fix(opensearch-dashboards): SBOM: Only read the package.json of installed packages

CHANGELOG.md

@@ -20,13 +20,13 @@ All notable changes to this project will be documented in this file.
 ### Changed
 
 - opensearch-dashboards: Bump cdxgen to 13.0.1 and pin the CycloneDX spec version to 1.6 ([#1600]).
-- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1638]).
+- opa, statsd-exporter: Bump cyclonedx-gomod to 1.12.0 ([#1639]).
 
 ### Fixed
 
 - spark: Propagate the entrypoint's exit code so failed applications are no longer reported as successful ([#1595]).
 - superset: Fix the broken builds by excluding the `cypress-base` end-to-end test project from the frontend SBOM ([#1616]).
-- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1620]).
+- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1621]).
 - superset: Install nvm into `/opt/nvm` so that Node and npm, which are only needed to build the frontend, are no longer shipped in the final image (about 161 MB) ([#1623]).
 - vector: Generate the SBOM with the same feature set the binary is built with, so that the integrations that are not compiled in are no longer reported ([#1630]).
 - base images: Exclude the build-time dependencies from the Rust SBOMs ([#1630]).
@@ -51,11 +51,15 @@ All notable changes to this project will be documented in this file.
 - hbase: Exclude the optional npm dependencies from the web UI SBOM ([#1630]).
 - airflow, superset: Create the Python SBOM from a separate environment, so that neither cyclonedx-bom nor its dependencies end up in the SBOM and in the image ([#1630]).
 - airflow, superset: Add the missing purl to the Airflow and Superset packages in the Python SBOM. They are installed from a locally built wheel, and without a purl they show up twice in the image SBOM ([#1630]).
-- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1638]).
+- opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1639]).
 - opa, statsd-exporter: Report the Go dependencies at module level instead of package and file
-  level ([#1638]).
+  level ([#1639]).
 - opensearch-dashboards: Generate the SBOM from the built distribution instead of the source
-  worktree, so dev dependencies are excluded ([#1641]).
+  worktree, so dev dependencies are excluded ([#1663]).
+- opensearch-dashboards: Only read the package.json of installed packages when generating the SBOM.
+  The subpath stubs, test fixtures, benchmarks and examples that packages ship below their own
+  directory were reported as components that do not exist on npmjs, most of them without a version
+  ([#1670]).
 - hive: Build against the Hive modules built alongside each other (in the same reactor) rather than the ones published on Maven Central, for `4.2.0`.
   Upstream fixed one instance of this for Hive 4.3.0 in [HIVE-29827](https://issues.apache.org/jira/browse/HIVE-29827) but there are others. ([#1636]).
 
@@ -74,16 +78,18 @@ All notable changes to this project will be documented in this file.
 [#1611]: https://github.com/stackabletech/docker-images/pull/1611
 [#1616]: https://github.com/stackabletech/docker-images/pull/1616
 [#1620]: https://github.com/stackabletech/docker-images/pull/1620
+[#1621]: https://github.com/stackabletech/docker-images/pull/1621
 [#1623]: https://github.com/stackabletech/docker-images/pull/1623
 [#1630]: https://github.com/stackabletech/docker-images/pull/1630
 [#1635]: https://github.com/stackabletech/docker-images/pull/1635
 [#1636]: https://github.com/stackabletech/docker-images/pull/1636
 [#1637]: https://github.com/stackabletech/docker-images/pull/1637
-[#1638]: https://github.com/stackabletech/docker-images/pull/1638
+[#1639]: https://github.com/stackabletech/docker-images/pull/1639
 [#1659]: https://github.com/stackabletech/docker-images/pull/1659
-[#1641]: https://github.com/stackabletech/docker-images/pull/1641
+[#1663]: https://github.com/stackabletech/docker-images/pull/1663
 [#1662]: https://github.com/stackabletech/docker-images/pull/1662
 [#1664]: https://github.com/stackabletech/docker-images/pull/1664
+[#1670]: https://github.com/stackabletech/docker-images/pull/1670
 
 ## [26.7.0] - 2026-07-21
 

opensearch-dashboards/Dockerfile

@@ -211,6 +211,12 @@ EOF
 # every component, because an installed package.json records one while a Yarn 1
 # lockfile does not.
 #
+# --include-regex restricts the walk to the package.json of an installed package,
+# which is always the direct child of a node_modules directory or of a scope
+# directory below it. cdxgen otherwise reads every package.json below
+# node_modules which includes test fixtures and benchmarks, we don't want these
+# in the SBOM.
+#
 # --spec-version is passed explicitly because cdxgen changes its default between
 # releases. The value is a global build argument, see boil.toml.
 # --type js restricts cdxgen to the JavaScript ecosystem. Without it, cdxgen
@@ -224,6 +230,7 @@ EOF
 RUN PATH="/opt/node-cdxgen/bin:$PATH" cdxgen --type js --no-babel --json-pretty \
     --spec-version "${CDXGEN_SPEC_VERSION}" \
     --exclude '**/yarn.lock' --exclude '**/package-lock.json' \
+    --include-regex '**/node_modules/{*,@*/*}/package.json' \
     -o /stackable/bom.json \
     /stackable/opensearch-dashboards