[Shivain-codes]

Fixes #2728

Add support for Yarn v2+ Plug and Play manifests (.pnp.cjs) for parsing npm dependencies.

Changes

• New YarnPnpHandler in src/packagedcode/npm.py: parses the embedded RAW_RUNTIME_STATE JSON in .pnp.cjs files. packageRegistryData is a list of [ident, [[reference, data], ...]] pairs, where references are locators such as npm:7.0.0, workspace:., or virtual:<hash>#npm:7.0.0; the null/null entry (the top-level package itself) is skipped, workspace: entries are skipped, and virtual: entries yield the npm version after #npm: when present.
• Register npm.YarnPnpHandler in APPLICATION_PACKAGE_DATAFILE_HANDLERS in src/packagedcode/__init__.py, so ScanCode actually calls the handler.
• Add test_is_datafile_yarn_pnp and test_parse_yarn_pnp in tests/packagedcode/test_npm.py, with fixtures tests/packagedcode/data/npm/yarn-pnp/.pnp.cjs and .pnp.cjs-expected (packages: @babel/core 7.0.0, lodash 4.17.21).
• Update CHANGELOG.rst (Next release) and add my name to AUTHORS.rst.

Notes

• Prior attempt Add Yarn v2 Plug and Play .pnp.cjs handler support #4875 was closed as incomplete because it lacked tests and the handler was not activated (no registration). This PR includes both: tests and the registration line.
• is_lockfile is left unset for this handler: .pnp.cjs is a runtime manifest, not a yarn.lock file. Happy to set it if maintainers prefer that behaviour.

Tasks

• Reviewed contribution guidelines
• PR is descriptively titled and links the original issue above
• Tests pass -- look for a green checkbox a few minutes after opening your PR
  Run locally: py.test -k yarn_pnp (2 passed) and full tests/packagedcode/test_npm.py (96 passed, no failures)
• Commits are in uniquely-named feature branch and has no merge conflicts
• Updated documentation pages (if applicable)
• Updated CHANGELOG.rst (if applicable)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.