fatal error: stack overflow on a particular pnpm-lock.yaml #6843

marcindulak · 2024-06-03T15:31:08Z

marcindulak
Jun 3, 2024

Description

https://github.com/aquasecurity/trivy/tree/v0.52.0 fails with fatal error: stack overflow on some pnpm-lock.yaml files.

Desired Behavior

Successful scan

Actual Behavior

runtime: goroutine stack exceeds 1000000000-byte limit
runtime: sp=0x14023c265d0 stack=[0x14023c26000, 0x14043c26000]
fatal error: stack overflow

runtime stack:
...

Reproduction Steps

1. Download trivy
   
   path=v0.52.0/trivy_0.52.0_Linux-64bit.tar.gz
   path=v0.52.0/trivy_0.52.0_macOS-ARM64.tar.gz
   curl -sLO https://github.com/aquasecurity/trivy/releases/download/$path
   file=$(echo $path | cut -d/ -f2)
   tar zxf $file trivy

Generate a problematic pnpm-lock.yaml

docker run --rm -it --volume $PWD:/mnt --name trivy-fatal-error node:20-bookworm-slim bash -c "npm install -g pnpm && cd /mnt && rm -f package.json pnpm-lock.yaml && pnpm add @babel/core"

Run a scan

./trivy filesystem --scanners vuln --format json --exit-code 1 --severity HIGH,CRITICAL --no-progress .

Here is an example of a failing pnpm-lock.yaml

lockfileVersion: '9.0'

settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

importers:

  .:
    dependencies:
      '@babel/core':
        specifier: ^7.24.6
        version: 7.24.6

packages:

  '@ampproject/[email protected]':
    resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
    engines: {node: '>=6.0.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-ZJhac6FkEd1yhG2AHOmfcXG4ceoLltoCVJjN5XsWN9BifBQr+cHJbWi0h68HZuSORq+3WtJ2z0hwF2NG1b5kcA==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-aC2DGhBq5eEdyXWqrDInSqQjO0k8xtPRf5YylULqx8MCd6jBtzqfta/3ETMRpuKIc5hyswfO80ObyA1MvkCcUQ==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-qAHSfAdVyFmIvl0VHELib8xar7ONuSHrE2hLnsaWkYNTI68dmi1x8GYDhJjMI/e7XWal9QBlZkwbOnkcw7Z8gQ==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-S7m4eNa6YAPJRHmKsLHIDJhNAGNKoWNiWefz1MBbpnt8g9lvMDl1hir4P9bo/57bQEmuwEhnRU/AMWsD0G/Fbg==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-VZQ57UsDGlX/5fFA7GkVPplZhHsVc+vuErWgdOiysI9Ksnw0Pbbd6pnPiR/mmJyKHgyIW0c7KT32gmhiF+cirg==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-Y50Cg3k0LKLMjxdPjIl40SdJgMB85iXn27Vk/qbHZCFx/o5XO3PSnpi675h1KEmmDb6OFArfd5SCQEQ5Q4H88g==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-xpeLqeeRkbxhnYimfr2PC+iA0Q7ljX/d1eZ9/inYbmfG2jpl8Lu3DyXvpOAnrS5kxkfOWJjioIMQsaMBXFI05w==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-SF/EMrC3OD7dSta1bLJIlrsVxwtd0UpjRJqLno6125epQMJ/kyFmpTT4pbvPbdQHzCHg+biQ7Syo8lnDtbR+uA==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-a26dmxFJBF62rRO9mmpgrfTLsAuyHk4e1hKTUkD/fcMfynt8gvEKwQPQDVxWhca8dHoDck+55DFt42zV0QMw5g==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-Y/YMPm83mV2HJTbX1Qh2sjgjqcacvOlhbzdCCsSlblOKjSYmQqEbO6rUniWQyRo9ncyfjT8hnUjlG06RXDEmcA==}
    engines: {node: '>=6.9.0'}
    peerDependencies:
      '@babel/core': ^7.0.0

  '@babel/[email protected]':
    resolution: {integrity: sha512-nZzcMMD4ZhmB35MOOzQuiGO5RzL6tJbsT37Zx8M5L/i9KSrukGXWTjLe1knIbb/RmxoJE9GON9soq0c0VEMM5g==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-CvLSkwXGWnYlF9+J3iZUvwgAxKiYzK3BWuo+mLzD/MDGOZDj7Gq8+hqaOkMxmJwmlv0iu86uH5fdADd9Hxkymw==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-WdJjwMEkmBicq5T9fm/cHND3+UlFa2Yj8ALLgmoSQAJZysYbBjw+azChSGPN4DSPLXOcooGRvDwZWMcF/mLO2Q==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-4yA7s865JHaqUdRbnaxarZREuPTHrjpDT+pXoAZ1yhyo6uFnIEpS8VMu16siFOHDpZNKYv5BObhsB//ycbICyw==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-Jktc8KkF3zIkePb48QO+IapbXlSapOW9S+ogZZkcO6bABgYAxtZcjZ/O005111YLf+j4M84uEgwYoidDkXbCkQ==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-V2PI+NqnyFu1i0GyTd/O/cTpxzQCYioSkUIRmgo7gFEHKKCg5w46+r/A6WeUR1+P3TeQ49dspGPNd/E3n9AnnA==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-2YnuOp4HAk2BsBrJJvYCbItHx0zWscI1C3zgWkz+wDyD9I7GIVrfnLyrR4Y1VR+7p+chAEcrgRQYZAGIKMV7vQ==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-eNZXdfU35nJC2h24RznROuOpO94h6x8sg9ju0tT9biNtLZ2vuP8SduLqqV+/8+cebSLV9SJEAN5Z3zQbJG/M+Q==}
    engines: {node: '>=6.0.0'}
    hasBin: true

  '@babel/[email protected]':
    resolution: {integrity: sha512-3vgazJlLwNXi9jhrR1ef8qiB65L1RK90+lEQwv4OxveHnqC3BfmnHdgySwRLzf6akhlOYenT+b7AfWq+a//AHw==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-OsNjaJwT9Zn8ozxcfoBc+RaHdj3gFmCmYoQLUII1o6ZrUwku0BMg80FoOTPx+Gi6XhcQxAYE4xyjPTo4SxEQqw==}
    engines: {node: '>=6.9.0'}

  '@babel/[email protected]':
    resolution: {integrity: sha512-WaMsgi6Q8zMgMth93GvWPXkhAIEobfsIkLTacoVZoK1J0CevIPGYY2Vo5YvJGqyHqXM6P4ppOYGsIRU8MM9pFQ==}
    engines: {node: '>=6.9.0'}

  '@jridgewell/[email protected]':
    resolution: {integrity: sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/[email protected]':
    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/[email protected]':
    resolution: {integrity: sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==}
    engines: {node: '>=6.0.0'}

  '@jridgewell/[email protected]':
    resolution: {integrity: sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==}

  '@jridgewell/[email protected]':
    resolution: {integrity: sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==}

  [email protected]:
    resolution: {integrity: sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-QW8HiM1shhT2GuzkvklfjcKDiWFXHOeFCIA/huJPwHsslwcydgk7X+z2zXpEijP98UCY7HbubZt5J2Zgvf0CaQ==}
    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
    hasBin: true

  [email protected]:
    resolution: {integrity: sha512-4zgNiB8nTyV/tHhwZrFs88ryjls/lHiqFhrxCW4qSTeuRByBVnPYpDInchOIySWknznucaf31Z4KYqjfbrecVw==}

  [email protected]:
    resolution: {integrity: sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==}

  [email protected]:
    resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}

  [email protected]:
    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}

  [email protected]:
    resolution: {integrity: sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==}
    engines: {node: '>=6.0'}
    peerDependencies:
      supports-color: '*'
    peerDependenciesMeta:
      supports-color:
        optional: true

  [email protected]:
    resolution: {integrity: sha512-ubp5+Ev/VV8KuRoWnfP2QF2Bg+O2ZFdb49DiiNbz2VmgkIqrnyYaqIOqj8A6K/3p1xV0QcU5hBQ1+BmB6ot1OA==}

  [email protected]:
    resolution: {integrity: sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==}
    engines: {node: '>=6'}

  [email protected]:
    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
    engines: {node: '>=0.8.0'}

  [email protected]:
    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
    engines: {node: '>=6.9.0'}

  [email protected]:
    resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}

  [email protected]:
    resolution: {integrity: sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==}
    engines: {node: '>=4'}
    hasBin: true

  [email protected]:
    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
    engines: {node: '>=6'}
    hasBin: true

  [email protected]:
    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}

  [email protected]:
    resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}

  [email protected]:
    resolution: {integrity: sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw==}

  [email protected]:
    resolution: {integrity: sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==}

  [email protected]:
    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
    hasBin: true

  [email protected]:
    resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==}
    engines: {node: '>=4'}

  [email protected]:
    resolution: {integrity: sha512-KVbTxlBYlckhF5wgfyZXTWnMn7MMZjMu9XG8bPlliUOP9ThaF4QnhP8qrjrH7DRzHfSk0oQv1wToW+iA5GajEQ==}
    hasBin: true
    peerDependencies:
      browserslist: '>= 4.21.0'

  [email protected]:
    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}

snapshots:

  '@ampproject/[email protected]':
    dependencies:
      '@jridgewell/gen-mapping': 0.3.5
      '@jridgewell/trace-mapping': 0.3.25

  '@babel/[email protected]':
    dependencies:
      '@babel/highlight': 7.24.6
      picocolors: 1.0.1

  '@babel/[email protected]': {}

  '@babel/[email protected]':
    dependencies:
      '@ampproject/remapping': 2.3.0
      '@babel/code-frame': 7.24.6
      '@babel/generator': 7.24.6
      '@babel/helper-compilation-targets': 7.24.6
      '@babel/helper-module-transforms': 7.24.6(@babel/[email protected])
      '@babel/helpers': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/template': 7.24.6
      '@babel/traverse': 7.24.6
      '@babel/types': 7.24.6
      convert-source-map: 2.0.0
      debug: 4.3.5
      gensync: 1.0.0-beta.2
      json5: 2.2.3
      semver: 6.3.1
    transitivePeerDependencies:
      - supports-color

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6
      '@jridgewell/gen-mapping': 0.3.5
      '@jridgewell/trace-mapping': 0.3.25
      jsesc: 2.5.2

  '@babel/[email protected]':
    dependencies:
      '@babel/compat-data': 7.24.6
      '@babel/helper-validator-option': 7.24.6
      browserslist: 4.23.0
      lru-cache: 5.1.1
      semver: 6.3.1

  '@babel/[email protected]': {}

  '@babel/[email protected]':
    dependencies:
      '@babel/template': 7.24.6
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/[email protected](@babel/[email protected])':
    dependencies:
      '@babel/core': 7.24.6
      '@babel/helper-environment-visitor': 7.24.6
      '@babel/helper-module-imports': 7.24.6
      '@babel/helper-simple-access': 7.24.6
      '@babel/helper-split-export-declaration': 7.24.6
      '@babel/helper-validator-identifier': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/[email protected]': {}

  '@babel/[email protected]': {}

  '@babel/[email protected]': {}

  '@babel/[email protected]':
    dependencies:
      '@babel/template': 7.24.6
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/helper-validator-identifier': 7.24.6
      chalk: 2.4.2
      js-tokens: 4.0.0
      picocolors: 1.0.1

  '@babel/[email protected]':
    dependencies:
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/code-frame': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/types': 7.24.6

  '@babel/[email protected]':
    dependencies:
      '@babel/code-frame': 7.24.6
      '@babel/generator': 7.24.6
      '@babel/helper-environment-visitor': 7.24.6
      '@babel/helper-function-name': 7.24.6
      '@babel/helper-hoist-variables': 7.24.6
      '@babel/helper-split-export-declaration': 7.24.6
      '@babel/parser': 7.24.6
      '@babel/types': 7.24.6
      debug: 4.3.5
      globals: 11.12.0
    transitivePeerDependencies:
      - supports-color

  '@babel/[email protected]':
    dependencies:
      '@babel/helper-string-parser': 7.24.6
      '@babel/helper-validator-identifier': 7.24.6
      to-fast-properties: 2.0.0

  '@jridgewell/[email protected]':
    dependencies:
      '@jridgewell/set-array': 1.2.1
      '@jridgewell/sourcemap-codec': 1.4.15
      '@jridgewell/trace-mapping': 0.3.25

  '@jridgewell/[email protected]': {}

  '@jridgewell/[email protected]': {}

  '@jridgewell/[email protected]': {}

  '@jridgewell/[email protected]':
    dependencies:
      '@jridgewell/resolve-uri': 3.1.2
      '@jridgewell/sourcemap-codec': 1.4.15

  [email protected]:
    dependencies:
      color-convert: 1.9.3

  [email protected]:
    dependencies:
      caniuse-lite: 1.0.30001627
      electron-to-chromium: 1.4.788
      node-releases: 2.0.14
      update-browserslist-db: 1.0.16([email protected])

  [email protected]: {}

  [email protected]:
    dependencies:
      ansi-styles: 3.2.1
      escape-string-regexp: 1.0.5
      supports-color: 5.5.0

  [email protected]:
    dependencies:
      color-name: 1.1.3

  [email protected]: {}

  [email protected]: {}

  [email protected]:
    dependencies:
      ms: 2.1.2

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]:
    dependencies:
      yallist: 3.1.1

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]: {}

  [email protected]:
    dependencies:
      has-flag: 3.0.0

  [email protected]: {}

  [email protected]([email protected]):
    dependencies:
      browserslist: 4.23.0
      escalade: 3.1.2
      picocolors: 1.0.1

  [email protected]: {}



### Target

Filesystem

### Scanner

Vulnerability

### Output Format

JSON

### Mode

Standalone

### Debug Output

```bash
2024-06-03T17:16:58+02:00	DEBUG	Parsed severities	severities=[HIGH CRITICAL]
2024-06-03T17:16:58+02:00	DEBUG	Ignore statuses	statuses=[]
2024-06-03T17:16:58+02:00	DEBUG	Cache dir	dir="/Users/user/Library/Caches/trivy"
2024-06-03T17:16:58+02:00	DEBUG	DB update was skipped because the local DB is the latest
2024-06-03T17:16:58+02:00	DEBUG	DB info	schema=2 updated_at=2024-06-03T12:11:45.362440298Z next_update=2024-06-03T18:11:45.362440047Z downloaded_at=2024-06-03T15:11:43.348442Z
2024-06-03T17:16:58+02:00	INFO	Vulnerability scanning is enabled
2024-06-03T17:16:58+02:00	DEBUG	Vulnerability type	type=[os library]
2024-06-03T17:16:58+02:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-06-03T17:16:58+02:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
runtime: goroutine stack exceeds 1000000000-byte limit
runtime: sp=0x14023c265d0 stack=[0x14023c26000, 0x14043c26000]
fatal error: stack overflow

runtime stack:
runtime.throw({0x107151d21?, 0x200000001?})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/panic.go:1023 +0x40 fp=0x16ee031a0 sp=0x16ee03170 pc=0x1010387d0
runtime.newstack()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/stack.go:1103 +0x460 fp=0x16ee03350 sp=0x16ee031a0 pc=0x101055150
runtime.morestack()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:341 +0x70 fp=0x16ee03350 sp=0x16ee03350 pc=0x10106e180

goroutine 11 gp=0x14000584e00 m=0 mp=0x10d5e5d80 [running]:
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:222 +0x18c fp=0x14023c265d0 sp=0x14023c265d0 pc=0x106e3fb1c
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c269a0 sp=0x14023c265d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c26d70 sp=0x14023c269a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27140 sp=0x14023c26d70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27510 sp=0x14023c27140 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c278e0 sp=0x14023c27510 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c27cb0 sp=0x14023c278e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28080 sp=0x14023c27cb0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28450 sp=0x14023c28080 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28820 sp=0x14023c28450 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28bf0 sp=0x14023c28820 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c28fc0 sp=0x14023c28bf0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29390 sp=0x14023c28fc0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29760 sp=0x14023c29390 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29b30 sp=0x14023c29760 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c29f00 sp=0x14023c29b30 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2a2d0 sp=0x14023c29f00 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2a6a0 sp=0x14023c2a2d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2aa70 sp=0x14023c2a6a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ae40 sp=0x14023c2aa70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b210 sp=0x14023c2ae40 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b5e0 sp=0x14023c2b210 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2b9b0 sp=0x14023c2b5e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2bd80 sp=0x14023c2b9b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c150 sp=0x14023c2bd80 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c520 sp=0x14023c2c150 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2c8f0 sp=0x14023c2c520 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ccc0 sp=0x14023c2c8f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d090 sp=0x14023c2ccc0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d460 sp=0x14023c2d090 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2d830 sp=0x14023c2d460 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2dc00 sp=0x14023c2d830 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2dfd0 sp=0x14023c2dc00 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2e3a0 sp=0x14023c2dfd0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2e770 sp=0x14023c2e3a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2eb40 sp=0x14023c2e770 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2ef10 sp=0x14023c2eb40 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2f2e0 sp=0x14023c2ef10 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2f6b0 sp=0x14023c2f2e0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2fa80 sp=0x14023c2f6b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c2fe50 sp=0x14023c2fa80 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c30220 sp=0x14023c2fe50 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c305f0 sp=0x14023c30220 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c309c0 sp=0x14023c305f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c30d90 sp=0x14023c309c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31160 sp=0x14023c30d90 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31530 sp=0x14023c31160 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31900 sp=0x14023c31530 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c31cd0 sp=0x14023c31900 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14023c320a0 sp=0x14023c31cd0 pc=0x106e3fadc
...549976 frames elided...
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1b3f0 sp=0x14043c1b020 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1b7c0 sp=0x14043c1b3f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1bb90 sp=0x14043c1b7c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1bf60 sp=0x14043c1bb90 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1c330 sp=0x14043c1bf60 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1c700 sp=0x14043c1c330 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1cad0 sp=0x14043c1c700 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1cea0 sp=0x14043c1cad0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1d270 sp=0x14043c1cea0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1d640 sp=0x14043c1d270 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1da10 sp=0x14043c1d640 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1dde0 sp=0x14043c1da10 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e1b0 sp=0x14043c1dde0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e580 sp=0x14043c1e1b0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1e950 sp=0x14043c1e580 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1ed20 sp=0x14043c1e950 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f0f0 sp=0x14043c1ed20 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f4c0 sp=0x14043c1f0f0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1f890 sp=0x14043c1f4c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c1fc60 sp=0x14043c1f890 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20030 sp=0x14043c1fc60 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20400 sp=0x14043c20030 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c207d0 sp=0x14043c20400 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20ba0 sp=0x14043c207d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c20f70 sp=0x14043c20ba0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21340 sp=0x14043c20f70 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21710 sp=0x14043c21340 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21ae0 sp=0x14043c21710 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c21eb0 sp=0x14043c21ae0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22280 sp=0x14043c21eb0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22650 sp=0x14043c22280 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22a20 sp=0x14043c22650 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c22df0 sp=0x14043c22a20 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c231c0 sp=0x14043c22df0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23590 sp=0x14043c231c0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23960 sp=0x14043c23590 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c798c0, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c23d30 sp=0x14043c23960 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14000d30e60, 0x1d}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c24100 sp=0x14043c23d30 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c79698, 0x13}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c244d0 sp=0x14043c24100 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c900c0, 0x28}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c248a0 sp=0x14043c244d0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).markRootPkgs(0x14000e76450, {0x14001c79ba8, 0x12}, 0x14043c257c0, 0x14043c256c0)
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:233 +0x14c fp=0x14043c24c70 sp=0x14043c248a0 pc=0x106e3fadc
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).parseV9(0x14000e76450, {{0x108d7b120, 0x140034783a0}, 0x0, 0x0, 0x1400189bd40, {{0x1400189bce0, 0x0}}, 0x1400189bdd0})
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:214 +0x77c fp=0x14043c25ab0 sp=0x14043c24c70 pc=0x106e3f48c
github.com/aquasecurity/trivy/pkg/dependency/parser/nodejs/pnpm.(*Parser).Parse(0x14000e76450, {0x109ca8e30, 0x14000e76448})
	/home/runner/work/trivy/trivy/pkg/dependency/parser/nodejs/pnpm/parse.go:87 +0x260 fp=0x14043c25b90 sp=0x14043c25ab0 pc=0x106e3e480
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language.Parse({0x1070f7334, 0x4}, {0x14000d1b310, 0xe}, {0x109c078a0?, 0x14000e76448?}, {0x109c1c9a0, 0x14000e76450})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/analyze.go:55 +0xac fp=0x14043c25c50 sp=0x14043c25b90 pc=0x106ddddec
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language.Analyze({0x1070f7334?, 0x4?}, {0x14000d1b310, 0xe}, {0x109ca8e30?, 0x14000e76448?}, {0x109c1c9a0?, 0x14000e76450?})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/analyze.go:23 +0x5c fp=0x14043c25cf0 sp=0x14043c25c50 pc=0x106ddd94c
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pnpm.pnpmLibraryAnalyzer.Analyze({}, {0x1400050a5e8?, 0x10104d734?}, {{0x16ee0386e, 0x1}, {0x14000d1b310, 0xe}, {0x109cc7608, 0x14001c27ba0}, {0x109ca8e30, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/language/nodejs/pnpm/pnpm.go:28 +0xb4 fp=0x14043c25d80 sp=0x14043c25cf0 pc=0x106e40604
github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pnpm.(*pnpmLibraryAnalyzer).Analyze(0x10d32ca30?, {0x109cb9030?, 0x14000d4a000?}, {{0x16ee0386e, 0x1}, {0x14000d1b310, 0xe}, {0x109cc7608, 0x14001c27ba0}, {0x109ca8e30, ...}, ...})
	<autogenerated>:1 +0x8c fp=0x14043c25df0 sp=0x14043c25d80 pc=0x106e4088c
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile.func1({0x109cbbc90?, 0x10d656ac0?}, {0x109cb9888?, 0x14000e76448?})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:432 +0x184 fp=0x14043c25fa0 sp=0x14043c25df0 pc=0x10695cc34
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile.gowrap1()
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:444 +0x3c fp=0x14043c25fd0 sp=0x14043c25fa0 pc=0x10695ca7c
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14043c25fd0 sp=0x14043c25fd0 pc=0x1010703f4
created by github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile in goroutine 1
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:427 +0x3bc

goroutine 1 gp=0x140000021c0 m=nil [semacquire]:
runtime.gopark(0x10d5f3560?, 0x0?, 0x80?, 0x73?, 0x4?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14003abf410 sp=0x14003abf3f0 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.semacquire1(0x14003c0dec8, 0x0, 0x1, 0x0, 0x12)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/sema.go:160 +0x208 fp=0x14003abf460 sp=0x14003abf410 pc=0x10104ee18
sync.runtime_Semacquire(0x14003abf401?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/sema.go:62 +0x2c fp=0x14003abf4a0 sp=0x14003abf460 pc=0x10106b7ac
sync.(*WaitGroup).Wait(0x14003c0dec0)
	/opt/hostedtoolcache/go/1.22.3/x64/src/sync/waitgroup.go:116 +0x74 fp=0x14003abf4c0 sp=0x14003abf4a0 pc=0x10107e124
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16ee0386e, 0x1}, {0x134ee5140, 0x14001311510}, {0x109c08060, 0x10d656ac0}, {0x140013117f0, {0x14000c89200, 0x1e, 0x20}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:117 +0x320 fp=0x14003abfc30 sp=0x14003abf4c0 pc=0x106d3e120
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.(*Artifact).Inspect(_, {_, _})
	<autogenerated>:1 +0xc0 fp=0x14003ac0990 sp=0x14003abfc30 pc=0x106d3edc0
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x14003d03b40, 0x2, 0x2}, {0x14003d03d40, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/scanner/scan.go:146 +0xa4 fp=0x14003ac1480 sp=0x14003ac0990 pc=0x106e7df64
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000bea20, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:691 +0x320 fp=0x14003ac2fc0 sp=0x14003ac1480 pc=0x106e83f80
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:264 +0xa8 fp=0x14003ac3cc0 sp=0x14003ac2fc0 pc=0x106e7fac8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:212 +0xac fp=0x14003ac49b0 sp=0x14003ac3cc0 pc=0x106e7f48c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:192 +0x1b8 fp=0x14003ac56b0 sp=0x14003ac49b0 pc=0x106e7f178
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x10711d758, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000bea20, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:425 +0x408 fp=0x14003ac6ca0 sp=0x14003ac56b0 pc=0x106e80fa8
github.com/aquasecurity/trivy/pkg/commands.NewFilesystemCommand.func2(0x14000a3b808, {0x140013d9550, 0x1, 0xb})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:372 +0x160 fp=0x14003ac7b40 sp=0x14003ac6ca0 pc=0x106f27780
github.com/spf13/cobra.(*Command).execute(0x14000a3b808, {0x140013d93f0, 0xb, 0xb})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:983 +0x840 fp=0x14003ac7cd0 sp=0x14003ac7b40 pc=0x101205940
github.com/spf13/cobra.(*Command).ExecuteC(0x14000a3b208)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1115 +0x344 fp=0x14003ac7db0 sp=0x14003ac7cd0 pc=0x101206104
github.com/spf13/cobra.(*Command).Execute(0x107186795?)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1039 +0x1c fp=0x14003ac7dd0 sp=0x14003ac7db0 pc=0x101205d0c
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:39 +0x120 fp=0x14003ac7e90 sp=0x14003ac7dd0 pc=0x1070f43a0
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20 fp=0x14003ac7f40 sp=0x14003ac7e90 pc=0x1070f4180
runtime.main()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:271 +0x28c fp=0x14003ac7fd0 sp=0x14003ac7f40 pc=0x10103b10c
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14003ac7fd0 sp=0x14003ac7fd0 pc=0x1010703f4

goroutine 2 gp=0x14000002700 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ecf90 sp=0x140000ecf70 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.forcegchelper()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:326 +0xb8 fp=0x140000ecfd0 sp=0x140000ecf90 pc=0x10103b3c8
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ecfd0 sp=0x140000ecfd0 pc=0x1010703f4
created by runtime.init.6 in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:314 +0x24

goroutine 3 gp=0x14000002c40 m=nil [GC sweep wait]:
runtime.gopark(0x1?, 0x0?, 0x0?, 0x0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ed760 sp=0x140000ed740 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.bgsweep(0x140000fe000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcsweep.go:318 +0x108 fp=0x140000ed7b0 sp=0x140000ed760 pc=0x1010254c8
runtime.gcenable.gowrap1()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:203 +0x28 fp=0x140000ed7d0 sp=0x140000ed7b0 pc=0x101019668
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ed7d0 sp=0x140000ed7d0 pc=0x1010703f4
created by runtime.gcenable in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:203 +0x6c

goroutine 4 gp=0x14000002e00 m=nil [sleep]:
runtime.gopark(0x14000114000?, 0x2b4d0245aa46?, 0x0?, 0x0?, 0x109bf1c90?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000edf20 sp=0x140000edf00 pc=0x10103b568
runtime.goparkunlock(...)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:408
runtime.(*scavengerState).sleep(0x10d5cc460, 0x40fd34a000000000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcscavenge.go:504 +0x128 fp=0x140000edf90 sp=0x140000edf20 pc=0x101023048
runtime.bgscavenge(0x140000fe000)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgcscavenge.go:662 +0x9c fp=0x140000edfb0 sp=0x140000edf90 pc=0x1010233fc
runtime.gcenable.gowrap2()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:204 +0x28 fp=0x140000edfd0 sp=0x140000edfb0 pc=0x101019608
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000edfd0 sp=0x140000edfd0 pc=0x1010703f4
created by runtime.gcenable in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:204 +0xac

goroutine 5 gp=0x14000003340 m=nil [finalizer wait]:
runtime.gopark(0x0?, 0x10dd6ae08?, 0xc8?, 0xc5?, 0x10100cc74?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ec580 sp=0x140000ec560 pc=0x10103b568
runtime.runfinq()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mfinal.go:194 +0x108 fp=0x140000ec7d0 sp=0x140000ec580 pc=0x101018738
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ec7d0 sp=0x140000ec7d0 pc=0x1010703f4
created by runtime.createfing in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mfinal.go:164 +0x80

goroutine 6 gp=0x140002cc540 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7d36?, 0x1?, 0x8d?, 0x85?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ee730 sp=0x140000ee710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000ee7d0 sp=0x140000ee730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ee7d0 sp=0x140000ee7d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 17 gp=0x14000184380 m=nil [GC worker (idle)]:
runtime.gopark(0x10d65b1a0?, 0x3?, 0xed?, 0xca?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e8730 sp=0x140000e8710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e87d0 sp=0x140000e8730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e87d0 sp=0x140000e87d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 33 gp=0x14000502000 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7d60?, 0x3?, 0xbc?, 0x28?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14000508730 sp=0x14000508710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140005087d0 sp=0x14000508730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140005087d0 sp=0x140005087d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 7 gp=0x140002cc700 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c95964c89?, 0x3?, 0x1?, 0xfc?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000eef30 sp=0x140000eef10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000eefd0 sp=0x140000eef30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000eefd0 sp=0x140000eefd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 18 gp=0x14000184540 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c500bca?, 0x3?, 0x2d?, 0xa0?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e8f30 sp=0x140000e8f10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e8fd0 sp=0x140000e8f30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e8fd0 sp=0x140000e8fd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 8 gp=0x140002cc8c0 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4fbea4?, 0x14000500040?, 0x1a?, 0xa?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000ef730 sp=0x140000ef710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000ef7d0 sp=0x140000ef730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000ef7d0 sp=0x140000ef7d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 34 gp=0x140005021c0 m=nil [GC worker (idle)]:
runtime.gopark(0x2b4c9c4f7ddd?, 0x3?, 0x3c?, 0xa9?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x14000508f30 sp=0x14000508f10 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x14000508fd0 sp=0x14000508f30 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x14000508fd0 sp=0x14000508fd0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 19 gp=0x14000184700 m=nil [GC worker (idle)]:
runtime.gopark(0x10d65b1a0?, 0x3?, 0x3b?, 0x24?, 0x0?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x140000e9730 sp=0x140000e9710 pc=0x10103b568
runtime.gcBgMarkWorker()
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1310 +0xd8 fp=0x140000e97d0 sp=0x140000e9730 pc=0x10101b768
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x140000e97d0 sp=0x140000e97d0 pc=0x1010703f4
created by runtime.gcBgMarkStartWorkers in goroutine 1
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/mgc.go:1234 +0x28

goroutine 9 gp=0x14000502c40 m=nil [select]:
runtime.gopark(0x1400050b768?, 0x3?, 0x0?, 0x20?, 0x1400050b762?)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/proc.go:402 +0xc8 fp=0x1400050b610 sp=0x1400050b5f0 pc=0x10103b568
runtime.selectgo(0x1400050b768, 0x1400050b75c, 0x14000ce3480?, 0x0, 0x0?, 0x1)
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/select.go:327 +0x614 fp=0x1400050b720 sp=0x1400050b610 pc=0x10104dfd4
go.opencensus.io/stats/view.(*worker).start(0x14000ce3480)
	/home/runner/go/pkg/mod/[email protected]/stats/view/worker.go:292 +0x88 fp=0x1400050b7b0 sp=0x1400050b720 pc=0x10544f788
go.opencensus.io/stats/view.init.0.gowrap1()
	/home/runner/go/pkg/mod/[email protected]/stats/view/worker.go:34 +0x28 fp=0x1400050b7d0 sp=0x1400050b7b0 pc=0x10544eb88
runtime.goexit({})
	/opt/hostedtoolcache/go/1.22.3/x64/src/runtime/asm_arm64.s:1222 +0x4 fp=0x1400050b7d0 sp=0x1400050b7d0 pc=0x1010703f4
created by go.opencensus.io/stats/view.init.0 in goroutine 1
	/home/runner/go/pkg/mod/[email protected]/stats/view/worker.go:34 +0x98

Operating System

macOS sonoma 14.5 and Ubuntu Linux 22.04

Version

Version: 0.52.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-06-03 12:11:45.362440298 +0000 UTC
  NextUpdate: 2024-06-03 18:11:45.362440047 +0000 UTC
  DownloadedAt: 2024-06-03 15:11:43.348442 +0000 UTC

Checklist

Run trivy image --reset
Read the troubleshooting

DmitriyLewen · 2024-06-04T05:20:47Z

DmitriyLewen
Jun 4, 2024
Maintainer

Hello @marcindulak
Thanks for your report!

Looks like this is bug in pnpm:

  [email protected]:
    dependencies:
      caniuse-lite: 1.0.30001627
      electron-to-chromium: 1.4.788
      node-releases: 2.0.14
      update-browserslist-db: 1.0.16([email protected])
   ...
  [email protected]([email protected]):
    dependencies:
      browserslist: 4.23.0
      escalade: 3.1.2
      picocolors: 1.0.1

cyclical dependencies - [email protected] => [email protected] => [email protected]

But [email protected] doesn't contain [email protected] - https://www.npmjs.com/package/update-browserslist-db?activeTab=dependencies

Any way we need to fix panic for this case. I created #6848

Regards, Dmitriy

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fatal error: stack overflow on a particular pnpm-lock.yaml #6843

{{title}}

Replies: 1 comment

{{title}}

Select a reply

fatal error: stack overflow on a particular pnpm-lock.yaml #6843

marcindulak Jun 3, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Operating System

Version

Checklist

Replies: 1 comment

DmitriyLewen Jun 4, 2024 Maintainer

marcindulak
Jun 3, 2024

DmitriyLewen
Jun 4, 2024
Maintainer