It appears that the yarn.lock file format has evolved somewhat since we created our implementation. AFAICT, our implementation takes care of versions 1 and 2, there is at least a version 8 now (which is YAML).

IMHO, it's not in our best interests to try and keep current with these file formats.

Rather, we should depend on the package managers themselves to give us a list of dependencies, manipulate that list into a form that we can manage, and send that to the tool.

e.g.,

$ yarn info -R --name-only | grep -P "(\S+)@npm:(\S+)" | sed -E -e 's|..\s(\S+)@npm:(\S+)|\1@\2|g' | java -jar org.eclipse.dash.licenses-<version>.jar -

That is:

1. Use the yarn info command to get a list of dependencies
2. Filter the ones that match the pattern
3. Coerce what's left into a format that the Eclipse Dash License Tool can handle.

We need to mark the yarn.lock functionality as deprecated.

FYI @mtdelgadoa