Unclear behaviour with vulnerabilities when using cwd about scanner

[fraxken]

Ok i think i found what's wrong: #39

[mbalabash]

Yep, now it works perfectly 👍
Thank you!

[fraxken]

Hi @mbalabash

Can you try to run cwd with includeDevDeps options set to true ? (just to be sure even if doesn't seem to be related to devDeps).

Or maybe there is something wrong with the way we check SemVer (possible). You can always take a look here:

• https://github.com/NodeSecure/scanner/blob/master/src/depWalker.js#L285

After this it use the npm strategy for Vuln package:

• https://github.com/NodeSecure/vuln/blob/main/src/strategies/npm-audit.js#L16

I'm going to take a look too.

[fraxken]

Hmm i failed to reproduce on my side with the package.json you provided

[mbalabash]

Hmm i failed to reproduce on my side with the package.json you provided

That’s strange. I tried with includeDevDeps: true and still get same vulnerabilities: [] output.

What kind of npm token should I use?
I've set npm readonly token into env var NODE_SECURE_TOKEN. Is it correct?

[fraxken]

Ok release 3.4.1 available: https://github.com/NodeSecure/scanner/releases/tag/v3.4.1 (could you check if everything ok now ?).