pnpm

osv-scanner in Practice — pnpm, Ignoring CVEs, Offline Mode, and the Errors You Hit

Only the second-day questions, answered against the official docs. pnpm-lock.yaml is supported; ignores live in osv-scanner.toml under IgnoredVulns and can carry an expiry; offline mode is three flags with three different jobs. This site's view: a scanner reports known vulnerabilities, and says nothing about a version you pinned yourself going stale — that needs a separate mechanism.