JavaScript for open source

Snyk for JavaScript support

Refer to the JavaScript details for supported package managers and features.

Open source and licensing

The following summarizes Snyk Open Source support for npm, pnpm and Yarn, and partial support for Lerna.

npm

The following table provides a matrix for npm lockfile versions and Snyk features availability.

Peer dependencies

In npm v7 and above, the behavior of peer dependencies changes if they are being installed by default. To match this in npm v7+ projects, Snyk assumes peer dependencies are installed and scans them by default.

An npm v7+ project ignores peer dependencies only if they are explicitly marked as optional in the peerDependenciesMeta object in the package.json as shown here for cache-manager:

{
    ...
    "peerDependenciesMeta": {
        "cache-manager": {
            "optional": true
        }
    },
    ...
}

In npm v6 and below, peer dependencies are not scanned by default, as the package manager does not install them by default. To scan peer dependencies, ensure they are installed, and then run the CLI with the --peer-dependencies option.

Lockfile versions

Snyk uses the package-lock.json lockfile when present to generate a dependency tree for your project. These lockfiles come in different versions.

Lockfile v1 was used in npm v5 and v6. Two new formats were introduced in npm v7 - lockfile v2 and lockfile v3. For more information, see lockfileVersion.

You can see which lockfile format you are using in the package-lock.json, as follows:

{
    ...
    "lockfileVersion": 3,
    ...
}

If you want to force npm to create a specific lockfile version, use the npm --lockfile-version parameter.

npm install --lockfile-version=2

pnpm

The following table shows a matrix of pnpm versions and Snyk features availability.

Lockfile versions

Snyk uses the pnpm-lock.yaml lockfile to generate a dependency tree for your project.

The supported lockfile versions are 5.4, 6.x and 9.x, corresponding to pnpm 7, 8 and 9.

pnpm lockfiles do not include bundledDependencies, so Snyk does not include them in scans.

Yarn

Snyk uses the Yarn lockfile (yarn.lock) to generate a representation of project dependencies.

The files Snyk relies on to scan a project may change on version upgrades of the package manager. Snyk lists only versions verified internally as supported.

If you are using a newer version of Yarn than is listed on this page, you may find Snyk performs as expected because Yarn is using a lockfile version that is already supported. That version of Yarn has likely not been evaluated and, thus, not added to this page.

The following table shows the Yarn versions and Snyk features availability matrix.

Lerna

Snyk does not fully support Lerna. If your project is set up using Yarn Workspaces, you can scan the project in the same way you scan any Yarn Workspaces project.

If your Lerna project is set up using Yarn Workspaces, you can run snyk test and snyk monitor as follows.

For each example package, you can use the following:

snyk monitor --file=packages/example-package/package.json

Alternatively, you can specify a script to automate scanning of nested package.json files:

ls packages | xargs -I PKG_NAME snyk monitor --file=packages/PKG_NAME/package.json

Steps to start scanning using npm, pnpm and Yarn

The following table lists the steps to start scanning your dependencies. It covers basic commands, such as snyk test and snyk monitor. For a full list of CLI commands, see the CLI commands and options summary.

Support for monorepos and workspaces

Yarn, npm, and pnpm support workspaces, to help manage monorepos containing multiple sub-projects.

Workspaces are supported in the Snyk CLI for the following CLI options:

• --all-projects : Discover and scan all Yarn, npm and pnpm workspaces projects, along with projects from other supported ecosystems. The root lock file is referenced when scanning the workspace projects.