fix(yarnlock): ignore yarn.lock files in node_modules

extractor/filesystem/language/javascript/yarnlock/yarnlock.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 
 	"github.com/google/osv-scalibr/extractor"
@@ -194,7 +195,19 @@ func (e Extractor) Requirements() *plugin.Capabilities {
 
 // FileRequired returns true if the specified file is an NPM yarn.lock file.
 func (e Extractor) FileRequired(api filesystem.FileAPI) bool {
-	return filepath.Base(api.Path()) == "yarn.lock"
+	path := api.Path()
+	if filepath.Base(path) != "yarn.lock" {
+		return false
+	}
+	// Skip lockfiles inside node_modules directories since the packages they list aren't
+	// necessarily installed by the root project. We instead use the more specific top-level
+	// lockfile for the root project dependencies.
+	dir := filepath.ToSlash(filepath.Dir(path))
+	if slices.Contains(strings.Split(dir, "/"), "node_modules") {
+		return false
+	}
+
+	return true
 }
 
 // Extract extracts packages from NPM yarn.lock files passed through the scan input.

extractor/filesystem/language/javascript/yarnlock/yarnlock_test.go

@@ -51,6 +51,10 @@ func TestExtractor_FileRequired(t *testing.T) {
 			inputPath: "path.to.my.yarn.lock",
 			want:      false,
 		},
+		{
+			inputPath: "foo/node_modules/bar/yarn.lock",
+			want:      false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.inputPath, func(t *testing.T) {