Skip to content

Dependency check does not scan the package-lock.json for Typescript projects even if it says it does when the node_modules haven't been installed. #6437

@IBolken

Description

@IBolken

Describe the bug
I run dependency check with sh dependency-check.sh --scan "/home/haxxor/dep-test/package-lock.json"

When I look at what gets printed in my terminal I see this

[WARN] Analyzing /home/haxxor/dep-test/package-lock.json - however, the node_modules directory does not exist. Please run npm install prior to running dependency-check

When I then look at my report I find that it has scanned 0 dependencies.

Now when I install all my node_modules and run the exact same command I find that it scans 1399 dependencies of which 419 are unique.

Version of dependency-check used
CLI 9.0.9

To Reproduce
Steps to reproduce the behavior:

  1. Clone a Typescript project
  2. Run the tool and specify the package-lock.json
  3. Install the node_modules and run the tool again specifying the package-lock.json again
  4. Compare both outputs

Expected behavior
Dependency check should scan dependencies even if the node_modules aren't installed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions