Dr. Stefan Pfeiffer

@jkowalleck Given that NPM won't fix the issue, is there a way to provide a workaround for this? Currently we are publishing SBOMs which claim we ship dependencies having security...

> for now, running with the `--package-lock-only` switch should report/exclude the dev/optionals properly in the SBOM. Thanks, i was not aware this is also an option to the plugin itself,...

Coming from SPDX to CycloneDX, we would love to have such a feature, too. @jakub-bochenski As a (dirty) workaround, we use a script executed after the SBOM generation that modifies...