pgutil: PackageLockOnly for npm projects

[caterina]

Hi,

I see that the Dependency Scanner for npm projects is able to handle "packageLockOnly" (like it was the case in pgscan). But I can't seem to find an option to set this flag from the outside.

Maybe this option has been overlooked? Or I am missing it?
I appreciate the help.

Thanks,
Caterina

[atripp]

Hi @caterina

It's very possible this was overlooked; we seem to have accepted a lot of pull requests without documenting them or knowing how they work

We want to make sure the tool is well documented... can you share what all this does, and how we can document it? It might be easy to add back in ... we just want to make sure all these switches are documented and still make sense.

Thanks,
Alana

[caterina]

Hi @atripp,

the default behavior of the NpmDependencyScanner is to read the input file as well as all package-lock.json files found in the node_modules directory.

Rich and I had a longer discussion about this behavior last year (https://forums.inedo.com/topic/3934/pgscan-different-results-for-npm-dependencies/13).
Result of this discussion was to add "--package-lock-only" to be able to ignore the package-lock.json files in node_modules.

The code for this is already part of pgutil ('packageLockOnly'-property in NpmDependencyScanner). The only thing missing here is the possibility to set this property from the outside.

Thanks,
Caterina

[atripp]

@caterina thanks, we'll discuss this internally and get back to you soon!

[rhessinger]

Hi @caterina,

We are working to add this back, but the hold up has been trying to properly document this. Here is our thoughts, but wanted to get your feedback.

We are looking to change the parameter name to --do-not-scan-node_modules with a command line description of:

Do not scan the node_modules directory when scanning for package-lock.json files

What are your thoughts on this?

Thanks,
Rich