@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/ecosystems/parsers-js.js

@@ -4,19 +4,26 @@ import path, {
   sep as _sep,
   basename,
   dirname,
+  isAbsolute,
   join,
   relative,
   resolve,
+  win32,
 } from "node:path";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
 import ssri from "ssri";
 import { parse as _load, parseAllDocuments } from "yaml";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  isSecureMode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { shouldFetchPackageMetadata } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
+import { isPathInsideProject } from "../core/lockPaths.js";
 import { analyzeSuspiciousJsFile } from "../inventory/analyzer.js";
 import { npmPurl, parsePurlLoose } from "../inventory/purl.js";
 import Arborist from "../third-party/arborist/lib/index.js";
@@ -864,6 +871,95 @@ function undoPackageExtensions(tree) {
   }
 }
 
+/**
+ * True for a home-relative path such as `~/pkg`; a `~1.2.3` range is not one.
+ *
+ * @param {string} value Path or specifier
+ *
+ * @returns {Boolean} True when the value starts with `~/` or `~\`, or is `~`
+ */
+function isHomeRelativePath(value) {
+  return value === "~" || value.startsWith("~/") || value.startsWith("~\\");
+}
+
+/**
+ * Extract the filesystem path a lockfile `version` or `resolved` value names,
+ * if any. `file:` and `link:` specifiers and bare relative or absolute paths
+ * are paths; registry and git URLs, other scheme-bearing specifiers such as
+ * `npm:` aliases, and plain versions are not.
+ *
+ * @param {string} value Lockfile `version` or `resolved` value
+ *
+ * @returns {string|undefined} The path, or undefined when the value is not one
+ */
+function lockfileValuePath(value) {
+  if (typeof value !== "string" || !value) {
+    return undefined;
+  }
+  if (value.startsWith("file:") || value.startsWith("link:")) {
+    return value.slice(5);
+  }
+  if (
+    value.startsWith(".") ||
+    value.startsWith("/") ||
+    value.startsWith("\\") ||
+    isHomeRelativePath(value) ||
+    value.includes("\0") ||
+    win32.isAbsolute(value)
+  ) {
+    return value;
+  }
+  return undefined;
+}
+
+/**
+ * Identify a lockfile node whose `version`, `resolved`, or link target names a
+ * path outside the project root (issue #3816). A crafted package-lock.json
+ * can use such values to point at arbitrary directories and to put traversal
+ * strings into purls; a legitimate one uses them for sibling `file:` and
+ * `npm link` dependencies.
+ *
+ * Arborist reports a link's `resolved` relative to the folder holding the
+ * link, so links are judged by their absolute `realpath`. Other nodes carry
+ * `resolved` already absolutised against the lockfile, and a path-valued
+ * `version` is written relative to the lockfile, so the lockfile directory is
+ * their only base.
+ *
+ * @param {Object} node Arborist node from the virtual tree
+ * @param {string} projectRoot Directory the lockfile paths are relative to
+ *
+ * @returns {string|undefined} The offending path, relative to projectRoot when
+ *   it was absolute, or undefined when the node stays inside.
+ */
+function findOutsideNpmNodePath(node, projectRoot) {
+  const pathValues = [];
+  if (node?.isLink) {
+    if (typeof node.realpath === "string" && node.realpath) {
+      pathValues.push(node.realpath);
+    }
+  } else {
+    pathValues.push(lockfileValuePath(node?.resolved));
+  }
+  pathValues.push(lockfileValuePath(node?.version));
+  for (const pathValue of pathValues) {
+    if (pathValue === undefined) {
+      continue;
+    }
+    // `~` expands to the home directory, which never sits inside the project,
+    // and a Windows drive or UNC path read on POSIX names a foreign root.
+    if (
+      isHomeRelativePath(pathValue) ||
+      (win32.isAbsolute(pathValue) && !isAbsolute(pathValue)) ||
+      !isPathInsideProject(pathValue, projectRoot)
+    ) {
+      return isAbsolute(pathValue)
+        ? relative(projectRoot, pathValue)
+        : pathValue;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Parse nodejs package lock file
  *
@@ -880,6 +976,33 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
     options.projectRoot || dirname(pkgLockFile),
   );
   const pkgSpecVersionCache = {};
+  // Nodes whose lockfile paths point outside the project (issue #3816),
+  // reported once per lockfile after the walk instead of once per entry. In
+  // secure mode they are omitted together with the edges into them; otherwise
+  // they are kept, since sibling `file:` and `npm link` dependencies are
+  // legitimate.
+  const outsidePathEntries = [];
+  const outsidePathByNode = new Map();
+  const projectRoot = dirname(resolve(pkgLockFile));
+  const outsideNpmNodePath = (node, rootNode) => {
+    if (!node || node === rootNode) {
+      return undefined;
+    }
+    if (!outsidePathByNode.has(node)) {
+      const value = findOutsideNpmNodePath(node, projectRoot);
+      outsidePathByNode.set(node, value);
+      if (value) {
+        outsidePathEntries.push({
+          name: node.packageName || node.name || node.location,
+          value,
+        });
+      }
+    }
+    return outsidePathByNode.get(node);
+  };
+  // Every node is checked, so the default mode can still report what it kept.
+  const isOmittedNpmNode = (node, rootNode) =>
+    Boolean(outsideNpmNodePath(node, rootNode)) && isSecureMode;
   if (!safeExistsSync(pkgLockFile)) {
     return {
       pkgList,
@@ -899,6 +1022,11 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
       return { pkgList: [], dependenciesList: [] };
     }
     visited.add(node);
+    // A dependency whose lockfile paths point outside the project is omitted
+    // in secure mode (issue #3816).
+    if (isOmittedNpmNode(node, rootNode)) {
+      return { pkgList: [], dependenciesList: [] };
+    }
     let pkgList = [];
     let dependenciesList = [];
 
@@ -1315,6 +1443,9 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
     const workspaceDependsOn = [];
     if (node.fsChildren && node.fsChildren.size > 0) {
       for (const workspaceNode of node.fsChildren) {
+        if (isOmittedNpmNode(workspaceNode, rootNode)) {
+          continue;
+        }
         const {
           pkgList: childPkgList,
           dependenciesList: childDependenciesList,
@@ -1366,6 +1497,9 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
     if (node !== rootNode && !node.edgesOut.size) {
       for (const child of node.children) {
         const childNode = child[1];
+        if (isOmittedNpmNode(childNode, rootNode)) {
+          continue;
+        }
         const {
           pkgList: childPkgList,
           dependenciesList: childDependenciesList,
@@ -1398,6 +1532,9 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
     // this handles the case when a node has a ["requires"] key
     const pkgDependsOn = [];
     for (const edge of node.edgesOut.values()) {
+      if (isOmittedNpmNode(edge.to, rootNode)) {
+        continue;
+      }
       let targetVersion;
       let targetName;
       let foundMatch = false;
@@ -1666,6 +1803,26 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
     options,
   ));
 
+  if (outsidePathEntries.length) {
+    const first = outsidePathEntries[0];
+    if (isSecureMode) {
+      console.warn(
+        `WARNING: Omitted ${outsidePathEntries.length} entries of ${pkgLockFile} whose file or link paths point outside the project root; first entry "${first.name}" (${first.value}).`,
+      );
+      recordDegradation("js.lockfile-unsafe-path", {
+        ecosystem: "npm",
+        tool: "npm",
+        impact: "transitive-deps",
+        path: pkgLockFile,
+        detail: `The lockfile carries ${outsidePathEntries.length} entries with file or link paths outside the project root; secure mode omits them.`,
+      });
+    } else {
+      console.warn(
+        `WARNING: ${pkgLockFile} has ${outsidePathEntries.length} entries whose file or link paths point outside the project root; first entry "${first.name}" (${first.value}). They are kept; secure mode omits them.`,
+      );
+    }
+  }
+
   if (shouldFetchPackageMetadata() && pkgList?.length) {
     if (DEBUG_MODE) {
       console.log(
@@ -1721,12 +1878,23 @@ export function yarnLockToIdentMap(lockData) {
             // - npm:^6.0.0
             // - npm:@types/ioredis@^4.28.10
             // - npm:strip-ansi@^6.0.1
+            // - npm:@example/left-lib
             // See test cases with yarn3.lock and yarn6.lock
             if (range?.startsWith("npm:")) {
-              if (range.includes("@")) {
-                range = range.split("@").slice(-1)[0];
+              // The target of an npm: alias is `name[@range]`, so split at the
+              // last "@" beyond index 0 and a scope is never mistaken for a
+              // version separator. A bare scoped target names a package with
+              // no version; "*" is the placeholder the version lookup uses for
+              // such targets. A bare unscoped target is a tag or range of the
+              // declared package ("npm:latest"), never an alias.
+              const spec = range.slice("npm:".length);
+              const sepIdx = spec.lastIndexOf("@");
+              if (sepIdx > 0) {
+                range = spec.slice(sepIdx + 1);
+              } else if (spec.startsWith("@")) {
+                range = "*";
               } else {
-                range = range.replace("npm:", "");
+                range = spec;
               }
               if (
                 !l.includes(" ") &&
@@ -1796,6 +1964,13 @@ function _parseYarnLine(l) {
       if (aliasSepIdx > -1) {
         // Aliased dependency: use the real package name from the target.
         fullName = target.slice(0, aliasSepIdx);
+      } else if (target.startsWith("@")) {
+        // A bare scoped target names a package with no version, so the alias
+        // points at the target itself; a key line closes with ":".
+        const bareName = target.endsWith(":") ? target.slice(0, -1) : target;
+        if (bareName) {
+          fullName = bareName;
+        }
       }
     }
   }
@@ -1823,13 +1998,22 @@ function _resolveYarnDependencyBomRef(
   let packageNameToUse = packageName;
   let versionRangeToUse = versionRange;
   if (versionRange.startsWith("npm:")) {
-    if (versionRange.includes("@")) {
-      versionRangeToUse = versionRange.split("@").splice(-1)[0];
-      packageNameToUse = versionRange
-        .replace("npm:", "")
-        .replace(`@${versionRangeToUse}`, "");
+    // The target of an npm: alias is `name[@range]`, so split at the last "@"
+    // beyond index 0 and a scope is never mistaken for a version separator.
+    const spec = versionRange.slice("npm:".length);
+    const sepIdx = spec.lastIndexOf("@");
+    if (sepIdx > 0) {
+      packageNameToUse = spec.slice(0, sepIdx);
+      versionRangeToUse = spec.slice(sepIdx + 1);
+    } else if (spec.startsWith("@")) {
+      // A bare scoped target names a package with no version; the version is
+      // looked up from identMap below.
+      packageNameToUse = spec;
+      versionRangeToUse = "*";
     } else {
-      versionRangeToUse = versionRange.replace("npm:", "");
+      // A bare unscoped target is a tag or range of the declared package
+      // ("npm:latest"), never an alias.
+      versionRangeToUse = spec;
     }
   }
   let resolvedVersion =
@@ -3178,6 +3362,126 @@ export function parsePnpmAliasRef(value) {
   };
 }
 
+/**
+ * Read the patch file paths that pnpm applies, keyed by name@version.
+ *
+ * The lockfile records only the hash of each patch. The paths live in the
+ * `patchedDependencies` of pnpm-workspace.yaml, or in the `pnpm` field of
+ * package.json for projects that predate pnpm-workspace.yaml settings.
+ *
+ * @param {string} projectDir Directory holding the lockfile
+ *
+ * @returns {Object} Patch file path by name@version
+ */
+function readPnpmPatchFiles(projectDir) {
+  const patchFiles = {};
+  const sources = [
+    ["pnpm-workspace.yaml", (data) => _load(data)?.patchedDependencies],
+    ["package.json", (data) => JSON.parse(data)?.pnpm?.patchedDependencies],
+  ];
+  for (const [fileName, extract] of sources) {
+    const sourceFile = join(projectDir, fileName);
+    if (!safeExistsSync(sourceFile)) {
+      continue;
+    }
+    try {
+      for (const [patchKey, patchValue] of Object.entries(
+        extract(readFileSync(sourceFile, "utf-8")) || {},
+      )) {
+        if (
+          typeof patchValue === "string" &&
+          patchValue &&
+          !patchFiles[patchKey]
+        ) {
+          patchFiles[patchKey] = patchValue;
+        }
+      }
+    } catch (_e) {
+      // A malformed settings file must not break the lockfile parse
+    }
+  }
+  return patchFiles;
+}
+
+/**
+ * Decide whether a parsed pnpm lockfile document is a boot document.
+ *
+ * Since pnpm 12 a lockfile can hold two YAML documents. The first, the boot
+ * document, records the project's config dependencies and the resolved pnpm
+ * version under its importers, and the last is the project lockfile. The
+ * boot document is recognised by these keys rather than by its position
+ * alone, and tolerates either key missing.
+ *
+ * See: https://pnpm.io/lockfile
+ *
+ * @param {Object} docObj Parsed YAML document
+ *
+ * @returns {boolean} true when the document looks like a boot document
+ */
+export function isPnpmBootDocument(docObj) {
+  const importers = docObj?.importers;
+  if (!importers || typeof importers !== "object") {
+    return false;
+  }
+  for (const importer of Object.values(importers)) {
+    if (
+      importer &&
+      typeof importer === "object" &&
+      ("configDependencies" in importer ||
+        "packageManagerDependencies" in importer)
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Find which pnpm catalog pinned each dependency of the workspace.
+ *
+ * A lockfile importer records the specifier next to the resolved version,
+ * and a specifier of `catalog:` or `catalog:<name>` means the version came
+ * from the default or the named catalog of pnpm-workspace.yaml. The lockfile
+ * is enough, so the workspace file is not read.
+ *
+ * @param {Object} importers The importers section of a pnpm lockfile
+ *
+ * @returns {Object} Sorted catalog names, keyed by name@version
+ */
+function collectPnpmCatalogUsage(importers) {
+  const usage = {};
+  if (!importers || typeof importers !== "object") {
+    return {};
+  }
+  for (const importer of Object.values(importers)) {
+    for (const section of [
+      "dependencies",
+      "devDependencies",
+      "optionalDependencies",
+    ]) {
+      for (const [depName, depEntry] of Object.entries(
+        importer?.[section] || {},
+      )) {
+        const specifier = depEntry?.specifier;
+        if (
+          typeof specifier !== "string" ||
+          !specifier.startsWith("catalog:") ||
+          typeof depEntry.version !== "string"
+        ) {
+          continue;
+        }
+        const catalogName = specifier.slice("catalog:".length).trim();
+        const key = `${depName}@${depEntry.version.split("(")[0]}`;
+        usage[key] = usage[key] || new Set();
+        usage[key].add(catalogName || "default");
+      }
+    }
+  }
+  return Object.fromEntries(
+    Object.entries(usage).map(([key, names]) => [key, [...names].sort()]),
+  );
+}
+
 /**
  * Parse nodejs pnpm lock file
  *
@@ -3185,7 +3489,6 @@ export function parsePnpmAliasRef(value) {
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceCatalogs Workspace catalogs
  * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  * @param {string} projectRoot Root path used to relativize pnpm-lock evidence paths
@@ -3195,13 +3498,13 @@ export async function parsePnpmLock(
   parentComponent = null,
   workspacePackages = [],
   workspaceSrcFiles = {},
-  _workspaceCatalogs = {},
   _workspaceDirectDeps = {},
   depsWorkspaceRefs = {},
   projectRoot = undefined,
 ) {
   let pkgList = [];
   const dependenciesList = [];
+  const formulationList = [];
   const pnpmLockDir = dirname(pnpmLock);
   const pnpmEvidenceRoot = projectRoot ? resolve(projectRoot) : pnpmLockDir;
   const npmrcConfig = loadNpmrcConfig(projectRoot || pnpmLockDir);
@@ -3245,13 +3548,15 @@ export async function parsePnpmLock(
   }
   if (safeExistsSync(pnpmLock)) {
     const lockData = readFileSync(pnpmLock, "utf8");
-    let yamlObj = parseAllDocuments(lockData);
-    if (!yamlObj) {
+    const yamlDocs = parseAllDocuments(lockData);
+    if (!yamlDocs) {
       return {};
     }
-    if (Array.isArray(yamlObj)) {
+    let yamlObj = yamlDocs;
+    if (Array.isArray(yamlDocs)) {
       try {
-        yamlObj = yamlObj[yamlObj.length - 1].toJS();
+        // The project lockfile is always the last document
+        yamlObj = yamlDocs[yamlDocs.length - 1].toJS();
       } catch (_e) {
         recordDegradation("js.pnpm-lock-unparseable", {
           ecosystem: "npm",
@@ -3265,12 +3570,44 @@ export async function parsePnpmLock(
         return {};
       }
     }
+    // Earlier documents can hold a boot document with the project's config
+    // dependencies and the resolved pnpm version. It is detected by shape,
+    // and a malformed document must not break the project parse.
+    let bootDocObj = null;
+    if (Array.isArray(yamlDocs) && yamlDocs.length > 1) {
+      for (const yamlDoc of yamlDocs.slice(0, -1)) {
+        let docObj;
+        try {
+          docObj = yamlDoc.toJS();
+        } catch (_e) {
+          continue;
+        }
+        if (isPnpmBootDocument(docObj)) {
+          bootDocObj = docObj;
+          break;
+        }
+      }
+    }
     lockfileVersion = yamlObj.lockfileVersion;
     try {
       lockfileVersion = Number.parseFloat(lockfileVersion, 10);
     } catch (_e) {
       // ignore parse errors
     }
+    // The lockfile's patchedDependencies maps name@version to a hash of the
+    // patch file; the patch file path itself lives in pnpm-workspace.yaml.
+    const patchedDependencies = {};
+    for (const [patchKey, patchValue] of Object.entries(
+      yamlObj.patchedDependencies || {},
+    )) {
+      if (typeof patchValue === "string" && patchValue) {
+        patchedDependencies[patchKey] = patchValue;
+      }
+    }
+    const patchFiles = Object.keys(patchedDependencies).length
+      ? readPnpmPatchFiles(pnpmLockDir)
+      : {};
+    const catalogUsage = collectPnpmCatalogUsage(yamlObj.importers);
     Object.assign(
       gitPkgRefs,
       buildPnpmGitPkgRefs(
@@ -3346,6 +3683,11 @@ export async function parsePnpmLock(
           githubServerHost,
           npmrcConfig,
         );
+        // Dev dependencies are still edges from the root: a monorepo root often
+        // declares only devDependencies (the build tooling), and without this
+        // edge the root component under-reports what the install pulls in.
+        // See #2020.
+        ddeplist.add(dpurl);
         possibleDevelopmentDeps[dpurl] = true;
       }
       // Find the root optional and peer dependencies
@@ -3414,6 +3756,15 @@ export async function parsePnpmLock(
           {};
         const componentPeerDeps =
           yamlObj?.importers[importedComponentName]["peerDependencies"] || {};
+        if (
+          DEBUG_MODE &&
+          !Object.keys(componentDeps).length &&
+          Object.keys(componentDevDeps).length
+        ) {
+          console.log(
+            `The workspace ${importedComponentName} declares only devDependencies, so its dependency tree is scoped as development. --required-only will exclude these components.`,
+          );
+        }
         let compPurl;
         let pkgSrcFile;
         let fallbackMode = true;
@@ -3915,6 +4266,35 @@ export async function parsePnpmLock(
               value: deprecatedMessage,
             });
           }
+          const patchKey = `${group ? `${group}/${name}` : name}@${version}`;
+          const patchHash = patchedDependencies[patchKey];
+          if (patchHash) {
+            // The component keeps its upstream purl, so vulnerability matching
+            // sees the published version the patch was applied to. See #803.
+            properties.push({
+              name: "cdx:pnpm:patched",
+              value: "true",
+            });
+            properties.push({
+              name: "cdx:pnpm:patchHash",
+              value: patchHash,
+            });
+            if (patchFiles[patchKey]) {
+              properties.push({
+                name: "cdx:pnpm:patchFile",
+                value: patchFiles[patchKey],
+              });
+            }
+          }
+          const catalogNames = catalogUsage[patchKey];
+          if (catalogNames?.length) {
+            // The version is pinned by a catalog entry in pnpm-workspace.yaml
+            // and not by the importer's own package.json. See #4611.
+            properties.push({
+              name: "cdx:pnpm:catalog",
+              value: catalogNames.join(","),
+            });
+          }
           const binary_metadata = { os, cpu, libc };
           Object.entries(binary_metadata).forEach(([key, value]) => {
             if (!value) return;
@@ -4045,6 +4425,108 @@ export async function parsePnpmLock(
         }
       }
     }
+    // Config dependencies and the resolved pnpm version live in the boot
+    // document. pnpm installs config dependencies before anything else and
+    // they may run hooks, so they are reported as components even though
+    // they are not part of the project dependency graph.
+    if (bootDocObj) {
+      const bootImporter = bootDocObj.importers?.["."];
+      const configDeps = bootImporter?.configDependencies;
+      if (configDeps && typeof configDeps === "object") {
+        for (const [depName, depEntry] of Object.entries(configDeps)) {
+          const version =
+            typeof depEntry === "string" ? depEntry : depEntry?.version;
+          if (!depName || !version || protoLockKey.test(depName)) {
+            continue;
+          }
+          let group = "";
+          let name = depName;
+          const slashIdx = name.indexOf("/");
+          if (name.startsWith("@") && slashIdx > 0) {
+            group = name.slice(0, slashIdx);
+            name = name.slice(slashIdx + 1);
+          }
+          const purlString = build({
+            type: "npm",
+            namespace: group || null,
+            name,
+            version,
+          });
+          const bomRef = decodeURIComponent(purlString);
+          const bootLockKey = `${depName}@${version}`;
+          const bootEntry =
+            bootDocObj.packages?.[bootLockKey] ||
+            bootDocObj.snapshots?.[bootLockKey];
+          const existingPkg = pkgRefMap[bomRef];
+          if (existingPkg) {
+            // The package is also a runtime dependency of the project, so
+            // keep that component and record the additional config role.
+            existingPkg.properties = existingPkg.properties || [];
+            if (
+              !existingPkg.properties.some(
+                (p) => p.name === "cdx:pnpm:configDependency",
+              )
+            ) {
+              existingPkg.properties.push({
+                name: "cdx:pnpm:configDependency",
+                value: "true",
+              });
+            }
+          } else {
+            const thePkg = {
+              group,
+              name,
+              version,
+              purl: purlString,
+              "bom-ref": bomRef,
+              type: "library",
+              _integrity: bootEntry?.resolution?.integrity,
+              properties: [
+                { name: "internal:SrcFile", value: pnpmLockSrcFile },
+                { name: "cdx:pnpm:configDependency", value: "true" },
+              ],
+              evidence: {
+                identity: {
+                  field: "purl",
+                  confidence: 1,
+                  methods: [
+                    {
+                      technique: "manifest-analysis",
+                      confidence: 1,
+                      value: pnpmLockSrcFile,
+                    },
+                  ],
+                },
+              },
+            };
+            pkgList.push(thePkg);
+            pkgRefMap[bomRef] = thePkg;
+          }
+        }
+      }
+      const pnpmVersion =
+        bootImporter?.packageManagerDependencies?.pnpm?.version;
+      if (pnpmVersion) {
+        // The pnpm version resolved for this project belongs next to the
+        // other build tools in the formulation section. Like the toolchain
+        // components there, it carries no bom-ref so that it cannot collide
+        // with the document's bom-ref namespace.
+        formulationList.push({
+          type: "application",
+          name: "pnpm",
+          version: pnpmVersion,
+          purl: build({
+            type: "npm",
+            namespace: null,
+            name: "pnpm",
+            version: pnpmVersion,
+          }),
+          description:
+            "pnpm version resolved for this project, read from the lockfile boot document.",
+          properties: [{ name: "internal:SrcFile", value: pnpmLockSrcFile }],
+        });
+      }
+    }
   }
   // We need to repeat optional packages detection
   if (Object.keys(possibleOptionalDeps).length) {
@@ -4192,17 +4674,18 @@ export async function parsePnpmLock(
       );
     }
     pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
-    return {
-      pkgList,
-      dependenciesList,
-      parentSubComponents,
-    };
   }
-  return {
+  const result = {
     pkgList,
     dependenciesList,
     parentSubComponents,
   };
+  // Reported only when the boot document contributed, so that lockfiles
+  // without one keep producing the result shape they always did.
+  if (formulationList.length) {
+    result.formulationList = formulationList;
+  }
+  return result;
 }
 
 /**