Fix missing project-level dependencies when importing SPDX SBOMs #1918#2035
Open
Monal-Reddy wants to merge 2 commits intoaboutcode-org:mainfrom
Open
Fix missing project-level dependencies when importing SPDX SBOMs #1918#2035Monal-Reddy wants to merge 2 commits intoaboutcode-org:mainfrom
Monal-Reddy wants to merge 2 commits intoaboutcode-org:mainfrom
Conversation
Monal-Reddy
force-pushed
the
fix-spdx-project-deps
branch
from
cce7844 to
ad6b2af
Compare
…cies Signed-off-by: Monal-Reddy <monalreddy001@gmail.com>
Monal-Reddy
force-pushed
the
fix-spdx-project-deps
branch
from
ad6b2af to
2b8eb3f
Compare
Monal-Reddy
changed the title
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When importing SPDX SBOMs, dependencies originating from the document root (SPDXRef-DOCUMENT) were treated as package-to-package dependencies instead of project-level dependencies.
This caused direct dependencies to be lost when the same package also appeared transitively.
This change maps SPDXRef-DOCUMENT to project-level dependencies (for_package=None), preserving both direct and transitive relationships.