Question
You scan a Node.js application using WhiteSource Bolt.
The scan finds numerous libraries with invalid licenses, but are only used during development.
You have to make sure that only production dependencies are scanned by WhiteSource Bolt.
Which of the following is a command you should run?
- A. npm edit
- B. npm publish
- C. npm install Correct
- D. npm update
Explanation
Running npm install with the production flag (npm install --production, or --omit=dev in newer npm) installs only the dependencies listed under dependencies and skips devDependencies, so the scan sees only production libraries. npm edit opens a package for editing, npm publish pushes a package to a registry, and npm update upgrades installed packages; none of them excludes development dependencies.
