Allow Disabling 'Dev' Dependencies | Voters

Allow Disabling 'Dev' Dependencies

complete

Justin McAteer

Many JavaScript dev tools have very large sets of transitive dependencies. Dev dependencies are fairly unimportant when considering supply chain issues. Provide a checkbox to include/exclude Development dependencies from the supply chain Report.

July 21, 2023

Feross Aboukhadijeh (Socket)

marked this post as

complete

You can now filter out dev dependencies in the organizational alerts interface using the filter feature at the top of the page. See: https://socket.dev/blog/introducing-organization-alerts

Divlo

Agree, I would even consider it further, and make it so that devDependencies are ignored by default as they are not installed by users when they install the npm package.

Feross Aboukhadijeh (Socket)

Divlo: Are you seeing dev dependencies being included in reports? If so, this is a bug. We should be excluding dev dependencies (of your dependencies) by default.

Nishant Jain

This would be such a helpful feature!