Missing dependency relationships between direct dependencies and transient dependencies in NPM packages #3109
Description
What happened:
Generating an SBOM in SPDX format for a filesystem containing a Node.js (npm) project, the dependency relationships between direct dependencies and transient dependencies are non-existent. In other words, the DEPENDENCY_OF classification is not present in the relationships portion of the SBOM.
Note: This is only evident for NPM packages. The correct dependency relationships are being generated for Python (Poetry) projects.
What is being generated by Syft:
Note: I'm grabbing specific items from the relationships list in order to compare it to the expected result below.
"relationships": [
{
"spdxElementId": "SPDXRef-Package-npm-tiny-package-4fae87ebfc4badf1",
"relatedSpdxElement": "SPDXRef-File-package-lock.json-fd71c2238fc07657",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-Package-npm-express-e6213bae4cd38c7c",
"relatedSpdxElement": "SPDXRef-File-package-lock.json-fd71c2238fc07657",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-Package-npm-accepts-317fb941ea652a28",
"relatedSpdxElement": "SPDXRef-File-package-lock.json-fd71c2238fc07657",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-Package-npm-array-flatten-cfb05003ba72ba14",
"relatedSpdxElement": "SPDXRef-File-package-lock.json-fd71c2238fc07657",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
}
]
What you expected to happen:
"relationships": [
{
"spdxElementId": "SPDXRef-DOCUMENT",
"relatedSpdxElement": "SPDXRef-1-tiny-package-1.0.0",
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-2-express-4.19.2",
"relatedSpdxElement": "SPDXRef-1-tiny-package-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-3-accepts-1.3.8",
"relatedSpdxElement": "SPDXRef-2-express-4.19.2",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-7-array-flatten-1.1.1",
"relatedSpdxElement": "SPDXRef-2-express-4.19.2",
"relationshipType": "DEPENDENCY_OF"
},
Steps to reproduce the issue:
mdkir tiny-package && cd tiny-packagenpm init -ynpm install expresssyft . --source-name=tiny-package -o spdx-json=syft.sbom.json
Anything else we need to know?:
Environment:
- Output of
syft version:
Application: syft
Version: 1.10.0
BuildDate: 2024-07-30T16:02:52Z
GitCommit: Homebrew
GitDescription: [not provided]
Platform: darwin/arm64
GoVersion: go1.22.5
Compiler: gc
- OS (e.g:
cat /etc/os-releaseor similar):
macOS Venture 13.6