CycloneDX / CycloneDX/cyclonedx-dotnet-library

Flatmerge clobbers metadata.component

Open
#183 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
28
Forks
35
PR merge metrics
No merged PRs in 30d

Description

Flatmerge clobbers metadata.component when the new metadata is initiated and the only sub-element that persists is metadata.tool.

https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/b5fbaf66e4fcae632950744f66b7f37e41e2dcb3/src/CycloneDX.Utils/Merge.cs#L62

If you can advise on how this should be handled, I'm happy to create a pull request with the change. Possibly, convert metadata.component to a List and then merge like metadata.tool?

This bug is linked to the following issues

#https://github.com/CycloneDX/cyclonedx-cli/issues/218
#https://github.com/CycloneDX/cyclonedx-cli/issues/219

Contributor guide

Open the contributing guide

Research direction

Start in src/CycloneDX.Utils/Merge.cs at line 62, where the metadata merge is reported to replace metadata.component while retaining metadata.tool. Review the linked cyclonedx-cli issues for the expected behavior, then verify that the chosen merge behavior preserves the intended metadata.component and metadata.tool values.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.