How to factor npm overrides when scanning for vulnerabilities #2852
Unanswered
aguilanegra
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I am performing a scan of a branch on a GitHub repo that employs
npm
to generate build artifacts. In the relevantpackage.json
file that is used to informnpm i,
command, I am employing theoverrides
spec to upgrade specific nested dependencies to the required versions for security compliance.I am, however, not seeing a way to factor in the versions as specified in the
overrides
spec when triggering a scan. Is there a configuration or parameter that can be passed as an argument to take this into account? Otherwise, I continue to get false positives.Beta Was this translation helpful? Give feedback.
All reactions