when I use a create in my library which has many optional features like sqlx (https://github.com/launchbadge/sqlx), and I create a sbom for my project, it also considers all the dependencies of the features which are actually not active.
Running cargo tree only lists the dependencies of activated features and lets the rest away. This would be very nice also to have for the sbom. For me personally this currently makes some problems because I process the sbom further (e.g. for vulnerability testing) and that one fails because of dependencies which are in actually not used by me.
It would be nice to consider those optional dependencies and filter them out in case they are not used.
Hi,
when I use a create in my library which has many optional features like
sqlx(https://github.com/launchbadge/sqlx), and I create a sbom for my project, it also considers all the dependencies of the features which are actually not active.Running cargo tree only lists the dependencies of activated features and lets the rest away. This would be very nice also to have for the sbom. For me personally this currently makes some problems because I process the sbom further (e.g. for vulnerability testing) and that one fails because of dependencies which are in actually not used by me.
It would be nice to consider those optional dependencies and filter them out in case they are not used.