What happened:
Syft not created "dependencies" in cyclonedx report for Go, Rust, Java and etc.
Cargo.lock had "dependencies". View like

[[package]]
name = "yaserde"
version = "0.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4bf52af554a50b866aaad63d7eabd6fca298db3dfe49afd50b7ba5a33dfa0582"
dependencies = [
 "log",
 "xml-rs",
 "yaserde_derive",
]

But output syft doesnt reflect this
What you expected to happen:
Want full cyclonedx report with "dependencies" and "depensOn" included

Steps to reproduce the issue:
syft -o cyclone-dx-json@1.5 Cargo.lock > report.json

Anything else we need to know?:

Environment:
Syft 0.94