[BUG] Generated bom fails to include package `luxon`

tomsontom commented 11 months ago

Describe the bug

If luxon is used in the application. The plugin fails include it in the output.

To Reproduce

Setup

git clone https://github.com/CycloneDX/cyclonedx-webpack-plugin.git
cd cyclonedx-webpack-plugin
npm install
cd tests/integration/webpack5-angular13
npm install --save luxon
npm install --save-dev @types/luxon

Use luxon

Change app.component.ts to look like this:

import { Component } from '@angular/core';
import { DateTime } from 'luxon'; 

console.log(DateTime.now());

@Component({
  selector: 'app-root',
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
})
export class AppComponent {
  title = '@cyclonedx-weboack-plugin-tests/example-webpack5-angular13';
}

Run build

npm run build

Expected behavior

I would expect that dist/.bom/bom.json to contain luxon

Screenshots or output-paste

luxon not contained

Environment

@cyclonedx/webpack-plugin version: current main-branch
webpack version: 5.76.1
Node version: 18.16.0
OS: mac osx

Additional context

The reason luxon is not contained in the output is that "node_modules/luxon/src" contains a filed named "package.json" with the following content

{
  "type": "module",
  "version": "3.4.4"
}

See https://github.com/moment/luxon/blob/3125686af82d9a25c7267a1cf1eb838a3d41144f/src/package.json#L1 and so cyclone is unable to find a name and skips luxon in the output.

A possible fix would be to make https://github.com/CycloneDX/cyclonedx-webpack-plugin/blob/ac87cd733ddb620fdc68dbe4b257e8aabdb02311/src/_helpers.ts#L28 smarter and check if there's a name and version and search on if none is in the loaded package.json