| 348 | return findings |
| 349 | |
| 350 | def check_node_package_locks(self) -> list[Finding]: |
| 351 | findings: list[Finding] = [] |
| 352 | for path in self.git_files("**/package.json", "package.json"): |
| 353 | full_path = self.repo_root / path |
| 354 | if not full_path.is_file(): |
| 355 | continue |
| 356 | try: |
| 357 | json.loads(full_path.read_text(encoding="utf-8")) |
| 358 | except Exception as exc: |
| 359 | findings.append(Finding("node-package-lock", path, f"invalid package.json: {exc}")) |
| 360 | |
| 361 | for path in self.git_files("**/package-lock.json", "package-lock.json"): |
| 362 | full_path = self.repo_root / path |
| 363 | if not full_path.is_file(): |
| 364 | continue |
| 365 | package_json = full_path.parent / "package.json" |
| 366 | if not package_json.is_file(): |
| 367 | findings.append( |
| 368 | Finding( |
| 369 | "node-package-lock", |
| 370 | path, |
| 371 | "package-lock.json has no package.json in the same directory", |
| 372 | ), |
| 373 | ) |
| 374 | continue |
| 375 | try: |
| 376 | data = json.loads(full_path.read_text(encoding="utf-8")) |
| 377 | except Exception as exc: |
| 378 | findings.append(Finding("node-package-lock", path, f"invalid package-lock.json: {exc}")) |
| 379 | continue |
| 380 | if "lockfileVersion" not in data: |
| 381 | findings.append(Finding("node-package-lock", path, "missing lockfileVersion")) |
| 382 | if "packages" not in data and "dependencies" not in data: |
| 383 | findings.append(Finding("node-package-lock", path, "missing packages/dependencies data")) |
| 384 | |
| 385 | for path in self.git_files("**/yarn.lock", "yarn.lock"): |
| 386 | full_path = self.repo_root / path |
| 387 | if not full_path.is_file(): |
| 388 | continue |
| 389 | text = full_path.read_text(encoding="utf-8", errors="ignore") |
| 390 | if "<<<<<<<" in text or "=======" in text or ">>>>>>>" in text: |
| 391 | findings.append(Finding("node-package-lock", path, "lock file contains merge conflict markers")) |
| 392 | if not text.strip(): |
| 393 | findings.append(Finding("node-package-lock", path, "lock file is empty")) |
| 394 | return findings |
| 395 | |
| 396 | |
| 397 | def _print_report(findings: Iterable[Finding]) -> None: |