diff --git a/src/builders.ts b/src/builders.ts index c925094d..2bf6417c 100644 --- a/src/builders.ts +++ b/src/builders.ts @@ -17,7 +17,9 @@ SPDX-License-Identifier: Apache-2.0 Copyright (c) OWASP Foundation. All Rights Reserved. */ -import { type Builders, Enums, type Factories, Models, Utils } from '@cyclonedx/cyclonedx-library' +import type { Builders, Factories } from '@cyclonedx/cyclonedx-library' +import { Enums, Models, Utils } from '@cyclonedx/cyclonedx-library' +import type { PackageJson } from '@cyclonedx/cyclonedx-library/dist.d/_helpers/packageJson' import { existsSync } from 'fs' import * as normalizePackageData from 'normalize-package-data' import { type PackageURL } from 'packageurl-js' @@ -420,17 +422,58 @@ export class BomBuilder { private makeComponent (data: any, type?: Enums.ComponentType | undefined): Models.Component | false | undefined { // older npm-ls versions (v6) hide properties behind a `_` - const isOptional = (data.optional ?? data._optional) === true + const isOptional = (data.optional ?? data._optional) === trueFrom https://github.com/ARRY7686/cyclonedx-node-npm + * branch set_devdependencies_to_excluded -> FETCH_HEAD + hint: You have divergent branches and need to specify how to reconcile them. + hint: You can do so by running one of the following commands sometime before + hint: your next pull: + hint: + hint: git config pull.rebase false # merge (the default strategy) + hint: git config pull.rebase true # rebase + hint: git config pull.ff only # fast-forward only + hint: + hint: You can replace "git config" with "git config --global" to set a default + hint: preference for all repositories. You can also pass --rebase, --no-rebase, + hint: or --ff-only on the command line to override the configured default per + hint: invocation. + fatal: Need to specify how to reconcile divergent branches. if (isOptional && this.omitDependencyTypes.has('optional')) { this.console.debug('DEBUG | omit optional component: %j %j', data.name, data._id) return false - } - - // older npm-ls versions (v6) hide properties behind a `_` + }From https://github.com/ARRY7686/cyclonedx-node-npm + * branch set_devdependencies_to_excluded -> FETCH_HEAD + hint: You have divergent branches and need to specify how to reconcile them. + hint: You can do so by running one of the following commands sometime before + hint: your next pull: + hint: + hint: git config pull.rebase false # merge (the default strategy) + hint: git config pull.rebase true # rebase + hint: git config pull.ff only # fast-forward only + hint: + hint: You can replace "git config" with "git config --global" to set a default + hint: preference for all repositories. You can also pass --rebase, --no-rebase, + hint: or --ff-only on the command line to override the configured default per + hint: invocation. + fatal: Need to specify how to reconcile divergent branches.roperties behind a `_` const isDev = (data.dev ?? data._development) === true - if (isDev && this.omitDependencyTypes.has('dev')) { - this.console.debug('DEBUG | omit dev component: %j %j', data.name, data._id) - return false + // if (isDev && this.omitDependencyTypes.has('dev')) { + // this.console.debug('DEBUG | omit dev component: %j %j', data.name, data._id) + // return false + // } + + // Initialize component with a default value + let component: Models.Component | undefined = undefined; + + // Modify the component's scope for devDependencies + if (isDev) { + // Set the scope of dev dependencies to 'Excluded' + component = this.componentBuilder.makeComponent(data, type); + if (component) { + component.scope = Enums.ComponentScope.Excluded; // This line ensures dev dependencies are marked as excluded + } + } else { + // Handle other component logic (omitted for brevity) + component = this.componentBuilder.makeComponent(data, type); } // attention: `data.devOptional` are not to be skipped with devs, since they are still required by optionals. @@ -453,7 +496,7 @@ export class BomBuilder { } // endregion fix normalizations - const component = this.componentBuilder.makeComponent( + const newComponent = this.componentBuilder.makeComponent( _dataC as normalizePackageData.Package, type ) @@ -541,8 +584,8 @@ export class BomBuilder { `${component.group || '-'}/${component.name}@${component.version || '-'}` /* eslint-enable @typescript-eslint/strict-boolean-expressions, @typescript-eslint/prefer-nullish-coalescing */ - return component - } + return newComponent +} private makePurl (component: Models.Component): PackageURL | undefined { const purl = this.purlFactory.makeFromComponent(component, this.reproducible) diff --git a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json index 72919e06..e938f815 100644 --- a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json +++ b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.json @@ -144,9 +144,9 @@ }, { "type": "library", - "name": "my-local-b", + "name": "my-local-b-off", "version": "0.0.0", - "bom-ref": "my-local-b@0.0.0", + "bom-ref": "my-local-b-off@0.0.0", "description": "demo: my-local-b-off - a package with a different name than its dir", "licenses": [ { @@ -156,7 +156,7 @@ } } ], - "purl": "pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b", + "purl": "pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b", "externalReferences": [ { "url": "https://github.com/CycloneDX/cyclonedx-node-npm/issues", @@ -240,11 +240,11 @@ { "ref": "my-local-a@0.0.0", "dependsOn": [ - "my-local-b@0.0.0" + "my-local-b-off@0.0.0" ] }, { - "ref": "my-local-b@0.0.0" + "ref": "my-local-b-off@0.0.0" }, { "ref": "my-noname@0.0.0" diff --git a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml index 1b89af22..d6a29402 100644 --- a/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml +++ b/tests/_data/sbom_demo-results/bare/local-dependencies_from-setup.snap.xml @@ -105,8 +105,8 @@ true - - my-local-b + + my-local-b-off 0.0.0 demo: my-local-b-off - a package with a different name than its dir @@ -114,7 +114,7 @@ Apache-2.0 - pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b + pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b https://github.com/CycloneDX/cyclonedx-node-npm/issues @@ -170,9 +170,9 @@ - + - + \ No newline at end of file diff --git a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json index 72919e06..e938f815 100644 --- a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json +++ b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.json @@ -144,9 +144,9 @@ }, { "type": "library", - "name": "my-local-b", + "name": "my-local-b-off", "version": "0.0.0", - "bom-ref": "my-local-b@0.0.0", + "bom-ref": "my-local-b-off@0.0.0", "description": "demo: my-local-b-off - a package with a different name than its dir", "licenses": [ { @@ -156,7 +156,7 @@ } } ], - "purl": "pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b", + "purl": "pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b", "externalReferences": [ { "url": "https://github.com/CycloneDX/cyclonedx-node-npm/issues", @@ -240,11 +240,11 @@ { "ref": "my-local-a@0.0.0", "dependsOn": [ - "my-local-b@0.0.0" + "my-local-b-off@0.0.0" ] }, { - "ref": "my-local-b@0.0.0" + "ref": "my-local-b-off@0.0.0" }, { "ref": "my-noname@0.0.0" diff --git a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml index 1b89af22..d6a29402 100644 --- a/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml +++ b/tests/_data/sbom_demo-results/flatten-components/local-dependencies_from-setup.snap.xml @@ -105,8 +105,8 @@ true - - my-local-b + + my-local-b-off 0.0.0 demo: my-local-b-off - a package with a different name than its dir @@ -114,7 +114,7 @@ Apache-2.0 - pkg:npm/my-local-b@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b + pkg:npm/my-local-b-off@0.0.0?vcs_url=git%2Bssh%3A//git%40github.com/CycloneDX/cyclonedx-node-npm.git#demo/local-dependencies/project/packages/my-local-b https://github.com/CycloneDX/cyclonedx-node-npm/issues @@ -170,9 +170,9 @@ - + - + \ No newline at end of file