detect "external dependencies" and included them in the SBOM result

[emersonpgomes]

Hi! First, thanks for this great plugin.

So, I have a webpack config with some external dependencies like react, react-dom, and lodash:

// webpack.config.js
{
  // ...
  externals: [
    // ...
    {
      "react-dom": "ReactDOM",
      lodash: "_",
      react: "React",
    },
  ],
};

These dependencies were also added to the package.json, but we load them directly from our own CDN. However, there is no information about those in the BOM file.

When checking the plugin code I noticed that the context property is null for external modules and then it is skipped.

I would like the external dependencies to be added as well. Any suggestion on how to solve this?

[emersonpgomes]

Well, I can get a workaround by changing my build script to make a prebuild ignoring the external dependencies to get the correct BOM file, and then the normal build. It is slow but works.

[jkowalleck]

Did some research and found out:
the reason why the "externals" are currently not included: they are external. they are not part of webpack's build result.
Therefore, they are not read nor touched by webpack, and they are not bundled by webpack.
Therefore, they are not part of the SBOM, because they are not in your build result, meaning: you do not ship them with your software(webpack result), but simply have them as an external dependency.
external means: your build result does not control whether these things are installed at all, nor from where they come from in which version.

So at the time the SBOM is generated, there is no evidence for these externals.
just the idea that they could exist.
This is why the externals are not part of your SBOM at the moment.

[jkowalleck]

if anybody comes up with a process/solution to reflect the topic, then lets discuss first,
before an implementation is drafted.