Completely excluding a particular package ecosystem or manifest from dependency graph

[grishka]

Select Topic Area

Question

Body

In one of my projects, I have two build system manifests:

• pom.xml for the actual server app in Java, which I do want scanned for vulnerabilities
• package-lock.json deep in the web sources that is only used for building the front end (TypeScript and PostCSS), which I want completely ignored because this only runs on the developer machine and never takes untrusted input

So far, I was only able to disable dependabot for it by creating a custom rule that tells it to ignore everything NPM. However, NPM dependencies are still listed in the dependency graph. Is there a way to remove them from there as well?

[jonjanego]

Hi @grishka - thanks for the question! At this time there is not a way to configure dependency graph to exclude any manifest files that are in the repository.