DRAFT: Fix Yarn Detector Crash on Yarn 4 Protocol Specifier

[zahidblackduck]

JIRA Ticket

IDETECT-5308

Description

This pull request fixes a crash in the Yarn detector when scanning Yarn 4 (Berry) projects that contain npm: protocol specifiers. Previously, detect scan would threw a StringIndexOutOfBoundsException during extraction, causing the entire scan to fail.

Root Cause

Yarn 4 encodes an "any version" dependency as "npm:" (empty after the colon). The header section parser strips the trailing : from @package@npm: lockfile header tokens via removeEnd(), which leaves the stored key as "npm" rather than "", causing a resolution map miss. The graph builder falls back to the LazyId path, which produces an empty version string. VersionUtility.mustUpgradeEqual() then calls version.substring(1) without guarding against an empty input, throwing StringIndexOutOfBoundsException.

Fix

• Add an empty-string guard in mustUpgradeEqual(): when the version string is empty (Yarn 4 "npm:" any-version specifier), return the highest available resolved version, matching the existing behavior for Yarn 1's "*" specifier
• Add functional test YarnLockV4NpmProtocolSpecifierTest covering Yarn 4 header variants.

---

N.B: This pull request is meant to be shipped with detect 12.2.0