# Not supported pnpm yet? **URL:** \ **Category:** Grype\ **Created:** [October 8, 2025, 9:27pm UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575 "2025-10-08T21:27:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![takuyahara](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/takuyahara/32/367_2.png) [@takuyahara](https://anchorecommunity.discourse.group/u/takuyahara)\ **Post date:** [October 8, 2025, 9:27pm UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/1 "2025-10-08T21:27:11Z")
I just started to try grype and have a question; doesn’t it support pnpm monorepo? Downloading pnpm’s SBOM from [GitHub](https://github.com/pnpm/pnpm/network/dependencies) and running `cat pnpm_pnpm_66e1aa.json | grype` resulted like the following excerpt. ```auto NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK tar catalog: 3.2.2 npm GHSA-3jfq-g458-7qm9 High 85.5% (99th) 67.1 js-yaml catalog: 2.0.5 npm GHSA-xxvw-45rp-3mj2 Critical 64.5% (98th) 58.1 json5 catalog: 1.0.2 npm GHSA-9c47-m6qq-7p4h High 40.5% (97th) 29.6 handlebars ^4.7.7 3.0.8 npm GHSA-w457-6q6x-cgp9 Critical 24.8% (95th) 23.3 handlebars ^4.7.7 4.7.7 npm GHSA-765h-qjxv-5f44 Critical 5.9% (90th) 5.5 handlebars ^4.7.7 4.7.7 npm GHSA-f2jv-r9rf-7988 Critical 4.0% (88th) 3.8 ``` I wonder why handlebars is listed up despite a newer version than fixed one is installed. `^4.7.7` seems to be picked from package.json but an exact version is surely described in [pnpm-lock.json](https://github.com/pnpm/pnpm/blob/8fcdda9e2c1a7b6c61321bd3cd75781f5c62620d/pnpm-lock.yaml#L21209). ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [October 9, 2025, 7:20pm UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/2 "2025-10-09T19:20:51Z")
Hi @takuyahara, we do support scanning PNPM, but I don’t think the issue here is related to that. It seems the SBOM you downloaded has versions set to things including `catalog:` and `^4.7.7`, which Grype is not able to compare very well. I’m not sure how `catalog:` would ever really be compared aside from lexicographically, but even a version starting with a carat (`^`), should probably have removed this character. We could possibly ignore this from the input, but aren’t doing so today. We could also warn that it seems like results may be poor due to unexpected SBOM input, but it seems like the crux of the issue is that the SBOM isn’t very good. If you download the source files from that repo and scan with Grype, you will see a lot more expected matches. Just to confirm, did you download the SBOM clicking the `Export SBOM` button? ---
**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\ **Post date:** [October 9, 2025, 7:29pm UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/3 "2025-10-09T19:29:57Z")
By the way @takuyahara we discussed this during our weekly livestream this week: [October 9th | Open Source Gardening | Live Stream](https://anchorecommunity.discourse.group/t/october-9th-open-source-gardening-live-stream/574) if you’d like to hear some more details. ---
**Author:** ![takuyahara](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/takuyahara/32/367_2.png) [@takuyahara](https://anchorecommunity.discourse.group/u/takuyahara)\ **Post date:** [October 10, 2025, 1:42am UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/4 "2025-10-10T01:42:06Z")
@kzantow Thank you for the helpful detail. Yes I downloaded SBOM by clicking the `Export SBOM` button and understood it’s a SBOM quality issue. Generating SBOM from source files with Syft and scanning it with Grype gave me an expected result. ---
**Author:** ![takuyahara](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/takuyahara/32/367_2.png) [@takuyahara](https://anchorecommunity.discourse.group/u/takuyahara)\ **Post date:** [October 10, 2025, 1:43am UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/5 "2025-10-10T01:43:23Z")
@willmurphy Will check it, thanks! ---
**Author:** ![gelafaco](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/gelafaco/32/520_2.png) [@gelafaco](https://anchorecommunity.discourse.group/u/gelafaco)\ **Post date:** [October 29, 2026, 3:54pm UTC](https://anchorecommunity.discourse.group/t/not-supported-pnpm-yet/575/6 "2026-10-29T15:54:34Z")
The `^4.7.7` value is a version range, not the resolved version in `pnpm-lock.yaml`. Grype scans the SBOM you pipe into it; it won’t look up the lockfile separately to replace that range. Check the SBOM’s component version and purl for Handlebars. If they contain the range, regenerate the SBOM from the checkout with Syft and confirm it reads the pnpm lockfile and records the resolved version.