add dependencies

[kabo]

Closes #61

#244 seems to have stalled...

This should be enough to to add dependencies though?

If someone could please direct me to some docs on how to generate new test snapshots I could do that as well.

[jkowalleck]

@kabo

If someone could please direct me to some docs on how to generate new test snapshots I could do that as well.

just run the tests as described here: https://github.com/CycloneDX/cyclonedx-node-module/blob/master/CONTRIBUTING.md
jest will tell you how to generate new snapshots.

Snapshot Summary
 › 12 snapshots failed from 1 test suite. Inspect your code changes or run `npm run test:jest -- -u` to update them.

Test Suites: 1 failed, 5 passed, 6 total
Tests:       12 failed, 39 passed, 51 total
Snapshots:   12 failed, 6 passed, 18 total
Time:        2.987 s
Ran all test suites.

see https://github.com/CycloneDX/cyclonedx-node-module/runs/6302754636?check_suite_focus=true#step:8:1310

[jkowalleck]

@kabo please rebase on latest master

[jkowalleck]

the dependency graph might look like an easy feature at first,
but the spec is more complex than it might look like.

it is totally understandable, that this feature needs some back and forth, and lots of reading of examples

here a re some resources that helped implementing the feature in other tools

• https://cyclonedx.org/use-cases/#dependency-graph
• https://github.com/CycloneDX/bom-examples/tree/master/SBOM

[jkowalleck]

implementation looks promising.
will review the snapshots from integration tests soon,
to make sure that all results are valid to CycloneDX spec and valid according to JSON schema / XML xsd

[jkowalleck]

@kabo could you add a entry to the HISTORY?
see https://github.com/CycloneDX/cyclonedx-node-module/blob/master/HISTORY.md

the format could look like this:

# Changelog

All notable changes to this project will be documented in this file.

## unreleased

* Added
  * Dependency graph is built and emitted. ([#61] via [#296]) 

[#61]: https://github.com/CycloneDX/cyclonedx-node-module/issues/61
[#296]: https://github.com/CycloneDX/cyclonedx-node-module/pull/296

## 3.8.1 - 2022-05-05

[jkowalleck]

implementation looks promising. will review the snapshots from integration tests soon, to make sure that all results are valid to CycloneDX spec and valid according to JSON schema / XML xsd

reviewed the snapshots. all looks good.
trees are complete from root to leafs.
one exception: the example where the package name is missing, then the purl is not generated and therefore the bomref is missing. this example is properly handled, and currently acceptable.

[jkowalleck]

thanks you for the feature, @kabo .
it was part of release 3.9