Vite plugin that generates a package.json and package-lock.json containing only the packages your Vite bundle actually imports. Useful for creating accurate SBOMs and avoiding false positives in NPM audit/SCA scans caused by misclassified devDependencies. v1.4.0 supports Vite 4–8. Actively maintained with regular updates, written in TypeScript with bundled type definitions. Differentiator: Unlike generic SBOM tools, it only includes runtime dependencies actually bundled, reducing noise in security reports.
npm install vite-plugin-generate-package-jsonVerified import paths — ran on the pinned version, not inferred.
Configures Vite to generate a minimal package.json and package-lock.json in the build output directory containing only the dependencies used by the bundle.
Upgrade to v1.4.0 which supports Vite 4–8, or stick with Vite 5 if using older plugin versions.
Always add generatePackageJson() as the first plugin in the array.
Remove `outputDir` and rely on `build.outDir` in Vite config.
Ensure your project and all dependencies are ESM-compatible, or manually include missing packages.
Install with `npm i -D vite-plugin-generate-package-json` and ensure your project uses ESM (type: 'module' in package.json).
Change `import generatePackageJson from '...'` to `import { generatePackageJson } from '...'`.Upgrade Vite to version 4, 5, 6, 7, or 8.