Excluding development dependencies (e.g. npm devDependencies)

[josundt]

Development time dependencies (like npm devDependencies) do not belong in a software bill of materials (SBOM).
Such dependencies are not "materials" of the "software", but rather tools used at development/build time.

Development dependencies do normally not concern external stakeholders, and it is therefore normally desirable to exclude them from a SBOM.

In my opinion, it would be most correct if sbom-tool excluded development dependencies by default.
But that will introduce a behavioral breaking change for the tool.

So I guess instead there should be a way to configure this (command line arg?)

FYI: Comparison: npm audit (which runs an npm dependency graph vulnerability scan), supports the argument --omit dev to exclude devDependencies.

Can you please prioritize this feature request?

[THEJRRR]

As it stands, there is not a consistent way to accomplish this across languages. In addition, we believe the packages that can impact the built software, like dev dependencies, should be disclosed in the SBOM. When VEX statements are fully implemented, that will be the place to indicate if packages do not impact the built software and how that is the case.

[mvarblow]

While it's not supported for all package ecosystems, it looks like labeling dev dependencies is a feature of the Component Detection library. So I don't see how lack of support is a good reason not to include the feature. Npm is one ecosystem where it is supported. And this is the ecosystem where it's most needed (or at least requested).

https://github.com/microsoft/component-detection/blob/main/docs/feature-overview.md

FWIW, this was requested (and rejected) early on in #78. In the comments for this earlier issue, it was also pointed out that lack of component detection support seems like a bad/false reason not to implement the feature.

[ollwenjones]

I also disagree that "packages that can impact the built software" is enough of a rubric for including devDependencies cart blanch. A devDependency is often something used to assist the development of a package (e.g. express in webpack dev server), but has 0 possibility of impacting the shipped software itself.