CycloneDX / CycloneDX/cyclonedx-node-npm

feat: Only fetching first level of dependencies

Open
#1,155 7 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted question
Dominant language
JavaScript
Stars
150
Forks
29
Avg merge
1h 3m
Merged PRs (30d)
1

Description

## Is your feature request related to a problem? Please describe.

As stated in the docs and the source code this project always fetches all npm packages via the "npm ls" command. Therefore it is executed with "npm ls -all" (i left out the other parametes here for better understanding)

What i would like to have is an option to create the SBOM only with the packages listed in package.json file. Basically just the first level of dependencies.

## Describe the solution you'd like

Add an additional parameter e.g. "--only-first-level-dependencies" to call "npm ls" without the --depth parameter or set to 1 to fetch only the first level of dependencies/packages.

Default of the parameter can be false so it will by default fetch all dependencies and only if you are configuring it you can limit the fetching.

## Describe alternatives you've considered

none. i think this the nicest approach

## Additional context

Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.