fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json

[DmitriyLewen]

Description

Correctly detect direct dependencies when using latest version for files yarn.lock + package.json.
See #6747 for more details.

Related issues

• Close Trivy Node scan can't parse package.json when latest is used as a package version #6747

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Why is it latest? package.json specifies "js-tokens": "^9.0.0". I thought this line would be js-tokens@^9.0.0.

[DmitriyLewen]

I updated this manually to test that new logic worked correctly.

[knqyf263]

I think it's better to keep using an original file as much as possible so we can understand how it actually works.

Also, instead of using latest in the package ID, what if we return package patterns somehow and do an exact match? Or, we may want to pass package.json to the yarn lock parser.

[DmitriyLewen]

I think it's better to keep using an original file as much as possible so we can understand how it actually works.

okay, i will remove this.

Also, instead of using latest in the package ID, what if we return package patterns somehow and do an exact match? Or, we may want to pass package.json to the yarn lock parser.

Hm... i will think about this.

[DmitriyLewen]

what if we return package patterns somehow and do an exact match

@knqyf263 I implemented your idea. Take a look, when you have time.