Consider removing dev dependencies before publishing a package. about generator-license HOT 7 CLOSED

Installing the generator-license package will install only the application runtime code and the templates. No development dependencies are installed.

from generator-license.

I read that this was indeed the case but was never able to actually make it work.
Here is my repro case:

mkdir p
cd p/
npm init --yes
npm install yeoman-generator@5

added 318 packages, and audited 319 packages in 9s

40 packages are looking for funding
run npm fund for details

found 0 vulnerabilities

npm install generator-license

added 582 packages, and audited 901 packages in 20s

75 packages are looking for funding
run npm fund for details

11 vulnerabilities (3 moderate, 3 high, 5 critical)

To address all issues, run:
npm audit fix

Run npm audit for details.

This does not happen after applying my suggested PR.
Can you point me what I’m doing wrong ?

from generator-license.

This is standard behaviour of npm. Use the --production flag when installing to exclude the dev dependencies.

from generator-license.

This is standard behaviour of npm. Use the --production flag when installing to exclude the dev dependencies.

This also happens, unfortunately, when using --production or --omit=dev flags.

from generator-license.

I think the correct way is to update the vulnerable dependencies and not to hide the fact that particular package was built or is using old packages.

from generator-license.

Please try v5.6.0 package.

from generator-license.

Please try v5.6.0 package.

Thank you that works.

from generator-license.