Scanning NPM packages prints warnings #4296
Replies: 3 comments
-
|
Hello @PeterBurner
Can you share link to your repository or
Use
Release package does not include dev dependencies. That's why we are excluding dev deps so users don't have to worry about dependencies that aren't included in the release. |
Beta Was this translation helpful? Give feedback.
-
|
Wow. As requested here is a zip of my dependency files. I can reproduce the warnings with its contents. |
Beta Was this translation helpful? Give feedback.
-
|
docs have information about all supported languages and modes to scanning them - https://aquasecurity.github.io/trivy/v0.40/docs/vulnerability/detection/language/
Thanks a lot! I will investigate this and write to you. |
Beta Was this translation helpful? Give feedback.
-
What I am trying to do
I am trying to scan a NPM monorepo with multiple
package.jsonfiles an one top levelpackage-lock.jsonfor licenses.Command:
trivy fs --scanners license .What I get as a result
Console output
What I expected
I expected Trivy to scan my dependencies and print the assessed licenses for the whole dependency graph in a table.
My setup
trivy.yaml
Project structure
. ├── README.md ├── functions │ ├── fun-1 │ │ ├── package.json │ │ ├── src │ │ └── ... │ │ └── tsconfig.json │ ├── fun-2 │ │ ├── package.json │ │ ├── src │ │ └── ... │ │ └── tsconfig.json │ └── fun-3 │ ├── package.json │ ├── src │ │ └── ... │ └── tsconfig.json ├── node_modules │ └── ... ├── package-lock.json ├── package.json ├── trivy.yaml └── tsconfig.jsonMy questions
package.jsonfiles insidenode_modules? According to the documentation for filesystem scanning this is intentionally disabled. Why? I am aware that there are A LOT of files but shouldn't the users decide how long they are willing to wait for the scan to conclude?devDependencies. Is there a way to enable NPM dev dependency scanning and if not, why?Beta Was this translation helpful? Give feedback.
All reactions