Accept package-lock.json files in v2 format about dash-licenses HOT 4 OPEN

The current implementation is something of a quick-and-dirty just-what-we-need convenience hack. Extending it to support multiple versions shouldn't be too hard (so we should do it), but I'm concerned that there may be some subtlety in parsing the file that we're missing.

It would be better to have npm do the parsing for us (even is only as a backup for cases where the hypothetical subtlety that I'm concerned about bites us).

AFAICT, the npm-ls command is the magic that gives us the dependency list, but I don't see a configuration that generates a simple flat file. The parseable option, even when combined with the long option doesn't seem to give us something that is any more workable than just the straight hierarchy list.

AFAICT, the simplest get-npm-to-do-it solution is this:

npm ls --all | grep -Poh "[\w\-\/]+@\d+(?:\.\d+){2}" | sort | uniq

and then pipe the result into the tool.

Do you have any further insight @ffendt ?

Can you provide me a link to the package-lock.json file for your project so that I can test with it?

from dash-licenses.

I've been looking a bit harder at the file format.

There's a "dev" option; when this is set to true, the library is required only at development time (i.e., it is specifically not required at runtime). I'm thinking that we can (at least optionally) skip these, or try to otherwise use the feature to identify "works with" dependencies.

from dash-licenses.

Rudimentary support for v2 has been added with 448b95b

from dash-licenses.

Thanks a lot for the work you've already put into this. Sadly I don't have further insights as I just stumbled upon this. Afaik, the dev option also was there for files in v1 format.

In our CI we're splitting the existing package-lock.json files at the dev option and run the dash-licenses tool once for the lockfile with only prod dependencies and once for the lockfile with only dev dependencies. You can find one of the bigger lockfiles we're running on in ditto-clients/javascript/lib/node/package-lock.json. (Side note: Sadly ClearlyDefined also times out sometimes for this amount of packages).

I'd really like to test your enhancements, but I'm not sure when I'll get to this as the next two weeks are already quite packed.

from dash-licenses.