pnpm audit does not report known vulnerability in 7.17.1 without a version in the package.json

[AndrewLeedham]

pnpm version: 7.17.1

Code to reproduce the issue:

package.json

{
  "name": "pnpm-vulnerable",
  "dependencies": {
    "mem": "3.0.1"
  }
}

pnpm-lock.yaml

lockfileVersion: 5.4

specifiers:
  mem: 3.0.1

dependencies:
  mem: 3.0.1

packages:

  /mem/3.0.1:
    resolution: {integrity: sha512-QKs47bslvOE0NbXOqG6lMxn6Bk0Iuw0vfrIeLykmQle2LkCw1p48dZDdzE+D88b/xqRJcZGcMNeDvSVma+NuIQ==}
    engines: {node: '>=4'}
    dependencies:
      mimic-fn: 1.2.0
      p-is-promise: 1.1.0
    dev: false

  /mimic-fn/1.2.0:
    resolution: {integrity: sha512-jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==}
    engines: {node: '>=4'}
    dev: false

  /p-is-promise/1.1.0:
    resolution: {integrity: sha512-zL7VE4JVS2IFSkR2GQKDSPEVxkoH43/p7oEnwpdCndKYJO0HVeRB7fA8TJwuLOTBREtK0ea8eHaxdwcpob5dmg==}
    engines: {node: '>=4'}
    dev: false

Expected behavior:

Running pnpm audit should yield 1 vulnerability for mem@3.0.1, as it does in 7.16.1

Actual behavior:

It prints:

No known vulnerabilities found

Additional information:

• node -v prints: v16.18.0
• Windows, macOS, or Linux?:

If a version is included in the package.json the vulnerability is reported. So it seems that v7.17.0 introduced a regression requiring a version.

[zkochan]

It was caused by this change: #5661

In the past, we always sent 0.0.0 as the version. Now we read the version from the package.json.

[AndrewLeedham]

Would the simple fix to do manifest.version ?? '0.0.0' then?

[zkochan]

Yes, and a test