SBOMs generated based on pnpm lock files are missing authors, description, and license attributes even when the node_modules directory is available for lookups. The FETCH_LICENSE environment variable can be used as a workaround until we improve the default metadata collection.