Dart: Syft incorrectly generates SBOM with version 0.0.0 for SDK dependencies about syft HOT 2 OPEN

Thanks for the report @joaquinricci, do all of these have source: sdk?

from syft.

Hey @kzantow , thanks for the ⚡ reply.

Thanks for the report @joaquinricci, do all of these have source: sdk?

I believe the answer is yes, I couldn't find the pubspec.lock documentation, but according to this dart documentation about sdks, aside from dart itself, flutter is currently the only other sdk.

Now, if you check this example, you can see that both flutter_web_plugins and flutter_test have the source parameter since those packages depend on the flutter SDK

  flutter_test:
    dependency: "direct dev"
    description: flutter
    source: sdk
    version: "0.0.0"
  flutter_time_picker_spinner:
    dependency: "direct main"
    description:
      name: flutter_time_picker_spinner
      url: "https://pub.dartlang.org"
    source: hosted
    version: "2.0.0"
  flutter_web_plugins:
    dependency: transitive
    description: flutter
    source: sdk
    version: "0.0.0"

EDIT

And yes, all of those examples are captured as version 0.0.0 in the syft output.

from syft.