Pnpm vulnerabilities are not shown in sonarqube about dependency-check-sonar-plugin HOT 5 OPEN

I'm having this same issue, I'm also not seeing package.json in my code in Sonarqube so I'm uncertain if it might also be the cause that it cannot link the vulnerabilities to dependencies.

I do see the html report in Sonarqube and that looks fine, I can see "OWASP-Dependency-Check" in the "Measures" tab of the project with numbers of vulnerabilities there I just can't see it linked to anything or in the Project's Security Hotspots.

from dependency-check-sonar-plugin.

I'm having this same issue, I'm also not seeing package.json in my code in Sonarqube so I'm uncertain if it might also be the cause that it cannot link the vulnerabilities to dependencies.

For npm you need the package-lock.json in your SCM as recommended by npm. https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json

This file is intended to be committed into source repositories

Please adjust sonar.sources property like in the example project.
https://github.com/dependency-check/dependency-check-sonar-plugin/blob/master/examples/single-module-nodejs/sonar-project.properties#L5
After that adjustment your vulnerabilities should be link to the package-lock.json.

from dependency-check-sonar-plugin.

pnpm-lock.yaml are currently not supported.

from dependency-check-sonar-plugin.