Is the last element in property "dependencies" meaning "direct dependencies"?

[SandZn]

Hi,

I noticed that in bom.json, the last element in the property "dependencies" looked like the direct dependencies for the given package.

However, when I generated bom.json for yeoman-generator, there are 94 items in the array "dependsOn". But depending on the package.json in yeoman-generator, there are only 13 direct dependencies. I wonder how it happens and what exactly are the items in "dependsOn" in the last element of "dependencies".

{
      "ref": "pkg:npm/yeoman-generator@5.6.1",
      "dependsOn": [
        "pkg:npm/chalk@4.1.2",
        "pkg:npm/dargs@7.0.0",
        "pkg:npm/debug@4.3.4",
        "pkg:npm/execa@5.1.1",
        "pkg:npm/github-username@6.0.0",
        "pkg:npm/lodash@4.17.21",
        "pkg:npm/minimist@1.2.6",
        "pkg:npm/read-pkg-up@7.0.1",
        "pkg:npm/run-async@2.4.1",
        "pkg:npm/semver@7.3.7",
        "pkg:npm/shelljs@0.8.5",
        "pkg:npm/sort-keys@4.2.0",
        "pkg:npm/text-table@0.2.0",
        "pkg:npm/%40tootallnate/once@1.1.2",
        "pkg:npm/%40gar/promisify@1.1.3",
        "pkg:npm/%40isaacs/string-locale-compare@1.1.0",
        "pkg:npm/%40nodelib/fs.scandir@2.1.5",
        "pkg:npm/%40nodelib/fs.walk@1.2.8",
        "pkg:npm/%40npmcli/git@2.1.0",
        "pkg:npm/%40npmcli/fs@1.1.1",
        "pkg:npm/%40npmcli/move-file@1.1.2",
        "pkg:npm/%40npmcli/metavuln-calculator@2.0.0",
        "pkg:npm/%40npmcli/name-from-folder@1.0.1",
        "pkg:npm/%40npmcli/package-json@1.0.1",
        "pkg:npm/%40types/expect@1.20.4",
        "pkg:npm/%40types/minimatch@3.0.5",
        "pkg:npm/%40types/node@15.14.9",
        "pkg:npm/%40types/vinyl@2.0.6",
        "pkg:npm/ansi-escapes@4.3.2",
        "pkg:npm/are-we-there-yet@2.0.0",
        "pkg:npm/argparse@1.0.10",
        "pkg:npm/array-differ@3.0.0",
        "pkg:npm/array-union@2.1.0",
        "pkg:npm/arrify@2.0.1",
        "pkg:npm/asap@2.0.6",
        "pkg:npm/async@3.2.3",
        "pkg:npm/base64-js@1.5.1",
        "pkg:npm/binaryextensions@4.18.0",
        "pkg:npm/bl@4.1.0",
        "pkg:npm/braces@3.0.2",
        "pkg:npm/chardet@0.7.0",
        "pkg:npm/cli-cursor@3.1.0",
        "pkg:npm/cli-spinners@2.6.1",
        "pkg:npm/cli-table@0.3.11",
        "pkg:npm/cli-width@3.0.0",
        "pkg:npm/clone@2.1.2",
        "pkg:npm/clone-buffer@1.0.0",
        "pkg:npm/clone-stats@1.0.0",
        "pkg:npm/cmd-shim@5.0.0",
        "pkg:npm/common-ancestor-path@1.0.1",
        "pkg:npm/commondir@1.0.1",
        "pkg:npm/core-util-is@1.0.2",
        "pkg:npm/dateformat@4.6.3",
        "pkg:npm/debuglog@1.0.1",
        "pkg:npm/deep-extend@0.6.0",
        "pkg:npm/dezalgo@1.0.4",
        "pkg:npm/diff@5.0.0",
        "pkg:npm/dir-glob@3.0.1",
        "pkg:npm/error@10.4.0",
        "pkg:npm/eventemitter3@4.0.7",
        "pkg:npm/external-editor@3.1.0",
        "pkg:npm/fast-glob@3.2.11",
        "pkg:npm/figures@3.2.0",
        "pkg:npm/find-up@5.0.0",
        "pkg:npm/find-yarn-workspace-root2@1.2.16",
        "pkg:npm/gauge@3.0.2",
        "pkg:npm/globby@11.1.0",
        "pkg:npm/grouped-queue@2.0.0",
        "pkg:npm/inquirer@8.2.4",
        "pkg:npm/is-scoped@2.1.0",
        "pkg:npm/is-utf8@0.2.1",
        "pkg:npm/isbinaryfile@4.0.10",
        "pkg:npm/json-stringify-nice@1.1.4",
        "pkg:npm/just-diff@5.0.2",
        "pkg:npm/just-diff-apply@5.3.1",
        "pkg:npm/mem-fs@2.2.1",
        "pkg:npm/mem-fs-editor@9.4.0",
        "pkg:npm/npmlog@5.0.1",
        "pkg:npm/p-finally@1.0.0",
        "pkg:npm/p-queue@6.6.2",
        "pkg:npm/p-transform@1.3.0",
        "pkg:npm/parse-conflict-json@2.0.2",
        "pkg:npm/preferred-pm@3.0.3",
        "pkg:npm/pretty-bytes@5.6.0",
        "pkg:npm/proc-log@1.0.0",
        "pkg:npm/promise-all-reject-late@1.0.1",
        "pkg:npm/promise-call-limit@1.0.1",
        "pkg:npm/read-cmd-shim@3.0.0",
        "pkg:npm/readdir-scoped-modules@1.1.0",
        "pkg:npm/treeverse@1.0.4",
        "pkg:npm/untildify@4.0.0",
        "pkg:npm/walk-up-path@1.0.0",
        "pkg:npm/%40npmcli/arborist@4.3.1",
        "pkg:npm/encoding@0.1.13",
        "pkg:npm/yeoman-environment@3.9.1"
      ]
    }

[jkowalleck]

FOr the dependnecies spec see - Please read the docs:

• https://cyclonedx.org/use-cases/#dependency-graph
• https://cyclonedx.org/docs/1.4/json/#dependencies

If this as not a question but a bug report:
the cyclonedx-node-module is not up to date, its result may be inaccurate for some constellations.
Please try https://github.com/CycloneDX/cyclonedx-node-npm instead.

[SandZn]

Thanks. Before I consider this a bug, I need to make sure what I understand is correct. I also tried cyclonedx-node-npm and found bugs. I know the tool is under development, and I will report bugs under cyclonedx-node-npm. Thanks for the useful tools, which help me a lot!
I look forward to their improvement! 😊

[jkowalleck]

this conversation got closed due to #321