Allow ignoring “dev dependencies” for npm projects
Nobody has claimed this yet.
- #339 by @EyalDelarea — closed without merging
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
Is your feature request related to a problem? Please describe.
We're requesting to add the ability to ignore “dev dependencies” in Frogbot. This feature is already implemented for the jf audit jfrog-cli command.
--dep-type [Default: all] Defines npm dependencies type. Possible values are: all, devOnly and prodOnly
Describe the solution you'd like to see
Add a property to allow this in the frogbot-config.yml file.
Describe alternatives you've considered
N/A
Additional context
Add any other context or screenshots about the feature request here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the existing frogbot-config.yml configuration and the npm dependency handling, then compare the requested behavior with the jf audit --dep-type option. Done means the configuration can select whether npm dev dependencies are included or ignored during Frogbot scans.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100