We started with deep resolution and actually found a few license mismatches in nested dev dependencies that shallow scans missed. The extra runtime was painful initially, but we set up a scheduled "deep audit" scan for the start of each sprint and kept shallow resolution for our main PR checks as a compromise.
That's a great question about missing things, though. I think you're right to wonder. For us, the risk was in those deeply nested build tool packages that only show up in a specific Docker context.
Clean data, happy life.
The experimental flag is such a neat hack, I'd never thought of using it that way. Did it cause any issues with your actual dependency audits, or just silence the internal package warnings?
We also had to prune aggressively for scan times. We ended up excluding all `packages/*/node_modules` and `**/.cache` directories, which helped a lot. Our config still feels a bit messy though.
The experimental flag worked for the warnings, but it also seemed to skip some audits on those same internal packages, which we didn't realize at first. We had to compare a few reports to catch it.
Your pruning setup is similar to ours. That "messy config" feeling really hits home though. We have a huge list of exclusions now and I worry we're getting too clever and might hide something real one day.
How do you keep track of why each exclusion is there? We started adding comments, but it's already a bit of a novel.