bug(pnpm): Trivy doesn't detect licenses for packages when ID contains peer deps

[DmitriyLewen]

Description

To create unique IDs, we started using the snapshot instead of the Trivy ID — #9330.
But package.json files (from the node_modules directory) don’t have peer dependencies in the package name.
So we can’t match the pkg.ID with the peer dependencies and license.
e.g.:
found package:

        {
          "ID": "@vue/server-renderer@3.5.22(vue@3.5.22)",
          "Name": "@vue/server-renderer",
          "Identifier": {
            "PURL": "pkg:npm/%40vue/server-renderer@3.5.22",
            "UID": "d42cdcee2561bb3d"
          },
          "Version": "3.5.22",
          "Indirect": true,
          "Relationship": "indirect",
          "DependsOn": [
            "@vue/compiler-ssr@3.5.22",
            "@vue/shared@3.5.22",
            "vue@3.5.22"
          ]
        },

node_modules/@vue/server-renderer/package.json:

Solution

We use dependency.ID for package.json files:

trivy/pkg/dependency/parser/nodejs/packagejson/parse.go

Line 55 in 404abb3

id = dependency.ID(ftypes.NodePkg, pkgJSON.Name, pkgJSON.Version)

So we need to use the same logic to match packages when finding licenses.

Discussed in #9658