required-only and no-babel not affecting result, what am I missing?

[pongells]

Hello,

I am using Yarn3 with a monorepo built with Nx.

I have a single main package.json and yarn.lock file.

Whether I run:

cdxgen -t node.js -o bom.json -r

or

cdxgen -t node.js -o bom.json --required-only --no-babel -r

or

cdxgen -t node.js -o bom.json --required-only -r

I get the same result -- all of the dependencies.

What am I missing? Thank you.

[prabhu]

@pongells Interesting. Could you share the directory structure and the output with debug enabled.

export CDXGEN_DEBUG_MODE=debug

[pongells]

I created a repro here: https://github.com/pongells/cyclonedx-repro

% export CDXGEN_DEBUG_MODE=debug
% cdxgen -t node.js -o bom.json -r                                                  
Scanning .
Performing babel-based package usage analysis with source code at .
Parsing /Workspace/cyclonedx-repro/yarn.lock
Found 909 npm packages at .
BoM includes 909 components and 933 dependencies after dedupe
% cdxgen -t node.js -o bom-req-babel.json --required-only --no-babel -r             
Scanning .
Parsing /Workspace/cyclonedx-repro/yarn.lock
Found 909 npm packages at .
BoM includes 909 components and 933 dependencies after dedupe

[puchta]

Any news on this topic? I face the same behaviour.

[pongells]

no news AFAIK, @prabhu ?

[prabhu]

I am currently distracted by another project. Could someone add console.log and share what is coming back from analyzer.js after the babel step?

Also, share the bom.json for the sample repo so that we can inspect and see what values are set for the scope attribute and the properties.

[prabhu]

@pongells, could you try the PR #644?

I tested --required-only and got back 8 components. Not sure if this is too aggressive. It doesn't work without babel yet (so --no-babel isn't supported)

[pongells]

I did not check the details, but it looks much much better! thank you :D