WhiteSource Bolt scanned a Node.js project and flagged many libraries with invalid licenses. Those libraries are development-only and not part of production deployment. To ensure WhiteSource Bolt scans only production dependencies, which two actions should you perform?

To ensure WhiteSource Bolt scans only production dependencies, you should first run npm install --production. This command installs only the dependencies listed in the dependencies section of package.json, excluding devDependencies. This isolates the production-critical libraries. Secondly, configure WhiteSource Bolt to scan only the nodemodules directory. This directory is where npm install places the installed packages, ensuring the scanner focuses solely on the installed dependencies rather than other project files. Modifying the WhiteSource Bolt policy to reassign licenses for development tools is incorrect because it doesn't prevent scanning development dependencies; it only changes how their licenses are handled. Modifying the devDependencies section of package.json is also incorrect as it would require manually moving dependencies, which is error-prone and not the standard way to manage production vs. development installs.