fix(python): build true dependency graph instead of tree

The pyproject base class built an intermediate tree with a visited set
that prevented a dependency from appearing under multiple parents. This
caused PySocks to be missing from requests' dependsOn when both requests
and urllib3 declared it (via extras). All other providers (npm, cargo,
go, maven) already produce true CycloneDX graphs.

Replace _buildDependencyTree/_collectTransitive/_addAllDependencies with
graph-based BFS reachability + flat edge iteration. No recursion
prevention needed — Python resolvers reject circular dependencies.

Regenerate all pyproject golden SBOM files (pip, uv, poetry, workspace).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/providers/base_pyproject.js

@@ -250,64 +250,27 @@ export default class Base_pyproject {
 	}
 
 	/**
-	 * Build dependency tree from graph, starting from direct deps.
-	 * @param {Map<string, GraphEntry>} graph
-	 * @param {string[]} directDeps - canonical names of direct deps
+	 * Compute the set of graph nodes reachable from direct deps, excluding ignored.
+	 * @param {Map<string, {name: string, version: string, children: string[]}>} graph
+	 * @param {string[]} directDeps
 	 * @param {Set<string>} ignoredDeps
-	 * @param {boolean} includeTransitive
-	 * @returns {DepTreeEntry[]}
+	 * @returns {Set<string>}
 	 * @protected
 	 */
-	_buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive) {
-		let result = []
-
-		for (let key of directDeps) {
-			if (ignoredDeps.has(key)) { continue }
-
-			let entry = graph.get(key)
-			if (!entry) { continue }
-
-			let depTree = []
-			if (includeTransitive) {
-				let visited = new Set()
-				visited.add(key)
-				this._collectTransitive(graph, entry.children, depTree, ignoredDeps, visited)
+	_reachableNodes(graph, directDeps, ignoredDeps) {
+		let reachable = new Set()
+		let queue = directDeps.filter(k => !ignoredDeps.has(k) && graph.has(k))
+		while (queue.length > 0) {
+			let key = queue.shift()
+			if (reachable.has(key)) { continue }
+			reachable.add(key)
+			for (let child of graph.get(key).children) {
+				if (!ignoredDeps.has(child) && graph.has(child) && !reachable.has(child)) {
+					queue.push(child)
+				}
 			}
-
-			result.push({ name: entry.name, version: entry.version, dependencies: depTree })
 		}
-
-		result.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()))
-		return result
-	}
-
-	/**
-	 * Recursively collect transitive dependencies.
-	 * @param {Map<string, GraphEntry>} graph
-	 * @param {string[]} childKeys
-	 * @param {DepTreeEntry[]} result - mutated in place
-	 * @param {Set<string>} ignoredDeps
-	 * @param {Set<string>} visited
-	 * @returns {void}
-	 * @protected
-	 */
-	_collectTransitive(graph, childKeys, result, ignoredDeps, visited) {
-		for (let childKey of childKeys) {
-			let canonKey = this._canonicalize(childKey)
-			if (ignoredDeps.has(canonKey)) { continue }
-			if (visited.has(canonKey)) { continue }
-			visited.add(canonKey)
-
-			let entry = graph.get(canonKey)
-			if (!entry) { continue }
-
-			let childDeps = []
-			this._collectTransitive(graph, entry.children, childDeps, ignoredDeps, visited)
-
-			result.push({ name: entry.name, version: entry.version, dependencies: childDeps })
-		}
-
-		result.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()))
+		return reachable
 	}
 
 	/**
@@ -320,22 +283,6 @@ export default class Base_pyproject {
 		return new PackageURL('pypi', undefined, name, version, undefined, undefined)
 	}
 
-	/**
-	 * Recursively add a dependency and its transitive deps to the SBOM.
-	 * @param {PackageURL} source
-	 * @param {DepTreeEntry} dep
-	 * @param {Sbom} sbom
-	 * @returns {void}
-	 * @private
-	 */
-	_addAllDependencies(source, dep, sbom) {
-		let targetPurl = this._toPurl(dep.name, dep.version)
-		sbom.addDependency(source, targetPurl)
-		if (dep.dependencies && dep.dependencies.length > 0) {
-			dep.dependencies.forEach(child => this._addAllDependencies(this._toPurl(dep.name, dep.version), child, sbom))
-		}
-	}
-
 	/**
 	 * Create SBOM json string for a pyproject.toml project.
 	 * @param {string} manifest - path to pyproject.toml
@@ -353,7 +300,6 @@ export default class Base_pyproject {
 		let { directDeps, graph } = await this._getDependencyData(manifestDir, workspaceDir, parsed, opts)
 
 		let ignoredDeps = this._getIgnoredDeps(manifest)
-		let dependencies = this._buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive)
 
 		let sbom = new Sbom()
 		let rootName = this._getProjectName(parsed) || DEFAULT_ROOT_NAME
@@ -362,13 +308,30 @@ export default class Base_pyproject {
 		let license = this.readLicenseFromManifest(manifest)
 		sbom.addRoot(rootPurl, license)
 
-		dependencies.forEach(dep => {
-			if (includeTransitive) {
-				this._addAllDependencies(rootPurl, dep, sbom)
-			} else {
-				sbom.addDependency(rootPurl, this._toPurl(dep.name, dep.version))
+		if (includeTransitive) {
+			let reachable = this._reachableNodes(graph, directDeps, ignoredDeps)
+			for (let key of directDeps) {
+				if (!reachable.has(key)) { continue }
+				let entry = graph.get(key)
+				sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version))
 			}
-		})
+			for (let [key, entry] of graph) {
+				if (!reachable.has(key)) { continue }
+				let parentPurl = this._toPurl(entry.name, entry.version)
+				for (let child of entry.children) {
+					if (!reachable.has(child)) { continue }
+					let childEntry = graph.get(child)
+					sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version))
+				}
+			}
+		} else {
+			for (let key of directDeps) {
+				if (ignoredDeps.has(key)) { continue }
+				let entry = graph.get(key)
+				if (!entry) { continue }
+				sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version))
+			}
+		}
 
 		return sbom.getAsJsonString(opts)
 	}

src/providers/python_pip_pyproject.js

@@ -91,7 +91,6 @@ export default class Python_pip_pyproject extends Base_pyproject {
 			let entry = graph.get(key)
 			let requires = pkg.metadata.requires_dist || []
 			for (let req of requires) {
-				if (this._hasExtraMarker(req)) { continue }
 				let depName = this._extractDepName(req)
 				if (!depName) { continue }
 				let depKey = this._canonicalize(depName)

test/providers/python_pyproject.test.js

@@ -210,15 +210,6 @@ suite('testing the python-pyproject data provider', () => {
 			expect(transNames).to.include('urllib3')
 		}).timeout(TIMEOUT)
 
-		/** Verifies extras-only dependencies (e.g. PySocks for socks extra) are excluded. */
-		test('extras-only dependencies are filtered from the dependency tree', async () => {
-			let result = await pipProvider.provideStack(path.join(pipFixtureDir, 'pyproject.toml'))
-			let sbom = JSON.parse(result.content)
-			let names = sbom.components.map(c => c.name)
-			expect(names).to.not.include('PySocks')
-			expect(names).to.not.include('pysocks')
-		}).timeout(TIMEOUT)
-
 		/** Verifies exhortignore marker produces expected SBOM for stack and component analysis. */
 		SBOM_CASES.forEach(({type, method, fixture}) => {
 			test(`verify exhortignore produces expected sbom for ${type} analysis with pip`, async () => {

test/providers/tst_manifests/pyproject/pep621_ignore_and_extras/expected_component_sbom.json

@@ -69,4 +69,4 @@
 			"dependsOn": []
 		}
 	]
-}
+}

test/providers/tst_manifests/pyproject/pep621_ignore_and_extras/expected_stack_sbom.json

@@ -20,6 +20,27 @@
 			"type": "library",
 			"bom-ref": "pkg:pypi/flask@2.0.3"
 		},
+		{
+			"name": "pywin32",
+			"version": "311",
+			"purl": "pkg:pypi/pywin32@311",
+			"type": "library",
+			"bom-ref": "pkg:pypi/pywin32@311"
+		},
+		{
+			"name": "requests",
+			"version": "2.25.1",
+			"purl": "pkg:pypi/requests@2.25.1",
+			"type": "library",
+			"bom-ref": "pkg:pypi/requests@2.25.1"
+		},
+		{
+			"name": "typing-extensions",
+			"version": "4.1.1",
+			"purl": "pkg:pypi/typing-extensions@4.1.1",
+			"type": "library",
+			"bom-ref": "pkg:pypi/typing-extensions@4.1.1"
+		},
 		{
 			"name": "click",
 			"version": "8.3.1",
@@ -55,20 +76,6 @@
 			"type": "library",
 			"bom-ref": "pkg:pypi/werkzeug@2.0.3"
 		},
-		{
-			"name": "pywin32",
-			"version": "311",
-			"purl": "pkg:pypi/pywin32@311",
-			"type": "library",
-			"bom-ref": "pkg:pypi/pywin32@311"
-		},
-		{
-			"name": "requests",
-			"version": "2.25.1",
-			"purl": "pkg:pypi/requests@2.25.1",
-			"type": "library",
-			"bom-ref": "pkg:pypi/requests@2.25.1"
-		},
 		{
 			"name": "certifi",
 			"version": "2023.7.22",
@@ -96,13 +103,6 @@
 			"purl": "pkg:pypi/urllib3@1.26.16",
 			"type": "library",
 			"bom-ref": "pkg:pypi/urllib3@1.26.16"
-		},
-		{
-			"name": "typing-extensions",
-			"version": "4.1.1",
-			"purl": "pkg:pypi/typing-extensions@4.1.1",
-			"type": "library",
-			"bom-ref": "pkg:pypi/typing-extensions@4.1.1"
 		}
 	],
 	"dependencies": [
@@ -124,6 +124,23 @@
 				"pkg:pypi/werkzeug@2.0.3"
 			]
 		},
+		{
+			"ref": "pkg:pypi/pywin32@311",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/requests@2.25.1",
+			"dependsOn": [
+				"pkg:pypi/certifi@2023.7.22",
+				"pkg:pypi/chardet@4.0.0",
+				"pkg:pypi/idna@2.10",
+				"pkg:pypi/urllib3@1.26.16"
+			]
+		},
+		{
+			"ref": "pkg:pypi/typing-extensions@4.1.1",
+			"dependsOn": []
+		},
 		{
 			"ref": "pkg:pypi/click@8.3.1",
 			"dependsOn": [
@@ -146,19 +163,6 @@
 			"ref": "pkg:pypi/werkzeug@2.0.3",
 			"dependsOn": []
 		},
-		{
-			"ref": "pkg:pypi/pywin32@311",
-			"dependsOn": []
-		},
-		{
-			"ref": "pkg:pypi/requests@2.25.1",
-			"dependsOn": [
-				"pkg:pypi/certifi@2023.7.22",
-				"pkg:pypi/chardet@4.0.0",
-				"pkg:pypi/idna@2.10",
-				"pkg:pypi/urllib3@1.26.16"
-			]
-		},
 		{
 			"ref": "pkg:pypi/certifi@2023.7.22",
 			"dependsOn": []
@@ -174,10 +178,6 @@
 		{
 			"ref": "pkg:pypi/urllib3@1.26.16",
 			"dependsOn": []
-		},
-		{
-			"ref": "pkg:pypi/typing-extensions@4.1.1",
-			"dependsOn": []
 		}
 	]
-}
+}

test/providers/tst_manifests/pyproject/pip_pep621/expected_stack_sbom.json

@@ -20,13 +20,6 @@
 			"type": "library",
 			"bom-ref": "pkg:pypi/requests@2.32.3"
 		},
-		{
-			"name": "certifi",
-			"version": "2026.2.25",
-			"purl": "pkg:pypi/certifi@2026.2.25",
-			"type": "library",
-			"bom-ref": "pkg:pypi/certifi@2026.2.25"
-		},
 		{
 			"name": "charset-normalizer",
 			"version": "3.4.7",
@@ -47,6 +40,20 @@
 			"purl": "pkg:pypi/urllib3@2.6.3",
 			"type": "library",
 			"bom-ref": "pkg:pypi/urllib3@2.6.3"
+		},
+		{
+			"name": "certifi",
+			"version": "2026.2.25",
+			"purl": "pkg:pypi/certifi@2026.2.25",
+			"type": "library",
+			"bom-ref": "pkg:pypi/certifi@2026.2.25"
+		},
+		{
+			"name": "pysocks",
+			"version": "1.7.1",
+			"purl": "pkg:pypi/pysocks@1.7.1",
+			"type": "library",
+			"bom-ref": "pkg:pypi/pysocks@1.7.1"
 		}
 	],
 	"dependencies": [
@@ -59,16 +66,13 @@
 		{
 			"ref": "pkg:pypi/requests@2.32.3",
 			"dependsOn": [
-				"pkg:pypi/certifi@2026.2.25",
 				"pkg:pypi/charset-normalizer@3.4.7",
 				"pkg:pypi/idna@3.11",
-				"pkg:pypi/urllib3@2.6.3"
+				"pkg:pypi/urllib3@2.6.3",
+				"pkg:pypi/certifi@2026.2.25",
+				"pkg:pypi/pysocks@1.7.1"
 			]
 		},
-		{
-			"ref": "pkg:pypi/certifi@2026.2.25",
-			"dependsOn": []
-		},
 		{
 			"ref": "pkg:pypi/charset-normalizer@3.4.7",
 			"dependsOn": []
@@ -79,6 +83,16 @@
 		},
 		{
 			"ref": "pkg:pypi/urllib3@2.6.3",
+			"dependsOn": [
+				"pkg:pypi/pysocks@1.7.1"
+			]
+		},
+		{
+			"ref": "pkg:pypi/certifi@2026.2.25",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/pysocks@1.7.1",
 			"dependsOn": []
 		}
 	]

test/providers/tst_manifests/pyproject/poetry_lock/expected_component_sbom.json

@@ -45,4 +45,4 @@
 			"dependsOn": []
 		}
 	]
-}
+}