fix(audit): audit should work even if there are no package.json files (#6283)

.changeset/friendly-ducks-lick.md

@@ -0,0 +1,6 @@
+---
+"@pnpm/audit": patch
+"pnpm": patch
+---
+
+`pnpm audit` should work even if there are no `package.json` file, just a `pnpm-lock.yaml` file.

lockfile/audit/package.json

@@ -29,6 +29,9 @@
     "url": "https://github.com/pnpm/pnpm/issues"
   },
   "homepage": "https://github.com/pnpm/pnpm/blob/main/lockfile/audit#readme",
+  "peerDependencies": {
+    "@pnpm/logger": "^5.0.0"
+  },
   "devDependencies": {
     "@pnpm/audit": "workspace:*",
     "@pnpm/constants": "workspace:*",

lockfile/audit/src/index.ts

@@ -3,6 +3,7 @@ import { PnpmError } from '@pnpm/error'
 import { type AgentOptions, fetchWithAgent, type RetryTimeoutOptions } from '@pnpm/fetch'
 import { type GetAuthHeader } from '@pnpm/fetching-types'
 import { type Lockfile } from '@pnpm/lockfile-types'
+import { globalWarn } from '@pnpm/logger'
 import { type DependenciesField } from '@pnpm/types'
 import { lockfileToAuditTree } from './lockfileToAuditTree'
 import { type AuditReport } from './types'
@@ -47,11 +48,16 @@ export async function audit (
     throw new PnpmError('AUDIT_BAD_RESPONSE', `The audit endpoint (at ${auditUrl}) responded with ${res.status}: ${await res.text()}`)
   }
   const auditReport = await (res.json() as Promise<AuditReport>)
-  return extendWithDependencyPaths(auditReport, {
-    lockfile,
-    lockfileDir: opts.lockfileDir,
-    include: opts.include,
-  })
+  try {
+    return await extendWithDependencyPaths(auditReport, {
+      lockfile,
+      lockfileDir: opts.lockfileDir,
+      include: opts.include,
+    })
+  } catch (err: any) { // eslint-disable-line
+    globalWarn(`Failed to extend audit report with dependency paths: ${err.message as string}`)
+    return auditReport
+  }
 }
 
 function getAuthHeaders (authHeaderValue: string | undefined) {

lockfile/audit/src/lockfileToAuditTree.ts

@@ -3,7 +3,7 @@ import { type Lockfile, type TarballResolution } from '@pnpm/lockfile-types'
 import { nameVerFromPkgSnapshot } from '@pnpm/lockfile-utils'
 import { lockfileWalkerGroupImporterSteps, type LockfileWalkerStep } from '@pnpm/lockfile-walker'
 import { type DependenciesField } from '@pnpm/types'
-import { readProjectManifest } from '@pnpm/read-project-manifest'
+import { safeReadProjectManifestOnly } from '@pnpm/read-project-manifest'
 import mapValues from 'ramda/src/map'
 
 export interface AuditNode {
@@ -36,12 +36,12 @@ export async function lockfileToAuditTree (
       // For some reason the registry responds with 500 if the keys in dependencies have slashes
       // see issue: https://github.com/pnpm/pnpm/issues/2848
       const depName = importerWalker.importerId.replace(/\//g, '__')
-      const { manifest } = await readProjectManifest(path.join(opts.lockfileDir, importerWalker.importerId))
+      const manifest = await safeReadProjectManifestOnly(path.join(opts.lockfileDir, importerWalker.importerId))
       dependencies[depName] = {
         dependencies: importerDeps,
         dev: false,
         requires: toRequires(importerDeps),
-        version: manifest.version ?? '0.0.0',
+        version: manifest?.version ?? '0.0.0',
       }
     })
   )