CycloneDX / CycloneDX/cyclonedx-dotnet
Incorrect dependency structure on different target framework
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
A dependency may reference different dependency versions based on the project's target framework. When scanning a solution where two projects with different target frameworks reference the same dependency, the generated SBOM may incorrectly label a transitive dependency as a direct dependency.
**Steps to reproduce**
1. Given a fresh solution
2. Add a net6.0 project (P1)
3. Let P1 reference `Microsoft.Data.SqlClient@5.2.1`
4. Add a net8.0 project (P2)
5. Let P2 reference `Microsoft.Data.SqlClient@5.2.1`
6. Generate an SBOM for the solution
**Result**
- Microsoft.Data.SqlClient@5.2.1
- System.Runtime.Caching@6.0.0
- System.Runtime.Caching@8.0.0
Contributor guide
Research direction
Reproduce the issue with the two-project solution described: net6.0 and net8.0 projects both referencing Microsoft.Data.SqlClient@5.2.1, then generate the solution SBOM. Trace how the dependency graph classifies System.Runtime.Caching across the two target frameworks; done means the SBOM no longer labels the transitive version as a direct dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100