sbom-tool
sbom-tool copied to clipboard
The Maven dependencies graph is different from other package managers
With the release of V3, I see that sbom-tool can generate correct relationships between packages.
But somehow the relationship graph of Maven is different from others.
For example here is a npm project graph:
But for maven, it always has another maven root package besides sbom root package.
This causes issues when we want to get all direct dependencies, for example.
Do you think we should do something about this?