fix: improve consistency of results from YarnAuditAnalyzer

[chadlwilson]

Description of Change

Improves consistency of results from invoking yarn (via direct install or corepack) by ensuring use of the ODC environment-defined yarn version (via path or corepack validation)

• The standard Yarn environment variable escape hatch is available to opt back into earlier behaviour.
• Regenerated and minimised the test lockfiles to avoid needing to query the npm audit API for dependencies that aren't actually asserted against in tests.

Have test cases been added to cover the new functionality?

yes

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 17 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 19 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java:270

• fetchYarnAdvisories now invokes yarn npm audit and no longer passes --offline, but the method Javadoc above still documents yarn audit --offline and says it generates a payload for the NPM API. Update that Javadoc to describe the actual command and behavior so maintainers are not misled.

        final String advisoriesJsons = startAndReadStdoutToString(createYarnBuilder(getDependencyDirectory(dependency.getActualFile()), args));

core/src/test/resources/yarn/yarn-classic-audit/package.json:19

• This fixture no longer declares marked after the dependency minimization, so the retained comment block above is now false and misleading. Please remove it or replace it with a comment describing the remaining fixture dependency.

    "swig": "1.4.2"

[Copilot]

Pull request overview

Copilot reviewed 15 out of 19 changed files in this pull request and generated 6 comments.

Suppressed comments (1)

core/src/test/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzerIT.java:110

• The env var name is duplicated as a string literal. Using YarnAuditAnalyzer.YARN_ENV_IGNORE_PATH avoids drift if the production constant ever changes.

            try (MockedStatic<SystemUtils> systemMock = mockStatic(SystemUtils.class)) {
                systemMock.when(() -> SystemUtils.getEnvironmentVariable("YARN_IGNORE_PATH", null)).thenReturn(envValue);

[Copilot]

Pull request overview

Copilot reviewed 15 out of 19 changed files in this pull request and generated 4 comments.