fix: Handle package.json when only devDependencies present (#298)

Author: abhisek

pkg/parser/fixtures/package-json-with-only-dev-dependencies.json

@@ -0,0 +1,5 @@
+{
+  "devDependencies": {
+    "a": "^1.0.0"
+  }
+}

pkg/parser/npm_graph.go

@@ -76,6 +76,10 @@ func parseNpmPackageJsonAsGraph(packageJsonPath string, config *ParserConfig) (*
 	manifest := models.NewPackageManifestFromLocal(packageJsonPath, models.EcosystemNpm)
 
 	dependencies := packageJson.Dependencies
+	if dependencies == nil {
+		dependencies = make(map[string]string)
+	}
+
 	if config.IncludeDevDependencies {
 		for k, v := range packageJson.DevDependencies {
 			if _, ok := dependencies[k]; !ok {

pkg/parser/npm_graph_test.go

@@ -28,6 +28,17 @@ func TestNpmGraphParserBasic(t *testing.T) {
 	assert.NotEmpty(t, pm.DependencyGraph.GetNodes())
 }
 
+func TestPackageJsonOnlyDevDependencies(t *testing.T) {
+	pm, err := parseNpmPackageJsonAsGraph("./fixtures/package-json-with-only-dev-dependencies.json",
+		&ParserConfig{IncludeDevDependencies: true})
+	assert.Nil(t, err)
+
+	assert.NotNil(t, pm)
+	assert.NotNil(t, pm.DependencyGraph)
+	assert.NotEmpty(t, pm.DependencyGraph.GetNodes())
+	assert.Equal(t, 1, len(pm.GetPackages()))
+}
+
 func TestNpmGraphParserDependencies(t *testing.T) {
 	pm, err := parseNpmPackageLockAsGraph("./fixtures/package-lock-graph.json", defaultParserConfigForTest)
 	assert.Nil(t, err)

pkg/reporter/summary.go

@@ -416,6 +416,11 @@ func (r *summaryReporter) sortedRemediationsGroupByDirectDependency() []*summary
 }
 
 func (r *summaryReporter) renderRemediationAdvice() {
+	if len(r.remediationScores) == 0 {
+		fmt.Println(text.BgGreen.Sprint(" No risky libraries identified "))
+		return
+	}
+
 	fmt.Println(text.Bold.Sprint("Consider upgrading the following libraries for maximum impact:"))
 	fmt.Println()