CycloneDX / CycloneDX/cyclonedx-dotnet

Incorrect dependency structure on different target framework

Open
#911 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

A dependency may reference different dependency versions based on the project's target framework. When scanning a solution where two projects with different target frameworks reference the same dependency, the generated SBOM may incorrectly label a transitive dependency as a direct dependency.

**Steps to reproduce**

1. Given a fresh solution
2. Add a net6.0 project (P1)
3. Let P1 reference `Microsoft.Data.SqlClient@5.2.1`
4. Add a net8.0 project (P2)
5. Let P2 reference `Microsoft.Data.SqlClient@5.2.1`
6. Generate an SBOM for the solution

**Result**

- Microsoft.Data.SqlClient@5.2.1
- System.Runtime.Caching@6.0.0
- System.Runtime.Caching@8.0.0

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the two-project solution described: net6.0 and net8.0 projects both referencing Microsoft.Data.SqlClient@5.2.1, then generate the solution SBOM. Trace how the dependency graph classifies System.Runtime.Caching across the two target frameworks; done means the SBOM no longer labels the transitive version as a direct dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.