pnpm-lock.yaml with Bomdesk
This opens a small pnpm-lock.yaml (lockfile version 9). Press Scan to look up licences and known advisories for every package it lists, then download the SBOM.
- Paste pnpm-lock.yaml or drop it on the box.
- Press Scan for licences and advisories.
- Download the SBOM as CycloneDX or SPDX.
- Use the Policy tab (Pro) to fail on licence classes you do not allow.
What to know
pnpm-lock.yaml lists every package under packages: with its exact version. It does not record licences, so the lookup is what fills them in. Bomdesk reads the package list from lockfile versions 5 to 9, strips the peer-dependency suffixes pnpm adds to some entries, and leaves out workspace and local file packages.
The file does not say which packages are direct dependencies, so Bomdesk does not claim to know: the direct and transitive split is left out for pnpm rather than guessed. Dev-only flags exist only in older lockfile versions and are shown when present.
On a test project the package list matched the folders pnpm itself created in node_modules/.pnpm, 248 of 248, and older lockfile keys (versions 5 and 6) were checked on small examples, including scoped packages and dev flags.
Updated · Cosmovex
Questions
Does pnpm-lock.yaml contain licences?
No. Licences are looked up by package name and version, which is why Scan sends those two values to deps.dev.
Are peer-dependency variants listed twice?
No. pnpm records a package once per peer set. Bomdesk lists each name and version once.
Does it read workspaces?
It reads the package list of the lockfile you paste. Workspace members themselves are your own code and are skipped.
Which pnpm lockfile versions are read?
Package entries from lockfile versions 5 to 9 are read, including the older slash-separated keys and the peer-dependency suffixes.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
