null entries in dependsOn

[aidansteele]

Hi,

This behaviour is using @cyclonedx/webpack-plugin v1.0.1. Unfortunately I'm having a fair bit of difficulty reproducing it in a minimal example (I'm seeing different behaviour in our closed source app) but I thought it might still be worth reporting.

For the closed source app, I am seeing the following entry in the generated bom.json:

{
    "ref": "pkg:npm/%40reach/[email protected]",
    "dependsOn": [
        "pkg:npm/%40reach/[email protected]",
        null
    ]
}

In my attempt at a minimal repro, I don't get a null in the dependsOn array, but I do get an empty object in the dependencies array:

    {
      "ref": "pkg:npm/%40reach/[email protected]",
      "dependsOn": [
        "pkg:npm/[email protected]",
        "pkg:npm/[email protected]",
        "pkg:npm/[email protected]",
        "pkg:npm/%40reach/[email protected]"
      ]
    },
    {
      "ref": "pkg:npm/[email protected]",
      "dependsOn": [
        "pkg:npm/[email protected]"
      ]
    },
    {
      "ref": "pkg:npm/[email protected]"
    },
    {
      "ref": "pkg:npm/[email protected]",
      "dependsOn": [
        "pkg:npm/[email protected]"
      ]
    },
    {
      "ref": "pkg:npm/%40reach/[email protected]"
    },
    {},

I will continue to try to pare down the closed source webpack config (it's big) and see if I can reproduce the nulls in a sample for you. Or let me know if there are specific things I can do to help debug this.

[aidansteele]

cyclonedx-webpack-plugin/src/webpack-plugin/bomGenerator.js

Line 76 in e68d2bd

const {package: dependencyPackage, path: dependencyPath} = dependencyPkg;

(If it helps) I sprinkled logs throughout this plugin and found that in the above line, dependencyPath is /<trim>/node_modules/@reach/utils/compose-refs/package.json and dependencyPackage is:

{
    "main": "dist/reach-utils-compose-refs.cjs.js",
    "module": "dist/reach-utils-compose-refs.esm.js",
    "name": "",
    "version": "",
    "readme": "ERROR: No README data found!",
    "_id": "@"
}

I think this is because the @reach/utils package has a file at /compose-refs/package.json in addition to /package.json. And this nested package.json is very bare:

{
  "main": "dist/reach-utils-compose-refs.cjs.js",
  "module": "dist/reach-utils-compose-refs.esm.js"
}