Bug Report

• This project is using vite@4.5.2, however, Cycode is incorrectly marking it as using version 4.4.9.
• This is because the scanner is not taking into account the override that is in the ./pnpm-workspace.yaml file.

overrides:
  "vite": "4.5.2"

• This override can be verified by checking the vite version used in the pnpm-lock.yaml file, as seen here.
• Perhaps more accurate results could be achieved if the scanner used the output of pnpm ls -r --depth=x as the primary source for dependencies. This guarantees an accurate list of all resolved dependencies in the pnpm workspace.

Steps to Reproduce

1. Clone this repository
2. cd to the project root
3. Run corepack enable & corepack use pnpm@latest-10
4. Run pnpm install
5. Run pnpm ls -r to verify that version vite@4.5.2 is listed
6. Run cycode scan --scan-type=sca path .
7. Observe that Cycode incorretly marks the version as vite@4.4.9

Evidence

pnpm ls -r output:

cycode scan --scan-type=sca path . output: