What would you like to be added: I would like to see support for bun as a package manager to scans for dependency vulnerabilities. It has shown to be quite smooth and fast to work with for us: https://bun.com/docs/pm/cli/install
So far npm, pnpm, and yarn are supported for JavaScript, according to https://oss.anchore.com/docs/capabilities/all-packages/
Why is this needed: We're using exclusively bun in our project and the scans are not executing because it cannot interpret a bun.lock file.
Will introduce another lock file as temporary workaround for now.
Additional context: Running the scan it only shows
[0002] ERROR unable to parse yarn v2 package key from=syft key=__metadata
No vulnerabilities found.
Nothing breaks, so it just silently fails. Not sure why it's trying to find yarn. We had yarn previously in the project but it's been removed some time ago, but there might be some leftovers that made it search for yarn.
Grype version: v0.110.0
Bun version: 1.3.14
What would you like to be added: I would like to see support for
bunas a package manager to scans for dependency vulnerabilities. It has shown to be quite smooth and fast to work with for us: https://bun.com/docs/pm/cli/installSo far
npm,pnpm, andyarnare supported for JavaScript, according to https://oss.anchore.com/docs/capabilities/all-packages/Why is this needed: We're using exclusively bun in our project and the scans are not executing because it cannot interpret a
bun.lockfile.Will introduce another lock file as temporary workaround for now.
Additional context: Running the scan it only shows
Nothing breaks, so it just silently fails. Not sure why it's trying to find
yarn. We hadyarnpreviously in the project but it's been removed some time ago, but there might be some leftovers that made it search for yarn.Grype version: v0.110.0
Bun version: 1.3.14