snapshot
         env:

.github/workflows/false-positive-approvals.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: generatedSuppressions
-      - uses: actions/[email protected]
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       - run: |
           npm install [email protected]
           npm install fs

.github/workflows/false-positive-ops.yml

@@ -41,7 +41,7 @@ jobs:
         with:
           issue-body: ${{ github.event.issue.body }}
           template-path: odc/.github/ISSUE_TEMPLATE/false-positive-report.yml
-      - uses: actions/[email protected]
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 14
       - name: Initialize npm

.github/workflows/publish-suppressions.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: generatedSuppressions
-      - uses: actions/[email protected]
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       - run: |
           npm install fs
       - name: Create Generated Suppressions XML

core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java

@@ -114,42 +114,31 @@ public AnalysisPhase getAnalysisPhase() {
     }
 
     /**
-     * Extracts the major version from a version string.
+     * Determines the Yarn major version implied by the metadata in the passed directory.
      *
-     * @param dependency the dependency to extract the yarn version from
-     * @return the major version (e.g., `4` from "4.2.1")
+     * @param dependencyDirectory The directory containing the lockfile and/or package.json
+     * @return the yarn version detected
      */
-    private int getYarnMajorVersion(Dependency dependency) {
-        final var yarnVersion = getYarnVersion(dependency);
-        try {
-            final var semver = Semver.coerce(yarnVersion);
-            return semver.getMajor();
-        } catch (SemverException e) {
-            throw new IllegalStateException("Invalid version string format", e);
-        }
-    }
-
-    private String getYarnVersion(Dependency dependency) {
-        final List<String> args = new ArrayList<>();
-        args.add(getYarn());
-        args.add("--version");
+    private Semver getYarnVersion(File dependencyDirectory) {
+        List<String> args = List.of(yarnPath, "--version");
         final ProcessBuilder builder = new ProcessBuilder(args);
-        builder.directory(getDependencyDirectory(dependency));
-        LOGGER.debug("Launching: {}", args);
+        builder.directory(dependencyDirectory);
         try {
             final Process process = builder.start();
             try (ProcessReader processReader = new ProcessReader(process)) {
                 processReader.readAll();
                 final int exitValue = process.waitFor();
+                final var yarnVersion = StringUtils.trimToEmpty(processReader.getOutput());
                 if (exitValue != 0) {
-                    throw new IllegalStateException("Unable to determine yarn version, unexpected response.");
+                    throw new IllegalStateException(String.format("Unable to determine yarn version, unexpected response (exit value %s, output: %s, error: %s)", exitValue, yarnVersion, processReader.getError()));
                 }
-                final var yarnVersion = processReader.getOutput();
                 if (StringUtils.isBlank(yarnVersion)) {
                     throw new IllegalStateException("Unable to determine yarn version, blank output.");
                 }
-                return yarnVersion;
+                return Semver.coerce(yarnVersion);
             }
+        }  catch (SemverException e) {
+            throw new IllegalStateException("Invalid version string format", e);
         } catch (Exception ex) {
             throw new IllegalStateException("Unable to determine yarn version.", ex);
         }
@@ -169,62 +158,35 @@ protected void prepareFileTypeAnalyzer(Engine engine) throws InitializationExcep
             LOGGER.debug("{} Analyzer is disabled skipping yarn executable check", getName());
             return;
         }
-        final List<String> args = new ArrayList<>();
-        args.add(getYarn());
-        args.add("--help");
-        final ProcessBuilder builder = new ProcessBuilder(args);
-        LOGGER.debug("Launching: {}", args);
         try {
-            final Process process = builder.start();
-            try (ProcessReader processReader = new ProcessReader(process)) {
-                processReader.readAll();
-                final int exitValue = process.waitFor();
-                final int expectedExitValue = 0;
-                final int yarnExecutableNotFoundExitValue = 127;
-                switch (exitValue) {
-                    case expectedExitValue:
-                        LOGGER.debug("{} is enabled.", getName());
-                        break;
-                    case yarnExecutableNotFoundExitValue:
-                    default:
-                        this.setEnabled(false);
-                        LOGGER.warn("The {} has been disabled after receiving exit value {}. Yarn executable was not " +
-                                        "found or received a non-zero exit value.", getName(), exitValue);
-                }
-            }
-        } catch (Exception ex) {
+            cacheYarnCommandPath();
+            getYarnVersion(new File("."));
+        } catch (Exception ex){
             this.setEnabled(false);
-            LOGGER.warn("The {} has been disabled after receiving an exception. This can occur when Yarn executable " +
-                    "is not found.", getName());
-            throw new InitializationException("Unable to read yarn audit output.", ex);
+            LOGGER.warn("The {} has been disabled after failing to find yarn. Yarn executable was not " +
+                    "found or received a non-zero exit value: {}", getName(), ex.getMessage());
+            throw new InitializationException("Unable to determine yarn executable to use.", ex);
         }
     }
 
     /**
-     * Attempts to determine the path to `yarn`.
-     *
-     * @return the path to `yarn`
+     * Attempts to determine and cache the path to `yarn`.
      */
-    private String getYarn() {
-        final String value;
-        synchronized (this) {
-            if (yarnPath == null) {
-                final String path = getSettings().getString(Settings.KEYS.ANALYZER_YARN_PATH);
-                if (path == null) {
-                    yarnPath = "yarn";
-                } else {
-                    final File yarnFile = new File(path);
-                    if (yarnFile.isFile()) {
-                        yarnPath = yarnFile.getAbsolutePath();
-                    } else {
-                        LOGGER.warn("Provided path to `yarn` executable is invalid.");
-                        yarnPath = "yarn";
-                    }
-                }
+    private void cacheYarnCommandPath() {
+        String value = getSettings().getString(Settings.KEYS.ANALYZER_YARN_PATH);
+        if (value == null || value.isBlank()) {
+            value = "yarn";
+        } else {
+            File fileValue = new File(value);
+            if (fileValue.isFile()) {
+                value = fileValue.getAbsolutePath();
+            } else {
+                LOGGER.warn("Provided path to `yarn` executable is invalid; defaulting to `yarn`.");
+                value = "yarn";
             }
-            value = yarnPath;
         }
-        return value;
+
+        yarnPath = value;
     }
 
     /**
@@ -247,7 +209,7 @@ private String startAndReadStdoutToString(ProcessBuilder builder) throws Analysi
                     LOGGER.debug("Process Error Out: {}", errOutput);
                     LOGGER.debug("Process Out: {}", processReader.getOutput());
                 }
-                return new String(Files.readAllBytes(tmpFile.toPath()), StandardCharsets.UTF_8);
+                return Files.readString(tmpFile.toPath());
             } catch (InterruptedException ex) {
                 Thread.currentThread().interrupt();
                 throw new AnalysisException("Yarn audit process was interrupted.", ex);
@@ -274,16 +236,16 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
         if (!packageLock.isFile() || packageLock.length() == 0 || !shouldProcess(packageLock)) {
             return;
         }
-        final File packageJson = new File(packageLock.getParentFile(), "package.json");
+        File dependencyDirectory = getDependencyDirectory(packageLock);
+        final var yarnVersion = getYarnVersion(dependencyDirectory);
         final List<Advisory> advisories;
         final MultiValuedMap<String, String> dependencyMap = new HashSetValuedHashMap<>();
-        final var yarnMajorVersion = getYarnMajorVersion(dependency);
-        if (YARN_CLASSIC_MAJOR_VERSION < yarnMajorVersion) {
-            LOGGER.info("Analyzing using Yarn Berry audit");
+        if (YARN_CLASSIC_MAJOR_VERSION < yarnVersion.getMajor()) {
+            LOGGER.info("Analyzing using Yarn Berry ({}) audit for {}", yarnVersion, dependency.getActualFilePath());
             advisories = analyzePackageWithYarnBerry(dependency);
         } else {
-            LOGGER.info("Analyzing using Yarn Classic audit");
-            advisories = analyzePackageWithYarnClassic(packageLock, packageJson, dependency, dependencyMap);
+            LOGGER.info("Analyzing using Yarn Classic ({}) audit for {}", yarnVersion, dependency.getActualFilePath());
+            advisories = analyzePackageWithYarnClassic(packageLock, dependency, dependencyMap);
         }
         try {
             processResults(advisories, engine, dependency, dependencyMap);
@@ -292,9 +254,9 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
         }
     }
 
-    private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDependencies) throws AnalysisException {
+    private JsonObject fetchYarnAuditJson(File dependencyDirectory, boolean skipDevDependencies) throws AnalysisException {
         final List<String> args = new ArrayList<>();
-        args.add(getYarn());
+        args.add(yarnPath);
         args.add("audit");
         //offline audit is not supported - but the audit request is generated in the verbose output
         args.add("--offline");
@@ -305,13 +267,14 @@ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDepe
         args.add("--json");
         args.add("--verbose");
         final ProcessBuilder builder = new ProcessBuilder(args);
-        builder.directory(getDependencyDirectory(dependency));
+        builder.directory(dependencyDirectory);
         LOGGER.debug("Launching: {}", args);
 
         final String verboseJson = startAndReadStdoutToString(builder);
         final String auditRequestJson = Arrays.stream(verboseJson.split("\n"))
                 .filter(line -> line.contains("Audit Request"))
-                .findFirst().get();
+                .findFirst()
+                .orElseThrow(() -> new AnalysisException("No results from Yarn Classic (offline step) - possibly trying to use classic analyzer on Yarn Berry lockfile"));
         String auditRequest;
         try (JsonReader reader = Json.createReader(IOUtils.toInputStream(auditRequestJson, StandardCharsets.UTF_8))) {
             final JsonObject jsonObject = reader.readObject();
@@ -323,8 +286,8 @@ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDepe
         return Json.createReader(IOUtils.toInputStream(auditRequest, StandardCharsets.UTF_8)).readObject();
     }
 
-    private static File getDependencyDirectory(Dependency dependency) {
-        final File folder = dependency.getActualFile().getParentFile();
+    private static File getDependencyDirectory(File lockFile) {
+        final File folder = lockFile.getParentFile();
         if (!folder.isDirectory()) {
             throw new IllegalArgumentException(String.format("%s should have been a directory.", folder.getAbsolutePath()));
         }
@@ -337,7 +300,6 @@ private static File getDependencyDirectory(Dependency dependency) {
      * submitting the payload, and returning the identified advisories.
      *
      * @param lockFile a reference to the package-lock.json
-     * @param packageFile a reference to the package.json
      * @param dependency a reference to the dependency-object for the yarn.lock
      * @param dependencyMap a collection of module/version pairs; during
      * creation of the payload the dependency map is populated with the
@@ -346,16 +308,16 @@ private static File getDependencyDirectory(Dependency dependency) {
      * @throws AnalysisException thrown when there is an error creating or
      * submitting the npm audit API payload
      */
-    private List<Advisory> analyzePackageWithYarnClassic(final File lockFile, final File packageFile,
-                                                         Dependency dependency, MultiValuedMap<String, String> dependencyMap)
+    private List<Advisory> analyzePackageWithYarnClassic(final File lockFile, Dependency dependency,
+                                                         MultiValuedMap<String, String> dependencyMap)
             throws AnalysisException {
         try {
             final boolean skipDevDependencies = getSettings().getBoolean(Settings.KEYS.ANALYZER_NODE_AUDIT_SKIPDEV, false);
             // Retrieves the contents of package-lock.json from the Dependency
-            final JsonObject lockJson = fetchYarnAuditJson(dependency, skipDevDependencies);
+            final JsonObject lockJson = fetchYarnAuditJson(getDependencyDirectory(lockFile), skipDevDependencies);
             // Retrieves the contents of package-lock.json from the Dependency
             final JsonObject packageJson;
-            try (JsonReader packageReader = Json.createReader(Files.newInputStream(packageFile.toPath()))) {
+            try (JsonReader packageReader = Json.createReader(Files.newInputStream(lockFile.getParentFile().toPath().resolve("package.json")))) {
                 packageJson = packageReader.readObject();
             }
             // Modify the payload to meet the NPM Audit API requirements
@@ -385,7 +347,7 @@ private List<Advisory> analyzePackageWithYarnClassic(final File lockFile, final
     private List<JSONObject> fetchYarnAdvisories(Dependency dependency, boolean skipDevDependencies) throws AnalysisException {
         final List<String> args = new ArrayList<>();
 
-        args.add(getYarn());
+        args.add(yarnPath);
         args.add("npm");
         args.add("audit");
         if (skipDevDependencies) {
@@ -394,9 +356,10 @@ private List<JSONObject> fetchYarnAdvisories(Dependency dependency, boolean skip
         }
         args.add("--all");
         args.add("--recursive");
+        args.add("--no-deprecations");
         args.add("--json");
         final ProcessBuilder builder = new ProcessBuilder(args);
-        builder.directory(getDependencyDirectory(dependency));
+        builder.directory(getDependencyDirectory(dependency.getActualFile()));
 
         final String advisoriesJsons = startAndReadStdoutToString(builder);
 

core/src/test/java/org/owasp/dependencycheck/EngineIT.java

@@ -95,6 +95,7 @@ void testEngine() throws DatabaseException, ReportException {
         getSettings().setBoolean(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED, false);
         getSettings().setBoolean(Settings.KEYS.ANALYZER_NODE_AUDIT_ENABLED, false);
         getSettings().setBoolean(Settings.KEYS.ANALYZER_PNPM_AUDIT_ENABLED, false);
+        getSettings().setBoolean(Settings.KEYS.ANALYZER_YARN_AUDIT_ENABLED, false);
         getSettings().setBoolean(Settings.KEYS.ANALYZER_EXPERIMENTAL_ENABLED, true);
         getSettings().setBoolean(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_ENABLED, false);
         getSettings().setBoolean(Settings.KEYS.ANALYZER_MIX_AUDIT_ENABLED, false);