Parsing yarn.lock fails to identify the currect package and version combinations

[AMoo-Miki]

What happened:
Extracting packages from this yarn.lock file failed to identify the correct and complete packages.

The output contained:

 ✔ Indexed ../syft-and-yarn-workspaces
 ✔ Cataloged packages      [3 packages]
NAME                      VERSION  TYPE
async                     0.9.2    npm
resize-observer-polyfill  1.5.2    npm
should-type               1.3.0    npm

What you expected to happen:
I expected to see both versions of async and the correct resize-observer-polyfil package:

 ✔ Indexed ../syft-and-yarn-workspaces
 ✔ Cataloged packages      [4 packages]
NAME                             VERSION  TYPE
@4lolo/resize-observer-polyfill  1.5.2    npm
async                            0.9.2    npm
async                            3.2.3    npm
should-type                      1.3.0    npm

How to reproduce it (as minimally and precisely as possible):

mkdir /tmp/yarn-workspace && cd /tmp/yarn-workspace
git clone https://github.com/AMoo-Miki/syft-and-yarn-workspaces.git .
syft .

Anything else we need to know?:
There are 2 problems in the above example but I want to propose a common solution to solve them both.

Why do I have 2 async versions?
Working in a Yarn workspace, I can have different versions of the same package across my dependencies. yarn.lock would list both of them.

Why am I overriding the package?

One method of mitigating vulnerable nested dependencies or working around problems with abandoned nested dependencies is to replace them with a forked and fixed release. My sample code is extracted from a much larger code that has the abandoned resize-observer-polyfill deeply nested in its dependencies, which I was forced to replace with @4lolo/resize-observer-polyfill, a forked and fixed release.

What am I proposing?
Depend solely on "resolved" URLs for those entries that are pulled from registry.yarnpkg.com; as in ^\s+resolved\s+"https://registry.yarnpkg.com/(.+?)/-/(?:.+?)-(\d+\..+?)\.tgz.

Environment:

• Output of syft version: 0.42.4
• OS (e.g: cat /etc/os-release or similar):
  • Ubuntu 20.04.2 LTS
  • macOS 12.2.1

[spiffcs]

@AMoo-Miki It looks like this has been fixed with the latest version:

I pulled down git clone https://github.com/AMoo-Miki/syft-and-yarn-workspaces.git

Ran syft against it:

The expected packages are now showing up.

If there is anything incorrect about this output or a bug is still present please feel free to tag me and I'll reopen this.