Dependencies of dev dependencies end up in SBOM despite `exclude-dev` option

[mm-jhn]

Version: CycloneDX 6.2.0

We have a project with a database layer that references Entity Framework. Some of the packages are development dependencies (PrivateAssets=all), and they are properly recognized as such with the --exclude-dev switch. But their dependencies still end up in the SBOM file (including all component details), even though these are not shipped as part of the application.

Simplified project file:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.9" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.9">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
  </ItemGroup>
</Project>

Command line and output:

D:\sbom-devdep-repro>dotnet cyclonedx Database.csproj -o sbom --exclude-dev --set-nuget-purl -spv 1.6

Found the following local nuget package cache locations:
    C:\Users\username\.nuget\packages\
Scanning at D:\sbom-devdep-repro\Database.csproj

» Analyzing: D:\sbom-devdep-repro\Database.csproj
  Attempting to restore packages
  Packages restored
  Found Assetsfile under D:\sbom-devdep-repro\obj\project.assets.json
Found 34 packages
2 packages being excluded as DevDependencies

Creating CycloneDX BOM
Writing to: D:\sbom-devdep-repro\sbom\bom.xml

Snippets from the resulting bom.xml:

  <dependencies>
    <dependency ref="pkg:nuget/Database@0.0.0">
      <dependency ref="pkg:nuget/Microsoft.EntityFrameworkCore@10.0.9" />
      <dependency ref="pkg:nuget/Microsoft.EntityFrameworkCore.Relational@10.0.9" />
    </dependency>
    <dependency ref="pkg:nuget/Humanizer.Core@2.14.1" />
    <dependency ref="pkg:nuget/Microsoft.Build.Framework@18.0.2" />
    <dependency ref="pkg:nuget/Microsoft.CodeAnalysis.Analyzers@3.11.0" />
    <dependency ref="pkg:nuget/Microsoft.CodeAnalysis.Common@5.0.0">
      <dependency ref="pkg:nuget/Microsoft.CodeAnalysis.Analyzers@3.11.0" />
    </dependency>
<!-- ... -->

<component type="library" bom-ref="pkg:nuget/Humanizer.Core@2.14.1">
  <!-- ... -->
  <name>Humanizer.Core</name>
  <version>2.14.1</version>
  <!-- ... -->
</component>
<component type="library" bom-ref="pkg:nuget/Microsoft.Build.Framework@18.0.2">
  <!-- ... -->
  <name>Microsoft.Build.Framework</name>
  <version>18.0.2</version>
  <!-- ... -->
</component>
<component type="library" bom-ref="pkg:nuget/Microsoft.CodeAnalysis.Analyzers@3.11.0">
  <!-- ... -->

You can see that the direct dependencies of Database are correctly set, but the dependencies of dev dependencies still show up.

[Whathecode]

Confirmed. Currently, all dependencies are collected, and dev dependencies are simply filtered out if --exclude-dev is set.

Instead, the dependency tree will need to be traversed recursively to mark all transitive dependencies of dev dependencies as potential dev dependencies in turn. However, the same dependencies may be used by non-dev dependencies, so care needs to be taken before removing them entirely.