Package Coverage Issue

post by Menna_Ahmed on Nov 30, 2025

Menna Ahmed

Hi there,

I’m facing an issue with Sonatype Lifecycle when scanning with pnpm. When the target file is pnpm-lock.yaml, the scan seems to only report direct dependencies and doesn’t capture most transitive packages. For example, the Axios package was missed in the scan.

Has anyone else experienced this behavior, or is there a recommended workaround?

post by alindley on Dec 1, 2025

Alex Lindley

Hello,

For best results, Sonatype recommends scanning both the ‘pnpm-lock.yaml’ and its corresponding ‘package.json’ file together. This allows Lifecycle to build the dependency hierarchy tree and accurately present the direct and transitive dependencies.

You can read more on JavaScript scanning with Lifecycle here.

As a Sonatype Lifecycle customer you can reach out to your local Sonatype admin who can raises questions directly to our Sonatype Customer Success or Support teams.

Regards,

Alex

post by Menna_Ahmed on Jun 22

Menna Ahmed

Hi Alex,

Thanks a lot for your reply. Kindly note that both files (pnpm-lock.yaml + package.json) are available in the repo. However, it has been noticed that the tool covers only the dependencies not the devDependencies. Therefore, I would appreciate it if you’ve any recommendations to solve such an issue.