sonarqube-licensecheck icon indicating copy to clipboard operation
sonarqube-licensecheck copied to clipboard

Not all transitive npm dependencies are found

Open HSSE-Dev opened this issue 4 years ago • 0 comments

For testing the scanning of transitive npm dependencies i tested the current master commit and activate the property "licensecheck.npm.resolvetransitive=true". For comparison i used the npm package license-checker Thereby i found a difference at the npm package "request", here the license of "request" and the transitive dependency "har-validator" are found, but not the dependency of "uri-js" BSD-2-Clause. Dependencies: request->har-validator->avj->uri-js

I found the difference only for "request" but often the dependencies and their dependencies use the common license types. Can someone reproduce the bug? @oliverlockwood @derkoe

HSSE-Dev avatar Mar 30 '20 12:03 HSSE-Dev