JavaScript for open source
Last updated
Last updated
More information
Snyk privacy policy© 2024 Snyk Limited | All product and company names and logos are trademarks of their respective owners.
Refer to the JavaScript details for supported package managers and features.
Only official releases are tracked. Commits, including into the default branch, are not identified unless included in an official release or tag.
In the case of JavaScript packages this means a release to the npmjs package registry.
The following summarizes Snyk Open Source support for npm, pnpm and Yarn, and partial support for Lerna.
The following table provides a matrix for npm lockfile versions and Snyk features availability.
Lockfile version | CLI support | Git support | License scanning | Fix PRs |
---|---|---|---|---|
In npm v7 and above, the behavior of peer dependencies changes if they are being installed by default. To match this in npm v7+ projects, Snyk assumes peer dependencies are installed and scans them by default.
An npm v7+ project ignores peer dependencies only if they are explicitly marked as optional in the peerDependenciesMeta
object in the package.json
as shown here for cache-manager
:
In npm v6 and below, peer dependencies are not scanned by default, as the package manager does not install them by default. To scan peer dependencies, ensure they are installed, and then run the CLI with the --peer-dependencies
option.
Snyk uses the package-lock.json
lockfile when present to generate a dependency tree for your project. These lockfiles come in different versions.
Lockfile v1 was used in npm v5 and v6. Two new formats were introduced in npm v7 - lockfile v2 and lockfile v3. For more information, see lockfileVersion.
You can see which lockfile format you are using in the package-lock.json
, as follows:
If you want to force npm to create a specific lockfile version, use the npm --lockfile-version
parameter.
Release status
Snyk CLI pnpm support is in Early Access.
Enable it using Snyk Preview and install CLI v1.1293.0 or later.
The following table shows a matrix of pnpm versions and Snyk features availability.
Lockfile versions
Snyk uses the pnpm-lock.yaml
lockfile to generate a dependency tree for your project.
The supported lockfile versions are 5.4, 6.x and 9.x, corresponding to pnpm 7, 8 and 9.
pnpm lockfiles do not include bundledDependencies, so Snyk does not include them in scans.
Snyk uses the Yarn lockfile (yarn.lock
) to generate a representation of project dependencies.
The files Snyk relies on to scan a project may change on version upgrades of the package manager. Snyk lists only versions verified internally as supported.
If you are using a newer version of Yarn than is listed on this page, you may find Snyk performs as expected because Yarn is using a lockfile version that is already supported. That version of Yarn has likely not been evaluated and, thus, not added to this page.
The following table shows the Yarn versions and Snyk features availability matrix.
Because different versions of Yarn have different feature sets, there are differences in Snyk support in order to match how the package manager works.
Resolutions are supported in Yarn v2 and above. Yarn v1 resolutions are not supported.
Snyk does not fully support Lerna. If your project is set up using Yarn Workspaces, you can scan the project in the same way you scan any Yarn Workspaces project.
If your Lerna project is set up using Yarn Workspaces, you can run snyk test
and snyk monitor
as follows.
For each example package, you can use the following:
Alternatively, you can specify a script to automate scanning of nested package.json
files:
The following table lists the steps to start scanning your dependencies. It covers basic commands, such as snyk test
and snyk monitor
. For a full list of CLI commands, see the CLI commands and options summary.
Yarn, npm, and pnpm support workspaces, to help manage monorepos containing multiple sub-projects.
Workspaces are supported in the Snyk CLI for the following CLI options:
--all-projects
: Discover and scan all Yarn, npm and pnpm workspaces projects, along with projects from other supported ecosystems. The root lock file is referenced when scanning the workspace projects.