[BUG] SBOM packages and relationships missing under some circumstances

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When I try to generate SBOM for the opentelemetry-js repository, the output is missing some packages and relationships.

The repository is a monorepo with many sub-packages. They are defined using npm workspaces and listed under the packages and experimental/packages directories. Ideally, I would like to generate an SBOM file for each sub-package.

When I run the command below to generate SBOM for a single sub-package (packages/opentelemetry-core), it is missing in the relationships section (the dependency is in the packages/opentelemetry-semantic-conventions directory).

npm sbom --sbom-format spdx --omit dev --workspace packages/opentelemetry-core > sbom.json

The relationship is missing even when I generate SBOM for the whole repository by running this in the root directory:

npm sbom --sbom-format spdx --omit dev > sbom.json

In addition, the SBOM output for the whole repository is missing some dependencies completely even in the packages section of the SBOM file. For example, the sub-package in folder packages/opentelemetry-sdk-trace-node has a dependency on semver, but semver is not included in the SBOM file at all.

Expected Behavior

npm sbom should capture all dependencies in a repository with workspaces.

Steps To Reproduce

First issue:

1. Generate SBOM file using these steps

git clone git@github.com:open-telemetry/opentelemetry-js.git
cd opentelemetry-js
npm ci
npm sbom --sbom-format spdx --omit dev --workspace packages/opentelemetry-core > sbom.json

2. In the generated SBOM file, note that the package @opentelemetry/semantic-conventions is listed under packages, but NOT under dependencies.

Second issue:

1. Generate SBOM file using these steps

git clone git@github.com:open-telemetry/opentelemetry-js.git
cd opentelemetry-js
npm ci
npm sbom --sbom-format spdx --omit dev > sbom.json

2. In the generates SBOM file, note that the semver package is completely missing (in both packages and relationships sections), even though the package in packages/opentelemetry-sdk-trace-node depends on it.

Environment

• npm: 10.4.0
• Node.js: v18.18.0
• OS Name: macOS 14.2.1

Reproduce the two SBOM commands in the opentelemetry-js repository after npm ci, using the workspace and root cases described. Compare the generated SPDX packages, dependencies, and relationships, including @opentelemetry/semantic-conventions and semver; done means all workspace dependencies and relationships are captured.