# Syft is not listing the packages under dev\_dependencies section in package-lock.json **URL:** \ **Category:** Syft\ **Created:** [March 18, 2026, 6:59am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614 "2026-03-18T06:59:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [March 18, 2026, 6:59am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/1 "2026-03-18T06:59:22Z")
We scanned nodejs git repository which has both package.json and package-lock.json, we observed packages under devdependencies are not listed in sbom. Please help us in resolving the issue. Regards, Anvitha ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [March 19, 2026, 12:41am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/2 "2026-03-19T00:41:26Z")
Hi @anvitha_haviligi, In the Syft configuration, you will see an option to include dev dependencies for Javascript, which is disabled by default (you can see the configuration options using `syft config`): ```auto javascript: ... # include development-scoped dependencies (env: SYFT_JAVASCRIPT_INCLUDE_DEV_DEPENDENCIES) include-dev-dependencies: ``` You can set this in a config file or from the command line using the environment variable noted in the config `SYFT_JAVASCRIPT_INCLUDE_DEV_DEPENDENCIES=true`. For example, you could run like: ```auto SYFT_JAVASCRIPT_INCLUDE_DEV_DEPENDENCIES=true syft ``` I think this should be what you’re looking for; let me know if you have any issues. ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [March 23, 2026, 9:17am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/3 "2026-03-23T09:17:19Z")
> [@kzantow](#): > > `SYFT_JAVASCRIPT_INCLUDE_DEV_DEPENDENCIES=true` Thank you so much, it is working, May i know where can i find all the environment variables ? ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [March 23, 2026, 1:21pm UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/4 "2026-03-23T13:21:42Z")
As noted in my earlier message, you can use `syft config` to list the full set of configuration options for the version of syft you have, which includes the environment variables for each option. You can also [see the latest version and read more about all our tools on our documentation site](https://oss.anchore.com/docs/reference/syft/configuration/). ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [March 24, 2026, 9:45am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/5 "2026-03-24T09:45:17Z")
Hi @kzantow , Thank you. One more finding, could you please help me in understanding. for one of the package in SBOM, im seeing multiple licenses, below is the package name, when i try to open the link mentioned in SBOM i have found consolidated license mentioned for different components , so syft is listing the licenses which are mentioned in the License file ? but if i search in google license for this particular package it says “Apache”, as syft listing multiple licenses, we are displaying all the licenses .[https://proxy.golang.org/github.com/hashicorp/vic/@v/v1.5.1-0.20190403131502-bbfe86ec9443.zip#github.com/hashicorp/vic@v1.5.1-0.20190403131502-bbfe86ec9443/LICENSE](https://proxy.golang.org/github.com/hashicorp/vic/@v/v1.5.1-0.20190403131502-bbfe86ec9443.zip#github.com/hashicorp/vic@v1.5.1-0.20190403131502-bbfe86ec9443/LICENSE) | [GitHub - hashicorp/vic: vSphere Integrated Containers Engine is a container runtime for vSphere. · GitHub](http://github.com/hashicorp/vic) | v1.5.1-0.20190403131502-bbfe86ec9443 | library | AFL-2.1 Apache-2.0 Artistic-1.0 Artistic-2.0 BSD-2-Clause BSD-3-Clause BSD-3-Clause-Clear BSD-3-Clause-No-Nuclear-Warranty BSD-4-Clause BSD-4-Clause-UC BSD-Source-Code BSL-1.0 Beerware CC-BY-3.0 CC-BY-4.0 CC-BY-SA-2.0 CC-BY-SA-3.0 CC-BY-SA-4.0 CC0-1.0 FSFAP FSFULLR GFDL-1.1-only GFDL-1.2-only GFDL-1.3-only GFDL-1.3-no-invariants-or-later GPL-1.0-only GPL-1.0-or-later GPL-2.0-only GPL-2.0-only GPL-2.0-or-later GPL-3.0-only GPL-3.0-or-later HPND HPND-sell-variant ISC LGPL-2.0-only LGPL-2.0-or-later LGPL-2.1-only LGPL-2.1-or-later LGPL-3.0-only LGPL-3.0-or-later LPPL-1.3c MIT MPL-1.1 MPL-2.0 MS-PL NCSA OFL-1.1 OLDAP-2.8 OSL-1.1 OpenSSL RSA-MD Rdisc SSH-OpenSSH Spencer-94 TCL WTFPL Zlib blessing bzip2-1.0.6 curl GooglePatentsFile sha256:efed67ff325d7d475f8f2f9b2a80522e35150deca75337a7d960f50aa4e85fd2 | | --- | --- | --- | --- | Thanks in advance ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [March 24, 2026, 12:27pm UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/6 "2026-03-24T12:27:10Z")
> [@anvitha\_haviligi](#): > > hashicorp/vic If you [look on Github](https://github.com/hashicorp/vic), it is also unable to determine the license, in fact it [can’t currently display the license tab](https://github.com/hashicorp/vic?tab=License-1-ov-file#readme). But [the LICENSE file exists](https://github.com/hashicorp/vic/blob/master/LICENSE) and a cursory look seems to contain all the licenses you noted. It looks like these are the licenses of all the dependencies, and it’s rightfully including them [because it has vendored them and is distributing those dependencies directly](https://github.com/hashicorp/vic/tree/master/vendor), you should definitely pay attention to what’s in that LICENSE – some of those dependencies are GPL-licensed and include some other licenses I’m not familiar with. It looks like Syft is doing the accurate thing here 🎉 ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [March 25, 2026, 3:52am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/7 "2026-03-25T03:52:28Z")
Hi @kzantow , Thank you so much for the response, one more question, sorry for asking many questions. We are not seeing many packages in sbom which are build with gradle, could you please help me if anything is missing in our folder structure. ./DateTime/build.gradle ./DateTime/gradle-mvn-push.gradle ./MaterialCalendarView/build.gradle ./apkversioninglibrary/build.gradle ./app/build.gradle ./app/projectDependencies.gradle ./appConfiguration/build.gradle ./cm/build.gradle ./commonlibrary/build.gradle ./dependencies.gradle ./keycloak/build.gradle ./knowledge\_hub/build.gradle ./nexus/build.gradle ./retrofitlibrary1.1/build.gradle ./settings.gradle ./sitemanagement/build.gradle ./socialview-commons/build.gradle ./socialview-core/build.gradle ./sonar.gradle ./switchdatetime/build.gradle ./webapilib/build.gradle ./jacoco.gradle ./build.gradle Thanks in advance, Anvitha ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [March 25, 2026, 4:22am UTC](https://anchorecommunity.discourse.group/t/syft-is-not-listing-the-packages-under-dev-dependencies-section-in-package-lock-json/614/8 "2026-03-25T04:22:10Z")
Syft is a static analysis tool – it does not execute 3rd party tools like Maven or NPM to get the exact same results as if you were to run those tools, which means the [ability to parse `.gradle` files](https://github.com/anchore/syft/blob/c5114fd745f51d092c2b3030e912366b2cef016a/syft/pkg/cataloger/java/parse_gradle_lockfile.go#L21) is limited because these are written in the Groovy programming language. However, we have support for the _lockfile_ format, which is not Groovy and is both easier to parse and contains resolved versions. Lockfiles have the added benefit of giving you reproducible builds; this would be one thing that could help improve the results.