Generates BOM with duplicate dependencies

[marob]

On a PHP composer projet having 2 composer.json files in a vendor-bin directory, cdxgen generated a BOM with duplicated dependencies:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  ...
  },
  "components": [
    ...
  ],
  "services": [],
  "dependencies": [
    {
      "ref": "pkg:composer/app@latest",
      "dependsOn": []
    },
    {
      "ref": "pkg:composer/app@latest",
      "dependsOn": []
    },
    ...
  ]
}

It may be due to

cdxgen/lib/cli/index.js

Line 4900 in 5778776

dependencies.splice(0, 0, pdependencies);

adding the dependency without de-duplicating (after calling mergeDependencies that do some de-duplicating?).

[prabhu]

@marob could you kindly share a repo to replicate this issue? Alternatively, could you send a PR to use mergeDependencies like you have identified?

[marob]

Hi @prabhu.
I don't really have time for now. I created a repo with only the 2 files that should cause the issue (https://github.com/marob/cdxgen-1419) but I haven't tested it.