RedHatProductSecurity / deplist

Apache License 2.0
3 stars 5 forks source link

npm improvement #3

Open mcoops opened 2 years ago

mcoops commented 2 years ago

If there is no yarn.lock or package-lock.json, then process the node_modules directory manually.

Along the lines of:

for modules in node_modules./* {
     output = append(output, {modules[name] modules[version]})
}

This should also account for any transient dependencies too by processing everything in the main node_modules directory.

Not sure yet the best way to approach this, but prob the safest will be to just apply this logic recursively i think, that should be ok and give the best results.