Question

[DeuxCatPotes]

Hello,

I'm not an expert not in dependency check nor in yarn/node.
I currently have a project that use npm for build, etc. It also use command line Dependency Check for scan.

How Dependency Check manage/detect what kind of project is it.
I currently have 2 behavior with or without following argument :

• disableYarnAudit

I think the good option is to set the option as it's a node/npm project. Not a yarn one.

The yarn scanner find security issues not find when it's disable. (as dependencies are not vulnerable).

One other thing is Dependency Check use a LAN database mirror.

Is just the detection can be improve ? or there is thing i miss ?

[jeremylong]

We would need a lot more detail and samples to be able to give any guidance or make improvements.