Remove duplicates when resolving Gradle dependencies from Node (#1566)

Signed-off-by: Roland Asmann <[email protected]>
CycloneDX · Jan 15, 2025 · 305ac50 · 305ac50
1 parent 1b1d5b0
commit 305ac50
Showing 1 changed file with 17 additions and 4 deletions.
diff --git a/lib/cli/index.js b/lib/cli/index.js
@@ -6083,11 +6083,24 @@ export async function createMultiXBom(pathList, options) {
         ) {
           parentSubComponents.push(bomData.parentComponent);
         }
-        // Retain metadata.component.components
+        // Retain metadata.component.components, but add duplicates to the list of current components
+        // and removing them from metadata.component.components -- the components are merged later
         if (bomData.parentComponent.components?.length) {
-          parentSubComponents = parentSubComponents.concat(
-            bomData.parentComponent.components,
-          );
+          let bomSubComponents = bomData.parentComponent.components;
+          if (["true", "1"].includes(process.env.GRADLE_RESOLVE_FROM_NODE)) {
+            const allRefs = components.map((c) => c["bom-ref"]);
+            const duplicateComponents = bomSubComponents.filter((c) =>
+              allRefs.includes(c["bom-ref"]),
+            );
+            components = components.concat(duplicateComponents);
+            const duplicateComponentRefs = duplicateComponents.map(
+              (c) => c["bom-ref"],
+            );
+            bomSubComponents = bomSubComponents.filter(
+              (c) => !duplicateComponentRefs.includes(c["bom-ref"]),
+            );
+          }
+          parentSubComponents = parentSubComponents.concat(bomSubComponents);
           delete bomData.parentComponent.components;
         }
       }