diff --git a/src/builders.ts b/src/builders.ts
index c925094d..2bf6417c 100644
--- a/src/builders.ts
+++ b/src/builders.ts
@@ -17,7 +17,9 @@ SPDX-License-Identifier: Apache-2.0
Copyright (c) OWASP Foundation. All Rights Reserved.
*/
-import { type Builders, Enums, type Factories, Models, Utils } from '@cyclonedx/cyclonedx-library'
+import type { Builders, Factories } from '@cyclonedx/cyclonedx-library'
+import { Enums, Models, Utils } from '@cyclonedx/cyclonedx-library'
+import type { PackageJson } from '@cyclonedx/cyclonedx-library/dist.d/_helpers/packageJson'
import { existsSync } from 'fs'
import * as normalizePackageData from 'normalize-package-data'
import { type PackageURL } from 'packageurl-js'
@@ -420,17 +422,58 @@ export class BomBuilder {
private makeComponent (data: any, type?: Enums.ComponentType | undefined): Models.Component | false | undefined {
// older npm-ls versions (v6) hide properties behind a `_`
- const isOptional = (data.optional ?? data._optional) === true
+ const isOptional = (data.optional ?? data._optional) === trueFrom https://github.com/ARRY7686/cyclonedx-node-npm
+ * branch set_devdependencies_to_excluded -> FETCH_HEAD
+ hint: You have divergent branches and need to specify how to reconcile them.
+ hint: You can do so by running one of the following commands sometime before
+ hint: your next pull:
+ hint:
+ hint: git config pull.rebase false # merge (the default strategy)
+ hint: git config pull.rebase true # rebase
+ hint: git config pull.ff only # fast-forward only
+ hint:
+ hint: You can replace "git config" with "git config --global" to set a default
+ hint: preference for all repositories. You can also pass --rebase, --no-rebase,
+ hint: or --ff-only on the command line to override the configured default per
+ hint: invocation.
+ fatal: Need to specify how to reconcile divergent branches.
if (isOptional && this.omitDependencyTypes.has('optional')) {
this.console.debug('DEBUG | omit optional component: %j %j', data.name, data._id)
return false
- }
-
- // older npm-ls versions (v6) hide properties behind a `_`
+ }From https://github.com/ARRY7686/cyclonedx-node-npm
+ * branch set_devdependencies_to_excluded -> FETCH_HEAD
+ hint: You have divergent branches and need to specify how to reconcile them.
+ hint: You can do so by running one of the following commands sometime before
+ hint: your next pull:
+ hint:
+ hint: git config pull.rebase false # merge (the default strategy)
+ hint: git config pull.rebase true # rebase
+ hint: git config pull.ff only # fast-forward only
+ hint:
+ hint: You can replace "git config" with "git config --global" to set a default
+ hint: preference for all repositories. You can also pass --rebase, --no-rebase,
+ hint: or --ff-only on the command line to override the configured default per
+ hint: invocation.
+ fatal: Need to specify how to reconcile divergent branches.roperties behind a `_`
const isDev = (data.dev ?? data._development) === true
- if (isDev && this.omitDependencyTypes.has('dev')) {
- this.console.debug('DEBUG | omit dev component: %j %j', data.name, data._id)
- return false
+ // if (isDev && this.omitDependencyTypes.has('dev')) {
+ // this.console.debug('DEBUG | omit dev component: %j %j', data.name, data._id)
+ // return false
+ // }
+
+ // Initialize component with a default value
+ let component: Models.Component | undefined = undefined;
+
+ // Modify the component's scope for devDependencies
+ if (isDev) {
+ // Set the scope of dev dependencies to 'Excluded'
+ component = this.componentBuilder.makeComponent(data, type);
+ if (component) {
+ component.scope = Enums.ComponentScope.Excluded; // This line ensures dev dependencies are marked as excluded
+ }
+ } else {
+ // Handle other component logic (omitted for brevity)
+ component = this.componentBuilder.makeComponent(data, type);
}
// attention: `data.devOptional` are not to be skipped with devs, since they are still required by optionals.
@@ -453,7 +496,7 @@ export class BomBuilder {
}
// endregion fix normalizations
- const component = this.componentBuilder.makeComponent(
+ const newComponent = this.componentBuilder.makeComponent(
_dataC as normalizePackageData.Package,
type
)
@@ -541,8 +584,8 @@ export class BomBuilder {
`${component.group || '-'}/${component.name}@${component.version || '-'}`
/* eslint-enable @typescript-eslint/strict-boolean-expressions, @typescript-eslint/prefer-nullish-coalescing */
- return component
- }
+ return newComponent
+}
private makePurl (component: Models.Component): PackageURL | undefined {
const purl = this.purlFactory.makeFromComponent(component, this.reproducible)
diff --git a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json
index 72919e06..e938f815 100644
--- a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json
+++ b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json
@@ -144,9 +144,9 @@
},
{
"type": "library",
- "name": "my-local-b",
+ "name": "my-local-b-off",
"version": "0.0.0",
- "bom-ref": "my-local-b@0.0.0",
+ "bom-ref": "my-local-b-off@0.0.0",
"description": "demo: my-local-b-off - a package with a different name than its dir",
"licenses": [
{
@@ -156,7 +156,7 @@
}
}
],
- "purl": "pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b",
+ "purl": "pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b",
"externalReferences": [
{
"url": "https://github.com/CycloneDX/cyclonedx-node-npm/issues",
@@ -240,11 +240,11 @@
{
"ref": "my-local-a@0.0.0",
"dependsOn": [
- "my-local-b@0.0.0"
+ "my-local-b-off@0.0.0"
]
},
{
- "ref": "my-local-b@0.0.0"
+ "ref": "my-local-b-off@0.0.0"
},
{
"ref": "my-noname@0.0.0"
diff --git a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml
index 1b89af22..d6a29402 100644
--- a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml
+++ b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml
@@ -105,8 +105,8 @@
true
-
- my-local-b
+
+ my-local-b-off
0.0.0
demo: my-local-b-off - a package with a different name than its dir
@@ -114,7 +114,7 @@
Apache-2.0
- pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b
+ pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b
https://github.com/CycloneDX/cyclonedx-node-npm/issues
@@ -170,9 +170,9 @@
-
+
-
+
\ No newline at end of file
diff --git a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json
index 72919e06..e938f815 100644
--- a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json
+++ b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json
@@ -144,9 +144,9 @@
},
{
"type": "library",
- "name": "my-local-b",
+ "name": "my-local-b-off",
"version": "0.0.0",
- "bom-ref": "my-local-b@0.0.0",
+ "bom-ref": "my-local-b-off@0.0.0",
"description": "demo: my-local-b-off - a package with a different name than its dir",
"licenses": [
{
@@ -156,7 +156,7 @@
}
}
],
- "purl": "pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b",
+ "purl": "pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b",
"externalReferences": [
{
"url": "https://github.com/CycloneDX/cyclonedx-node-npm/issues",
@@ -240,11 +240,11 @@
{
"ref": "my-local-a@0.0.0",
"dependsOn": [
- "my-local-b@0.0.0"
+ "my-local-b-off@0.0.0"
]
},
{
- "ref": "my-local-b@0.0.0"
+ "ref": "my-local-b-off@0.0.0"
},
{
"ref": "my-noname@0.0.0"
diff --git a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml
index 1b89af22..d6a29402 100644
--- a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml
+++ b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml
@@ -105,8 +105,8 @@
true
-
- my-local-b
+
+ my-local-b-off
0.0.0
demo: my-local-b-off - a package with a different name than its dir
@@ -114,7 +114,7 @@
Apache-2.0
- pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b
+ pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b
https://github.com/CycloneDX/cyclonedx-node-npm/issues
@@ -170,9 +170,9 @@
-
+
-
+
\ No newline at end of file