IDETECT-5225 : Fix pnpm 11 multi-document lockfile parsing selecting wrong dependency section

[bd-spratikbharti]

Description

Problem

pnpm 11 introduced a new lockfile format with two sections (YAML documents) separated by ---:

• Document 1: environment metadata / config dependencies
• Document 2: actual project dependencies

Both documents can contain a lockfileVersion field. The parser was picking the first document it found with lockfileVersion, which meant it extracted config dependencies instead of real project dependencies.

Solution

Changed the document selection logic to be position-based instead of content-based:

• Single-document lockfiles (pnpm versions before 11) → use that document directly
• Multi-document lockfiles (pnpm 11+) → use the last document, which contains the real dependencies

This ensures we extract the correct dependencies while maintaining backward compatibility with older lockfile formats.

Testing

• Added test case with both documents having lockfileVersion
• Verified correct dependencies extracted from document 2
• All 32 existing pnpm tests pass (zero regressions)

[Copilot]

Pull request overview

This PR updates Detect’s pnpm lockfile parsing to correctly handle pnpm 11’s multi-document pnpm-lock.yaml format by selecting the dependency document deterministically, and adds regression coverage for the case where both YAML documents contain lockfileVersion.

Changes:

• Update pnpm multi-document lockfile document selection to use a position-based rule (choose the last document when multiple are present).
• Add a new functional test and a pnpm 11 multi-document fixture where both documents include lockfileVersion.
• Update the “current release notes” markdown content.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
documentation/src/main/markdown/currentreleasenotes.md	Updates current release notes content (notices + 12.0.0 entries).
detectable/src/main/java/com/blackduck/integration/detectable/detectables/pnpm/lockfile/process/PnpmLockYamlParserInitial.java	Selects the correct YAML document in pnpm 11+ multi-document lockfiles by choosing the last parsed lockfile document.
detectable/src/test/java/com/blackduck/integration/detectable/detectables/pnpm/functional/PnpmLockYamlParserMultiDocTest.java	Adds regression test ensuring the parser selects the correct document when both documents include lockfileVersion.
detectable/src/test/resources/detectables/functional/pnpm/v11-multi-doc-both-versions/pnpm-lock.yaml	Adds a pnpm 11 multi-document lockfile fixture where document 1 is a “trap” and document 2 contains real dependencies.

Files not reviewed (1)

• detectable/src/test/resources/detectables/functional/pnpm/v11-multi-doc-both-versions/pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.