Repository navigation
Duplicate refs in dependsOn since v6.3.0 #1143
Description
Summary
When several projects in a solution depend on the same package, but one of that package's dependencies is missing from the restored dependency graph of some of those projects (through PrivateAssets = "all"), the generated BOM lists that dependency twice in the package's dependsOn array. The generated manifest then violates the CycloneDX 1.6 schema.
Trying to upload the file to DependencyTrack results in this error:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"/dependencies/<number>/dependsOn: must have only unique items in the array"
]
}
Repro
It's a bit hard to explain IMO, so here is a minimal sample that reproduces the issue.
Repro.slnx
<Solution>
<Project Path="Api/Api.csproj" />
<Project Path="Consumer/Consumer.csproj" />
</Solution>
Api.csproj
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
<PackageReference Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.11" PrivateAssets="all" />
</ItemGroup>
</Project>
Consumer.csproj
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../Api/Api.csproj" />
</ItemGroup>
</Project>
nuget.config
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<clear />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
</packageSources>
</configuration>
Commands to run:
$ dotnet restore Repro.slnx
$ dotnet tool install -g CycloneDX --version 6.3.1
$ dotnet CycloneDX Repro.slnx -o out -F Json
The resulting out/bom.json then contains a duplicate entry in Swashbuckle.AspnetCore's dependsOn.
"dependencies": [
...
{
"ref": "pkg:nuget/Swashbuckle.AspNetCore@10.0.1",
"dependsOn": [
"pkg:nuget/Microsoft.Extensions.ApiDescription.Server@10.0.11",
"pkg:nuget/Swashbuckle.AspNetCore.Swagger@10.0.1",
"pkg:nuget/Swashbuckle.AspNetCore.SwaggerGen@10.0.1",
"pkg:nuget/Swashbuckle.AspNetCore.SwaggerUI@10.0.1",
"pkg:nuget/Microsoft.Extensions.ApiDescription.Server@10.0.11" <--- duplicated
]
},
...
]
This seems to only affect versions >= 6.3.0. v6.2.1 does not duplicate the entry.
Activity
fix: deduplicate refs in dependsOn