You scan 50 Node.js projects using WhiteSource. Each project contains package.json, package-lock.json, and npm-shrinkwrap.json files. You want WhiteSource to report only the libraries that your projects explicitly reference. What action should you take?

The correct answer is to add a devDependencies section to package-lock.json. WhiteSource, by default, scans all dependencies listed in package.json and package-lock.json. To report only explicitly referenced libraries, you should move development-only dependencies into the devDependencies section of your package.json file. When WhiteSource scans, it can then be configured to exclude devDependencies, focusing solely on the production dependencies. Configuring the File System Agent plug-in or the Artifactory plug-in are general configuration steps for WhiteSource integration and do not specifically address the filtering of dependency types. Deleting package-lock.json would remove the locked dependency versions, potentially leading to inconsistent builds and would not help in filtering the reported libraries; it would likely make the scan less accurate or complete.