From fb11ae8f4a848d94e5c40460e91047aeb48fd292 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Tue, 22 Sep 2026 11:12:42 +0000 Subject: [PATCH 1/2] fix(opensearch-dashboards): Only read installed packages for the SBOM --- CHANGELOG.md | 5 +++++ opensearch-dashboards/Dockerfile | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 015c02dc3..c5ed7b410 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,6 +56,10 @@ All notable changes to this project will be documented in this file. level ([#1638]). - opensearch-dashboards: Generate the SBOM from the built distribution instead of the source worktree, so dev dependencies are excluded ([#1641]). +- opensearch-dashboards: Only read the package.json of installed packages when generating the SBOM. + The subpath stubs, test fixtures, benchmarks and examples that packages ship below their own + directory were reported as components that do not exist on npmjs, most of them without a version + ([#1670]). - hive: Build against the Hive modules built alongside each other (in the same reactor) rather than the ones published on Maven Central, for `4.2.0`. Upstream fixed one instance of this for Hive 4.3.0 in [HIVE-29827](https://issues.apache.org/jira/browse/HIVE-29827) but there are others. ([#1636]). @@ -84,6 +88,7 @@ All notable changes to this project will be documented in this file. [#1641]: https://github.com/stackabletech/docker-images/pull/1641 [#1662]: https://github.com/stackabletech/docker-images/pull/1662 [#1664]: https://github.com/stackabletech/docker-images/pull/1664 +[#1670]: https://github.com/stackabletech/docker-images/pull/1670 ## [26.7.0] - 2026-07-21 diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile index 7ee633303..d9e3da51f 100644 --- a/opensearch-dashboards/Dockerfile +++ b/opensearch-dashboards/Dockerfile @@ -211,6 +211,12 @@ EOF # every component, because an installed package.json records one while a Yarn 1 # lockfile does not. # +# --include-regex restricts the walk to the package.json of an installed package, +# which is always the direct child of a node_modules directory or of a scope +# directory below it. cdxgen otherwise reads every package.json below +# node_modules which includes test fixtures and benchmarks, we don't want these +# in the SBOM. +# # --spec-version is passed explicitly because cdxgen changes its default between # releases. The value is a global build argument, see boil.toml. # --type js restricts cdxgen to the JavaScript ecosystem. Without it, cdxgen @@ -224,6 +230,7 @@ EOF RUN PATH="/opt/node-cdxgen/bin:$PATH" cdxgen --type js --no-babel --json-pretty \ --spec-version "${CDXGEN_SPEC_VERSION}" \ --exclude '**/yarn.lock' --exclude '**/package-lock.json' \ + --include-regex '**/node_modules/{*,@*/*}/package.json' \ -o /stackable/bom.json \ /stackable/opensearch-dashboards From 51d006998f44a02af7bf2b1f6390332c524ff81a Mon Sep 17 00:00:00 2001 From: dervoeti Date: Tue, 22 Sep 2026 11:45:28 +0000 Subject: [PATCH 2/2] chore: Fix the wrong PR references in the changelog --- CHANGELOG.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5ed7b410..9b717026d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,13 +20,13 @@ All notable changes to this project will be documented in this file. ### Changed - opensearch-dashboards: Bump cdxgen to 13.0.1 and pin the CycloneDX spec version to 1.6 ([#1600]). -- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1638]). +- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1639]). ### Fixed - spark: Propagate the entrypoint's exit code so failed applications are no longer reported as successful ([#1595]). - superset: Fix the broken builds by excluding the `cypress-base` end-to-end test project from the frontend SBOM ([#1616]). -- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1620]). +- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1621]). - superset: Install nvm into `/opt/nvm` so that Node and npm, which are only needed to build the frontend, are no longer shipped in the final image (about 161 MB) ([#1623]). - vector: Generate the SBOM with the same feature set the binary is built with, so that the integrations that are not compiled in are no longer reported ([#1630]). - base images: Exclude the build-time dependencies from the Rust SBOMs ([#1630]). @@ -51,11 +51,11 @@ All notable changes to this project will be documented in this file. - hbase: Exclude the optional npm dependencies from the web UI SBOM ([#1630]). - airflow, superset: Create the Python SBOM from a separate environment, so that neither cyclonedx-bom nor its dependencies end up in the SBOM and in the image ([#1630]). - airflow, superset: Add the missing purl to the Airflow and Superset packages in the Python SBOM. They are installed from a locally built wheel, and without a purl they show up twice in the image SBOM ([#1630]). -- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1638]). +- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1639]). - opa, statsd-exporter: Report the Go dependencies at module level instead of package and file - level ([#1638]). + level ([#1639]). - opensearch-dashboards: Generate the SBOM from the built distribution instead of the source - worktree, so dev dependencies are excluded ([#1641]). + worktree, so dev dependencies are excluded ([#1663]). - opensearch-dashboards: Only read the package.json of installed packages when generating the SBOM. The subpath stubs, test fixtures, benchmarks and examples that packages ship below their own directory were reported as components that do not exist on npmjs, most of them without a version @@ -78,14 +78,15 @@ All notable changes to this project will be documented in this file. [#1611]: https://github.com/stackabletech/docker-images/pull/1611 [#1616]: https://github.com/stackabletech/docker-images/pull/1616 [#1620]: https://github.com/stackabletech/docker-images/pull/1620 +[#1621]: https://github.com/stackabletech/docker-images/pull/1621 [#1623]: https://github.com/stackabletech/docker-images/pull/1623 [#1630]: https://github.com/stackabletech/docker-images/pull/1630 [#1635]: https://github.com/stackabletech/docker-images/pull/1635 [#1636]: https://github.com/stackabletech/docker-images/pull/1636 [#1637]: https://github.com/stackabletech/docker-images/pull/1637 -[#1638]: https://github.com/stackabletech/docker-images/pull/1638 +[#1639]: https://github.com/stackabletech/docker-images/pull/1639 [#1659]: https://github.com/stackabletech/docker-images/pull/1659 -[#1641]: https://github.com/stackabletech/docker-images/pull/1641 +[#1663]: https://github.com/stackabletech/docker-images/pull/1663 [#1662]: https://github.com/stackabletech/docker-images/pull/1662 [#1664]: https://github.com/stackabletech/docker-images/pull/1664 [#1670]: https://github.com/stackabletech/docker-images/pull/1670