fix: lossless flattening of dependency graph during JSON serialization

cyclonedx/output/json.py

@@ -19,7 +19,7 @@
 from json import dumps as json_dumps, loads as json_loads
 from typing import TYPE_CHECKING, Any, Literal, Optional, Union
 
-from ..contrib.bom.utils import BomRefDiscriminator
+from ..contrib.bom.utils import BomDependencyGraphFlatMerger, BomRefDiscriminator
 from ..exception.output import FormatNotSupportedException
 from ..schema import OutputFormat, SchemaVersion
 from ..schema.schema import (
@@ -72,9 +72,10 @@ def generate(self, force_regeneration: bool = False) -> None:
         bom = self.get_bom()
         bom.validate()
         with BomRefDiscriminator.from_bom(bom):
-            bom_json: dict[str, Any] = json_loads(
-                bom.as_json(  # type:ignore[attr-defined]
-                    view_=_view))
+            with BomDependencyGraphFlatMerger(bom):
+                bom_json: dict[str, Any] = json_loads(
+                    bom.as_json(  # type:ignore[attr-defined]
+                        view_=_view))
         bom_json.update(_json_core)
         self._bom_json = bom_json
         self.generated = True

tests/_data/models.py

@@ -1589,6 +1589,78 @@ def get_bom_for_issue540_duplicate_components() -> Bom:
     bom.register_dependency(component1, [component3])
     return bom
 
+
+def get_bom_for_issue941_nested_dependencies_irreversible_migrate() -> Bom:
+    bom = _make_bom()
+    bom.metadata.component = root_component = Component(
+        name='myApp',
+        type=ComponentType.APPLICATION,
+        bom_ref='myApp'
+    )
+
+    component1 = Component(
+        type=ComponentType.LIBRARY,
+        name='some-library',
+        bom_ref='some-library1'
+    )
+    bom.components.add(component1)
+
+    component2 = Component(
+        type=ComponentType.LIBRARY,
+        name='some-library',
+        bom_ref='some-library2'
+    )
+    bom.components.add(component2)
+
+    component3 = Component(
+        type=ComponentType.LIBRARY,
+        name='some-other-library',
+        bom_ref='some-library3'
+    )
+    bom.components.add(component3)
+
+    component4 = Component(
+        type=ComponentType.LIBRARY,
+        name='some-other-library',
+        bom_ref='some-library4'
+    )
+    bom.components.add(component4)
+
+    bom.dependencies.add(
+        Dependency(
+            root_component.bom_ref,
+            dependencies=[
+                Dependency(
+                    component1.bom_ref,
+                    dependencies=[
+                        Dependency(
+                            component2.bom_ref,
+                            dependencies=[
+                                Dependency(component3.bom_ref),
+                            ]
+                        ),
+                    ]
+                ),
+                Dependency(
+                    component2.bom_ref,
+                    dependencies=[
+                        Dependency(component4.bom_ref),
+                    ]
+                ),
+            ]
+        )
+    )
+    bom.dependencies.add(
+        Dependency(
+            component3.bom_ref,
+            dependencies=[
+                Dependency(component4.bom_ref),
+            ]
+        )
+    )
+
+    return bom
+
 # ---
 
 

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.0.xml.bin

@@ -0,0 +1,25 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>some-library</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>some-library</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>some-other-library</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>some-other-library</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.1.xml.bin

@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
+  <components>
+    <component type="library" bom-ref="some-library1">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library2">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library3">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library4">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+  </components>
+</bom>

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.2.json.bin

@@ -0,0 +1,73 @@
+{
+  "components": [
+    {
+      "bom-ref": "some-library1",
+      "name": "some-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library2",
+      "name": "some-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library3",
+      "name": "some-other-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library4",
+      "name": "some-other-library",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "some-library1",
+        "some-library2"
+      ],
+      "ref": "myApp"
+    },
+    {
+      "dependsOn": [
+        "some-library2"
+      ],
+      "ref": "some-library1"
+    },
+    {
+      "dependsOn": [
+        "some-library3",
+        "some-library4"
+      ],
+      "ref": "some-library2"
+    },
+    {
+      "dependsOn": [
+        "some-library4"
+      ],
+      "ref": "some-library3"
+    },
+    {
+      "ref": "some-library4"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "myApp",
+      "name": "myApp",
+      "type": "application",
+      "version": ""
+    },
+    "timestamp": "2023-01-07T13:44:32.312678+00:00"
+  },
+  "serialNumber": "urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac",
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.2.xml.bin

@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
+  <metadata>
+    <timestamp>2023-01-07T13:44:32.312678+00:00</timestamp>
+    <component type="application" bom-ref="myApp">
+      <name>myApp</name>
+      <version/>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="some-library1">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library2">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library3">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library4">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="myApp">
+      <dependency ref="some-library1">
+        <dependency ref="some-library2">
+          <dependency ref="some-library3"/>
+        </dependency>
+      </dependency>
+      <dependency ref="some-library2">
+        <dependency ref="some-library4"/>
+      </dependency>
+    </dependency>
+    <dependency ref="some-library1"/>
+    <dependency ref="some-library2"/>
+    <dependency ref="some-library3">
+      <dependency ref="some-library4"/>
+    </dependency>
+    <dependency ref="some-library4"/>
+  </dependencies>
+</bom>

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.3.json.bin

@@ -0,0 +1,73 @@
+{
+  "components": [
+    {
+      "bom-ref": "some-library1",
+      "name": "some-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library2",
+      "name": "some-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library3",
+      "name": "some-other-library",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "some-library4",
+      "name": "some-other-library",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "some-library1",
+        "some-library2"
+      ],
+      "ref": "myApp"
+    },
+    {
+      "dependsOn": [
+        "some-library2"
+      ],
+      "ref": "some-library1"
+    },
+    {
+      "dependsOn": [
+        "some-library3",
+        "some-library4"
+      ],
+      "ref": "some-library2"
+    },
+    {
+      "dependsOn": [
+        "some-library4"
+      ],
+      "ref": "some-library3"
+    },
+    {
+      "ref": "some-library4"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "myApp",
+      "name": "myApp",
+      "type": "application",
+      "version": ""
+    },
+    "timestamp": "2023-01-07T13:44:32.312678+00:00"
+  },
+  "serialNumber": "urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac",
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}

tests/_data/snapshots/get_bom_for_issue941_nested_dependencies_irreversible_migrate-1.3.xml.bin

@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
+  <metadata>
+    <timestamp>2023-01-07T13:44:32.312678+00:00</timestamp>
+    <component type="application" bom-ref="myApp">
+      <name>myApp</name>
+      <version/>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="some-library1">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library2">
+      <name>some-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library3">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+    <component type="library" bom-ref="some-library4">
+      <name>some-other-library</name>
+      <version/>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="myApp">
+      <dependency ref="some-library1">
+        <dependency ref="some-library2">
+          <dependency ref="some-library3"/>
+        </dependency>
+      </dependency>
+      <dependency ref="some-library2">
+        <dependency ref="some-library4"/>
+      </dependency>
+    </dependency>
+    <dependency ref="some-library1"/>
+    <dependency ref="some-library2"/>
+    <dependency ref="some-library3">
+      <dependency ref="some-library4"/>
+    </dependency>
+    <dependency ref="some-library4"/>
+  </dependencies>
+</bom>