CycloneDX / CycloneDX/cyclonedx-node-npm
feat: Only fetching first level of dependencies
- Dominant language
- JavaScript
- Stars
- 150
- Forks
- 29
- Avg merge
- 1h 3m
- Merged PRs (30d)
- 1
Description
## Is your feature request related to a problem? Please describe.
As stated in the docs and the source code this project always fetches all npm packages via the "npm ls" command. Therefore it is executed with "npm ls -all" (i left out the other parametes here for better understanding)
What i would like to have is an option to create the SBOM only with the packages listed in package.json file. Basically just the first level of dependencies.
## Describe the solution you'd like
Add an additional parameter e.g. "--only-first-level-dependencies" to call "npm ls" without the --depth parameter or set to 1 to fetch only the first level of dependencies/packages.
Default of the parameter can be false so it will by default fetch all dependencies and only if you are configuring it you can limit the fetching.
## Describe alternatives you've considered
none. i think this the nicest approach
## Additional context
Add any other context or screenshots about the feature request here.
Contributor guide
Assessment
This issue has not been assessed yet.