CycloneDX
No way to capture top level dependencies from yarn projects
Since the yarn lock file does not contain dependency information about the root project, the tool flattens all the transitive dependencies and represents them as direct dependencies of the root in the sBOM for yarn projects.
Issue not present in npm or pnpm as their lock files represent this relationship accurately.
Would propose to modify the logic to generate the direct relationships for the root project only from package.json and the rest from yarn.lock as it currently is.
@ajmalab I exactly know what you're talking about. I tried to mirror what yarn list does. Will revisit and see if this could be improved.
https://github.com/CycloneDX/cdxgen/blob/master/index.js#L1896
@prabhu any update on this? I tried to build the cdxgen for react project: https://github.com/facebook/react I noticed that it is adding all the dependencies as if it is coming from the root package.json. Mostly for mono repos it is very hard to find the exact root project where the dependency is present. It should identify all the dirs with package.json as separate components.
Command used: cdxgen -t js
Is there anything that can be done with the SrcFile property in the meanwhile? Ideally, it must list all the lock files a given component was found.