fix: exclude devDep transitive trees from yarn berry SBOM and use exact purl matching

Address two review comments:

1. Yarn berry addDependenciesToSbom() now builds a reachable set via
   BFS from root production deps, so devDependency nodes and their
   entire transitive trees are excluded from the SBOM — not just the
   root edges.

2. Replace substring-based checkIfPackageInsideDependsOnList() with
   purl-prefix matching in ensurePeerAndOptionalDeps() to avoid false
   positives (e.g. "minimist" matching "minimist-options") and false
   negatives (e.g. "@hapi/joi" not matching URL-encoded "%40hapi/joi").

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

Author: soul2zimate

src/cyclone_dx_sbom.js

@@ -282,6 +282,21 @@ export default class CycloneDxSbom {
 		}
 	}
 
+	/**
+	 * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+	 * @param {PackageURL} sourceRef - The source component
+	 * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+	 * @return {boolean}
+	 */
+	checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+		const sourcePurl = sourceRef.toString();
+		const depIndex = this.getDependencyIndex(sourcePurl);
+		if (depIndex < 0) {
+			return false;
+		}
+		return this.dependencies[depIndex].dependsOn.some(dep => dep.startsWith(purlPrefix));
+	}
+
 	/** Removes the root component from the sbom
 	 */
 	removeRootComponent() {

src/providers/base_javascript.js

@@ -278,13 +278,15 @@ export default class Base_javascript {
 	 */
 	#ensurePeerAndOptionalDeps(sbom) {
 		const rootPurl = toPurl(purlType, this.#manifest.name, this.#manifest.version);
-		const rootComponent = sbom.getRoot();
 		const depSources = [this.#manifest.peerDependencies, this.#manifest.optionalDependencies];
 		for (const source of depSources) {
 			for (const [name, version] of Object.entries(source)) {
-				if (!sbom.checkIfPackageInsideDependsOnList(rootComponent, name)) {
-					const target = toPurl(purlType, name, version);
-					sbom.addDependency(rootPurl, target);
+				// Build the purl prefix for exact matching (e.g. "pkg:npm/minimist@"
+				// or "pkg:npm/%40hapi/joi@") to avoid substring false positives
+				const probe = toPurl(purlType, name, version);
+				const purlPrefix = probe.toString().replace(/@[^@]*$/, '@');
+				if (!sbom.checkDependsOnByPurlPrefix(rootPurl, purlPrefix)) {
+					sbom.addDependency(rootPurl, probe);
 				}
 			}
 		}

src/providers/processors/yarn_berry_processor.js

@@ -93,31 +93,95 @@ export default class Yarn_berry_processor extends Yarn_processor {
 			return;
 		}
 
-		// Collect names of production dependencies to filter out devDeps from root
+		// Build index of nodes by their value for quick lookup
+		const nodeIndex = new Map();
+		depTree.forEach(n => nodeIndex.set(n.value, n));
+
+		// Determine the set of node values reachable from root via production deps
 		const prodDeps = new Set(this._manifest.dependencies);
+		const reachable = new Set();
+		const queue = [];
+
+		// Seed with root's production dependencies
+		const rootNode = depTree.find(n => this.#isRoot(n.value));
+		if (rootNode?.children?.Dependencies) {
+			for (const d of rootNode.children.Dependencies) {
+				const to = this.#purlFromLocator(d.locator);
+				if (to) {
+					const fullName = to.namespace ? `${to.namespace}/${to.name}` : to.name;
+					if (prodDeps.has(fullName)) {
+						queue.push(d.locator);
+					}
+				}
+			}
+		}
 
+		// BFS to find all transitively reachable packages
+		while (queue.length > 0) {
+			const locator = queue.shift();
+			if (reachable.has(locator)) {continue;}
+			reachable.add(locator);
+
+			const node = nodeIndex.get(this.#nodeValueFromLocator(locator));
+			if (node?.children?.Dependencies) {
+				for (const d of node.children.Dependencies) {
+					if (!reachable.has(d.locator)) {
+						queue.push(d.locator);
+					}
+				}
+			}
+		}
+
+		// Only emit edges for root and reachable nodes
 		depTree.forEach(n => {
 			const depName = n.value;
 			const isRoot = this.#isRoot(depName);
+			if (!isRoot && !this.#isReachableNode(depName, reachable)) {return;}
+
 			const from = isRoot ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
 			const deps = n.children?.Dependencies;
 			if(!deps) {return;}
 			deps.forEach(d => {
+				if (!reachable.has(d.locator)) {return;}
 				const to = this.#purlFromLocator(d.locator);
 				if(to) {
-					// For root node, only add production dependencies (exclude devDeps)
-					if (isRoot) {
-						const fullName = to.namespace ? `${to.namespace}/${to.name}` : to.name;
-						if (!prodDeps.has(fullName)) {
-							return;
-						}
-					}
 					sbom.addDependency(from, to);
 				}
 			});
 		})
 	}
 
+	/**
+	 * Converts a locator to the node value format used in yarn info output
+	 * @param {string} locator - e.g. "express@npm:4.17.1"
+	 * @returns {string} The node value, same as locator for non-virtual
+	 * @private
+	 */
+	#nodeValueFromLocator(locator) {
+		// Virtual locators: "@scope/name@virtual:hash#npm:version" → "@scope/name@npm:version"
+		const virtualMatch = Yarn_berry_processor.VIRTUAL_LOCATOR_PATTERN.exec(locator);
+		if (virtualMatch) {
+			return `${virtualMatch[1]}@npm:${virtualMatch[2]}`;
+		}
+		return locator;
+	}
+
+	/**
+	 * Checks if a node is in the reachable set by matching its value against reachable locators
+	 * @param {string} depName - The node value (e.g. "express@npm:4.17.1")
+	 * @param {Set<string>} reachable - Set of reachable locators
+	 * @returns {boolean}
+	 * @private
+	 */
+	#isReachableNode(depName, reachable) {
+		if (reachable.has(depName)) {return true;}
+		// Check if any reachable locator resolves to this node value
+		for (const locator of reachable) {
+			if (this.#nodeValueFromLocator(locator) === depName) {return true;}
+		}
+		return false;
+	}
+
 	/**
    * Creates a PackageURL from a dependency locator
    * @param {string} locator - The dependency locator

src/sbom.js

@@ -86,6 +86,16 @@ export default class Sbom {
 		return this.sbomModel.checkIfPackageInsideDependsOnList(component, name)
 	}
 
+	/**
+	 * Checks if any entry in the dependsOn list of sourceRef starts with the given purl prefix.
+	 * @param {PackageURL} sourceRef - The source component to check
+	 * @param {string} purlPrefix - The purl prefix to match (e.g. "pkg:npm/minimist@")
+	 * @return {boolean}
+	 */
+	checkDependsOnByPurlPrefix(sourceRef, purlPrefix) {
+		return this.sbomModel.checkDependsOnByPurlPrefix(sourceRef, purlPrefix)
+	}
+
 	/** Removes the root component from the sbom
 	 */
 	removeRootComponent() {