Repository navigation
fix: fail scan on a truncated lockfile - #435
Merged
Merged
Conversation
vg build already stopped when a lockfile was truncated. vg scan did not: a nested package-lock.json, yarn.lock, or pnpm-lock.yaml was treated as absent, or the code-map step was skipped, and the command exited 0. Check in-scope lockfiles before drift scoring and before parse workers start, including vg scan --no-graph. The error names the file and the format and does not include file contents. When several lockfiles are invalid, the path that sorts first is the one reported. Closes #310 Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
A truncated or syntactically invalid lockfile fails before a dependency graph is built and before source parse workers start. The error names each bad file in path order, omits the file contents, and exits non-zero. An empty go.sum or go.work.sum remains valid. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com> # Conflicts: # CHANGELOG.md Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com> # Conflicts: # src/cli.ts Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com> # Conflicts: # src/reporting/commands/scan.ts Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
vibgrate-team
marked this pull request as ready for review
October 11, 2026 13:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vg scanandvg buildnow stop when a lockfile is truncated or not valid syntax, before a partial dependency graph is built and before parse workers start.The error names every bad lockfile in path order and tells you to regenerate it with your package manager. It does not echo lockfile contents, and the process exits non-zero without writing scan or graph output. A valid lockfile scans and builds as before.
This covers
package-lock.json,pnpm-lock.yaml,yarn.lockand the other supported lockfiles (Cargo, Python, Gradle, Ruby, PHP, Dart, Swift, Bun, Deno, Go and more). An emptygo.sumorgo.work.sumis still valid, and a lockfile ignored by the root.gitignoreis not treated as part of the project.Related issues
Closes #310
Checklist
pnpm testpassespnpm lintis cleanpnpm typecheckis cleanHow to verify
pnpm test pnpm lint pnpm typecheck