cdxgen fails to look at all dependencies for python project

[Kasyap-R]

It seems like cdxgen stops looking for dependencies after reading the "requirements-dev.txt" file. This is an issue as some packages have a requirements-dev.txt file but not a requirements.txt file. In that case, cdxgen should check the setup.py file to look for runtime dependencies.

[prabhu]

Thank you for your support and patience. Please retest with version 8.6.0

[LeontyV]

I am check python repository with 2 files requirements.txt. Dependencies in result file is not all. Problem not resolve.
cdxgen version 8.6.0

requirements.txt
requirements.txt
bom.txt

[prabhu]

@LeontyV Are you referring to the dependency tree under "dependencies." That is currently only supported for a handful of languages. With 8.6.0 the focus was on the "components" section to list all dependencies reliably.

https://github.com/CycloneDX/cdxgen#dependency-tree

[prabhu]

@LeontyV Adding some informational messages to troubleshoot issues like the one in your requirements.

The version or the version specifiers used for the dependency is invalid. Resolve the below error to improve SBoM accuracy.
ERROR: Could not find a version that satisfies the requirement asyncio==3.9 (from versions: 0.1.1, 0.2.1, 0.3.1, 0.4.1, 3.4.1, 3.4.2, 3.4.3)
ERROR: No matching distribution found for asyncio==3.9

ERROR: Could not find a version that satisfies the requirement requests==2.2.7 (from versions: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.6, 0.10.7, 0.10.8, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.13.6, 0.13.7, 0.13.8, 0.13.9, 0.14.0, 0.14.1, 0.14.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 2.10.0, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.12.5, 2.13.0, 2.14.0, 2.14.1, 2.14.2, 2.15.1, 2.16.0, 2.16.1, 2.16.2, 2.16.3, 2.16.4, 2.16.5, 2.17.0, 2.17.1, 2.17.2, 2.17.3, 2.18.0, 2.18.1, 2.18.2, 2.18.3, 2.18.4, 2.19.0, 2.19.1, 2.20.0, 2.20.1, 2.21.0, 2.22.0, 2.23.0, 2.24.0, 2.25.0, 2.25.1, 2.26.0, 2.27.0, 2.27.1, 2.28.0, 2.28.1, 2.28.2, 2.29.0, 2.30.0, 2.31.0)
ERROR: No matching distribution found for requests==2.2.7