-
-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ignore all vulnerabilities from dependencies installed by given package #75
Comments
I just run into this situation myself. There is one package that I know it is safe to ignore. My suggestion is that it could be a new feature, instead of using the already existing
|
as we all know the different versions in npm has big discrepancies by the information provided in the report, hence this feature might be difficult to handle properly for e.g. npm v6 and v7; in v6, we might be able to analyze the dependencies tree using the however, in v7+, it seems like there is only e.g. we might need to find an alternative solution to list and analyze the dependencies tree (perhaps
|
Using the option
-m
can only ignore vulnerabilities in a specific package. It would be nice if we could ignore a whole package and it's child dependencies (packages installed by it). I believe this could be included in the same-m
option.So for example if I have
node-sass
installed, and it bringsnode-forge
andtrim-newlines
with security vulnerabilities,-m node-sass
would ignore both. But on the other hand if I also havepackage-x
that also installsnode-forge
then it doesn't.Context: in certain cases the split between production and non dev only packages is used for other purposes. Like for example installing less packages in certain pipelines (frontend web targeted only projects do this). So using only
--production
doesn't cover this case.The text was updated successfully, but these errors were encountered: