e7bef1dfd5
The npm lockfile generation approach (npm install --package-lock-only) is unreliable for pnpm repos that have a packageManager field: corepack intercepts npm and the install fails, leaving no lockfile for npm audit. Skip npm audit entirely for pnpm repos. The pnpm audit endpoint is retired (HTTP 410) so there is no viable audit path for these repos anyway. Co-Authored-By: Paperclip <noreply@paperclip.ing>