Skip to main content

NPM

NPM

The Node package manager for Node.js.

Description​

The Node package manager.

Configuration​

Example​

Use the following syntax to configure this plugin globally as part of config.yml:

ort:
  analyzer:
    packageManagers:
      NPM:
        options:
          ignoreProjectNpmrcFiles: false
          legacyPeerDeps: false
          nodeVersion: ""

Use the following syntax to configure this plugin in a repository's .ort.yml:

analyzer:
  package_managers:
    NPM:
      options:
        ignoreProjectNpmrcFiles: false
        legacyPeerDeps: false
        nodeVersion: ""

If the plugin is configured in both locations, the configurations are merged, with options from .ort.yml taking precedence over those from config.yml.

Options​

ignoreProjectNpmrcFiles​

BOOLEAN Default

If true, ignore any project-specific .npmrc files.

legacyPeerDeps​

BOOLEAN Default

If true, the "--legacy-peer-deps" flag is passed to NPM to ignore conflicts in peer dependencies which are reported since NPM 7. This allows to analyze NPM 6 projects with peer dependency conflicts. For more information see the documentation and the NPM Blog.

nodeVersion​

STRING Default

Allows configuring the version of Node.js to be used for the analysis. This implicitly also sets the NPM version because NPM is bundled with Node.js. The property is interpreted as follows: If it is unspecified, ORT uses the version of Node.js that is currently installed (or ships with the container image if using the ORT Docker image). If the property has the special value "*", ORT tries to set up the version requested by the project, in a .node-version or .nvmrc file, or in the engines field of the package.json file. Any other value of the property is interpreted as a specific version of Node.js to be used for the analysis.