fix(pnpm): strip leading slashes from pnpm v9 package keys

[Kunal241207]

What changed and why

In pnpm-lock.yaml v9 lockfiles, package snapshot keys and dependency references can start with a leading slash (for example, '/@babel/core@7.20.0': {}).

Previously, parsePnpmPackageKeyV9 and normalizePnpmDepRefV9 stripped peer-dependency suffixes (e.g. (foo@1.0.0)), but did not strip leading slashes / (unlike parsePnpmPackageKey for v5–v8 lockfiles). As a result, package names were stored with leading slashes (e.g., "/@babel/core"). When cve-lite queried advisory sources (OSV / local DB) for @babel/core, lookups failed to match, causing affected packages to bypass vulnerability scanning.

This PR updates parsePnpmPackageKeyV9 and normalizePnpmDepRefV9 in src/parsers/pnpm-lock.ts to normalize keys by stripping leading slashes (replace(/^\//, "")), matching legacy pnpm lockfile parsing, and adds test coverage in tests/parsers/pnpm-lock.test.ts.

Closes #1012

[sonukapoor]

Thanks for this - the core fix is correct. Two small asks before we merge:

Restore the comments that were removed from these lines - the split("(")[0] for stripping peer-dep suffixes is not obvious to someone reading cold:

// strip leading slash (pnpm v9 can emit /\@babel/core\@7.20.0) then peer-dep suffix (pkg\@1.0.0(peer\@2.0.0))
const cleaned = key.replace(/^\//, "").split("(")[0];
if (idx <= 0) return null; // no @ or @ is the first char (scoped package name only)

Two more test cases - the scoped case is covered but please add:

• /express\@4.18.2 (non-scoped with leading slash - simplest form of the bug)
• express\@4.18.2 (no slash - explicit regression confirming pnpm v8 keys are unaffected)

Quick fixes, then this is good to go.

[Kunal241207]

Thanks for this - the core fix is correct. Two small asks before we merge:

Restore the comments that were removed from these lines - the split("(")[0] for stripping peer-dep suffixes is not obvious to someone reading cold:

// strip leading slash (pnpm v9 can emit /\@babel/core\@7.20.0) then peer-dep suffix (pkg\@1.0.0(peer\@2.0.0))
const cleaned = key.replace(/^\//, "").split("(")[0];
if (idx <= 0) return null; // no @ or @ is the first char (scoped package name only)

Two more test cases - the scoped case is covered but please add:

• /express\@4.18.2 (non-scoped with leading slash - simplest form of the bug)
• express\@4.18.2 (no slash - explicit regression confirming pnpm v8 keys are unaffected)

Quick fixes, then this is good to go.

Done.