Closed bmvermeer closed 4 years ago
@bmvermeer I am not sure I agree, given the user is in the manifest file and seeing Snyk annotations on their dependencies
the absence of annotations on the devDependencies
does not clearly communicate these are being ignored by default. Instead my assumption would be that these devDeps should be considered safe/secure.
@bmvermeer In case my earlier edit got missed we should definitely filter out any packages which are not being loaded from NPM, this includes the GitHub & local style mentioned here: https://docs.npmjs.com/files/package.json#github-urls
:tada: This PR is included in version 1.2.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:
Maybe in the future. I dont believe it is good to do this by default. I think it will be considered noise but lets monitor this. Maybe we should make it optional just like in the CLI.