SBOM generation failures since v16.0.3

[funnelfiasco]

Summary

As noted in #86839, SBOM generation with cdxgen fails starting with v16.0.3. More specifically, it appears to be introduced in 88581b9 (PR #84210).

Any ideas? (Or suggestions on how to avoid auto-closure of meta-issues?)

Additional information

No response

Example

No response

[icyJoseph]

Hiyo, I'll forward this to the team. Let's keep it here as a discussion, for now, once we have more evidence and what not we can move the discussion into an issue. And sorry in advance if people start to post LLM answers as if they had worked with the tool their whole lives.

Is there any set of flags that need to be passed cdxgen though? Does the error mean that it is finding @napi-rs/[email protected] again when going through turbopack/crates/turbopack-tests and that causes a YAML syntax error? 🤔 can't it just ignore the turbopack tests?

[funnelfiasco]

cdxgen is pretty forgiving in my experience. I did try getting a little more specific with my invocation, specifying a type with both --type javascript and --type pnpm (not at the same time). I also tried --required-only to try to reduce the scope. None of those flags changed the behavior.

I think the the error messages might be a red herring. A successful run (against Next v16.0.2) also produces that error without tha YAML syntax error:

Found a duplicate workspace with the name: webpack-sources, ref: pkg:npm/webpack-sources at packages/next/src/compiled/webpack-sources1/package.json and packages/next/src/compiled/webpack-sources3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/webpack-sources#packages/next/src/compiled/webpack-sources1 under metadata.component.components
Found a duplicate workspace with the name: web-vitals, ref: pkg:npm/web-vitals at packages/next/src/compiled/web-vitals/package.json and packages/next/src/compiled/web-vitals-attribution/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/web-vitals#packages/next/src/compiled/web-vitals under metadata.component.components
Found a duplicate workspace with the name: schema-utils, ref: pkg:npm/schema-utils at packages/next/src/compiled/schema-utils2/package.json and packages/next/src/compiled/schema-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/schema-utils#packages/next/src/compiled/schema-utils2 under metadata.component.components
Found a duplicate workspace with the name: loader-utils, ref: pkg:npm/loader-utils at packages/next/src/compiled/loader-utils2/package.json and packages/next/src/compiled/loader-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/loader-utils#packages/next/src/compiled/loader-utils2 under metadata.component.components
Unable to find any package.json files belonging to the workspace 'crates/js' referred in /Users/bcotton/devel/next.js/pnpm-workspace.yaml. To improve SBOM precision, run cdxgen from the directory containing the complete source code.
Found a duplicate workspace with the name: exports, ref: pkg:npm/exports at turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a/package.json and turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-b/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/exports#turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a under metadata.component.components
Failed to parse package: next-rspack-binding@undefined,fail with:name or version is not defined

From the failure output, I think where it's failing is on @napi-rs/wasm-runtime but it's not clear to me why (full disclosure, I am not an expert on Next or cdxgen, so I may be missing something obvious). The only changes including "wasm-runtime" between the first-bad (88581b9) and last-good (4da7406) commits are bumps to package lock files. Maybe there's a change in the build behavior?

   '@napi-rs/[email protected]':
-  '@napi-rs/[email protected]':
+  '@napi-rs/[email protected]':
   '@napi-rs/[email protected]':
-  '@napi-rs/[email protected]':
+  '@napi-rs/[email protected]':
-      '@napi-rs/wasm-runtime': 1.0.3
+      '@napi-rs/wasm-runtime': 1.0.7
   '@napi-rs/[email protected]':
-  '@napi-rs/[email protected]':
+  '@napi-rs/[email protected]':
   '@napi-rs/[email protected]':
-      '@napi-rs/wasm-runtime': 1.0.3
+      '@napi-rs/wasm-runtime': 1.0.7
-  '@napi-rs/[email protected]':
+  '@napi-rs/[email protected]':
   '@napi-rs/[email protected]':

I'm certainly open to the possibility that this is a cdxgen bug that versions of Next prior to 16.0.3 didn't trigger for some reason.