Fix: mark devDependencies as "excluded" in SBOM results #1222
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This pull request addresses the issue #1151, where devDependencies in the Software Bill of Materials (SBOM) were incorrectly marked as required. According to the CycloneDX specification, devDependencies should be marked with the excluded scope since they are not required at runtime but used for development or testing purposes.
Changes Implemented:
Modified the makeComponent method in src/builders.ts to set the scope of devDependencies to excluded.
Added a conditional check for dev dependencies, ensuring they are marked as excluded in the generated SBOM.
Commented out the original logic that omitted devDependencies entirely, which was not compliant with the SBOM specification.
Testing Performed:
Verified the SBOM generation for projects with both regular and devDependencies.
Ensured that regular dependencies are marked as required and devDependencies are correctly marked as excluded in the generated SBOM.
All the tests have been passed
Issue Reference:
This pull request fixes #1151.