feat(pnpm): add support of Lockfile v9

[DmitriyLewen]

Description

pnpm released lockfile v9 (see pnpm/pnpm#7666, pnpm/pnpm#7861).
We need to add support for this.

Discussed in #6503

[DmitriyLewen]

I created pnpm/spec#6 about specification for lockfile v9.

[bcurtin144]

One issue I've noticed is that Trivy is treating all @types/[package] entries as if they are the package.

For example, with lockfileVersion: '6.0' the YAML for nodemailer and @types/nodemailer are:

packages:
  /@types/nodemailer@6.4.14:
    resolution: {integrity: sha512-fUWthHO9k9DSdPCSPRqcu6TWhYyxTBg382vlNIttSe9M7XfsT06y0f24KHXtbnijPGGRIcVvdKHTNikOI6qiHA==}
    dependencies:
      '@types/node': 20.12.4
    dev: true

  /nodemailer@6.9.13:
    resolution: {integrity: sha512-7o38Yogx6krdoBf3jCAqnIN4oSQFx+fMa0I7dK1D+me9kBxx12D+/33wSb+fhOCtIxvYJ+4x4IMEhmhCKfAiOA==}
    engines: {node: '>=6.0.0'}
    dev: false

Trivy does not detect any problems with these packages. But with lockfileVersion: '9.0', the YAML has become

packages:
  '@types/nodemailer@6.4.14':
    resolution: {integrity: sha512-fUWthHO9k9DSdPCSPRqcu6TWhYyxTBg382vlNIttSe9M7XfsT06y0f24KHXtbnijPGGRIcVvdKHTNikOI6qiHA==}

  nodemailer@6.9.13:
    resolution: {integrity: sha512-7o38Yogx6krdoBf3jCAqnIN4oSQFx+fMa0I7dK1D+me9kBxx12D+/33wSb+fhOCtIxvYJ+4x4IMEhmhCKfAiOA==}
    engines: {node: '>=6.0.0'}

snapshots:
  '@types/nodemailer@6.4.14':
    dependencies:
      '@types/node': 20.12.7

  nodemailer@6.9.13: {}

When Trivy runs on this file, the output includes

├────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ nodemailer │ CVE-2020-7769       │ CRITICAL │        │ 6.4.14            │ 6.4.16               │ This affects the package nodemailer before 6.4.16. Use of    │
│            │                     │          │        │                   │                      │ crafted reci ......                                          │
│            │                     │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2020-7769                    │
│            ├─────────────────────┼──────────┤        │                   ├──────────────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2021-23400      │ MEDIUM   │        │                   │ 6.6.1                │ The package nodemailer before 6.6.1 are vulnerable to HTTP   │
│            │                     │          │        │                   │                      │ Header Inje ......                                           │
│            │                     │          │        │                   │                      │ https://avd.aquasec.com/nvd/cve-2021-23400                   │
│            ├─────────────────────┤          │        │                   ├──────────────────────┼──────────────────────────────────────────────────────────────┤
│            │ GHSA-9h6g-pr28-7cqp │          │        │                   │ 6.9.9                │ nodemailer ReDoS when trying to send a specially crafted     │
│            │                     │          │        │                   │                      │ email                                                        │
│            │                     │          │        │                   │                      │ https://github.com/advisories/GHSA-9h6g-pr28-7cqp            │
└────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────┴──────────────────────────────────────────────────────────────┘

[anbraten]

Am I right that there should be a check added for the version arround:

trivy/pkg/dependency/parser/nodejs/pnpm/parse.go

Line 56 in a5d485c

lockVer := p.parseLockfileVersion(lockFile)