Expand optional tree

[prabhu]

When a direct optional dependency had more optional child dependencies, cdxgen was simplifying the tree and grouping all of the optional ones together. With this PR, the optional trees are retained correctly.

Attached is the sbom for NodeGoat. check the tree for request and zaproxy.

bom-full.json

{
            "ref": "pkg:npm/request@2.36.0",
            "dependsOn": [
                "pkg:npm/aws-sign2@0.5.0",
                "pkg:npm/forever-agent@0.5.2",
                "pkg:npm/form-data@0.1.4",
                "pkg:npm/hawk@1.0.0",
                "pkg:npm/http-signature@0.10.1",
                "pkg:npm/json-stringify-safe@5.0.1",
                "pkg:npm/mime@1.2.11",
                "pkg:npm/node-uuid@1.4.8",
                "pkg:npm/oauth-sign@0.3.0",
                "pkg:npm/qs@0.6.6",
                "pkg:npm/tough-cookie@2.3.4",
                "pkg:npm/tunnel-agent@0.4.3"
            ]
        },
        {
            "ref": "pkg:npm/zaproxy@0.2.0",
            "dependsOn": [
                "pkg:npm/lodash@2.4.2",
                "pkg:npm/request@2.36.0"
            ]
        },

[prabhu]

Example sbom in deep mode for NodeGoat.

bom.json

[Bnaya]

Is available to use?

Thanks!

[prabhu]

Will release 11.0.9 and let you know.