diff --git a/CHANGELOG.md b/CHANGELOG.md index 015c02dc3..9b717026d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,13 +20,13 @@ All notable changes to this project will be documented in this file. ### Changed - opensearch-dashboards: Bump cdxgen to 13.0.1 and pin the CycloneDX spec version to 1.6 ([#1600]). -- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1638]). +- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1639]). ### Fixed - spark: Propagate the entrypoint's exit code so failed applications are no longer reported as successful ([#1595]). - superset: Fix the broken builds by excluding the `cypress-base` end-to-end test project from the frontend SBOM ([#1616]). -- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1620]). +- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1621]). - superset: Install nvm into `/opt/nvm` so that Node and npm, which are only needed to build the frontend, are no longer shipped in the final image (about 161 MB) ([#1623]). - vector: Generate the SBOM with the same feature set the binary is built with, so that the integrations that are not compiled in are no longer reported ([#1630]). - base images: Exclude the build-time dependencies from the Rust SBOMs ([#1630]). @@ -51,11 +51,15 @@ All notable changes to this project will be documented in this file. - hbase: Exclude the optional npm dependencies from the web UI SBOM ([#1630]). - airflow, superset: Create the Python SBOM from a separate environment, so that neither cyclonedx-bom nor its dependencies end up in the SBOM and in the image ([#1630]). - airflow, superset: Add the missing purl to the Airflow and Superset packages in the Python SBOM. They are installed from a locally built wheel, and without a purl they show up twice in the image SBOM ([#1630]). -- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1638]). +- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1639]). - opa, statsd-exporter: Report the Go dependencies at module level instead of package and file - level ([#1638]). + level ([#1639]). - opensearch-dashboards: Generate the SBOM from the built distribution instead of the source - worktree, so dev dependencies are excluded ([#1641]). + worktree, so dev dependencies are excluded ([#1663]). +- opensearch-dashboards: Only read the package.json of installed packages when generating the SBOM. + The subpath stubs, test fixtures, benchmarks and examples that packages ship below their own + directory were reported as components that do not exist on npmjs, most of them without a version + ([#1670]). - hive: Build against the Hive modules built alongside each other (in the same reactor) rather than the ones published on Maven Central, for `4.2.0`. Upstream fixed one instance of this for Hive 4.3.0 in [HIVE-29827](https://issues.apache.org/jira/browse/HIVE-29827) but there are others. ([#1636]). @@ -74,16 +78,18 @@ All notable changes to this project will be documented in this file. [#1611]: https://github.com/stackabletech/docker-images/pull/1611 [#1616]: https://github.com/stackabletech/docker-images/pull/1616 [#1620]: https://github.com/stackabletech/docker-images/pull/1620 +[#1621]: https://github.com/stackabletech/docker-images/pull/1621 [#1623]: https://github.com/stackabletech/docker-images/pull/1623 [#1630]: https://github.com/stackabletech/docker-images/pull/1630 [#1635]: https://github.com/stackabletech/docker-images/pull/1635 [#1636]: https://github.com/stackabletech/docker-images/pull/1636 [#1637]: https://github.com/stackabletech/docker-images/pull/1637 -[#1638]: https://github.com/stackabletech/docker-images/pull/1638 +[#1639]: https://github.com/stackabletech/docker-images/pull/1639 [#1659]: https://github.com/stackabletech/docker-images/pull/1659 -[#1641]: https://github.com/stackabletech/docker-images/pull/1641 +[#1663]: https://github.com/stackabletech/docker-images/pull/1663 [#1662]: https://github.com/stackabletech/docker-images/pull/1662 [#1664]: https://github.com/stackabletech/docker-images/pull/1664 +[#1670]: https://github.com/stackabletech/docker-images/pull/1670 ## [26.7.0] - 2026-07-21 diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile index 7ee633303..d9e3da51f 100644 --- a/opensearch-dashboards/Dockerfile +++ b/opensearch-dashboards/Dockerfile @@ -211,6 +211,12 @@ EOF # every component, because an installed package.json records one while a Yarn 1 # lockfile does not. # +# --include-regex restricts the walk to the package.json of an installed package, +# which is always the direct child of a node_modules directory or of a scope +# directory below it. cdxgen otherwise reads every package.json below +# node_modules which includes test fixtures and benchmarks, we don't want these +# in the SBOM. +# # --spec-version is passed explicitly because cdxgen changes its default between # releases. The value is a global build argument, see boil.toml. # --type js restricts cdxgen to the JavaScript ecosystem. Without it, cdxgen @@ -224,6 +230,7 @@ EOF RUN PATH="/opt/node-cdxgen/bin:$PATH" cdxgen --type js --no-babel --json-pretty \ --spec-version "${CDXGEN_SPEC_VERSION}" \ --exclude '**/yarn.lock' --exclude '**/package-lock.json' \ + --include-regex '**/node_modules/{*,@*/*}/package.json' \ -o /stackable/bom.json \ /stackable/opensearch-dashboards