feat!: always emit dev dependencies with scope=excluded; deprecate --exclude-dev

CycloneDX.E2ETests/Infrastructure/NuGetServerFixture.cs

@@ -110,6 +110,15 @@ await PushPackageAsync(NupkgBuilder.Build(
             // TestPkg.Dev 1.0.0 — intended to be used as a dev/build dependency
             await PushPackageAsync(NupkgBuilder.Build("TestPkg.Dev", "1.0.0")).ConfigureAwait(false);
 
+            // TestPkg.DevTransitive 1.0.0 — a package that is pulled in transitively by TestPkg.DevWithDep
+            await PushPackageAsync(NupkgBuilder.Build("TestPkg.DevTransitive", "1.0.0")).ConfigureAwait(false);
+
+            // TestPkg.DevWithDep 1.0.0 — dev/build dependency that itself has a transitive dep
+            await PushPackageAsync(NupkgBuilder.Build(
+                "TestPkg.DevWithDep", "1.0.0",
+                dependencies: new[] { new NupkgDependency("TestPkg.DevTransitive", "1.0.0") }
+            )).ConfigureAwait(false);
+
             // TestPkg.Transitive 1.0.0 — used only as a transitive dep
             await PushPackageAsync(NupkgBuilder.Build("TestPkg.Transitive", "1.0.0")).ConfigureAwait(false);
         }

CycloneDX.E2ETests/Tests/DevDependencyTests.cs

@@ -19,14 +19,12 @@
 using CycloneDX.E2ETests.Builders;
 using CycloneDX.E2ETests.Infrastructure;
 using Xunit;
-using static VerifyXunit.Verifier;
 
 namespace CycloneDX.E2ETests.Tests
 {
     /// <summary>
     /// Tests for dev/build-only dependencies (PrivateAssets="all").
-    /// Verifies that <c>--exclude-dev</c> omits packages that are exclusively
-    /// consumed at build time and not shipped with the application.
+    /// Dev dependencies are always included in the BOM with scope="excluded".
     /// </summary>
     [Collection("E2E")]
     public sealed class DevDependencyTests
@@ -39,9 +37,9 @@ public DevDependencyTests(E2EFixture fixture)
         }
 
         [Fact]
-        public async Task DevDependency_IncludedByDefault()
+        public async Task DevDependency_IncludedWithScopeExcluded()
         {
-            // Without --exclude-dev, dev dependencies SHOULD appear in the BOM
+            // Dev dependencies must appear in <components> with <scope>excluded</scope>
             using var solution = await new SolutionBuilder("DevDepDefaultSln")
                 .AddProject("MyApp", p => p
                     .WithTargetFramework("net8.0")
@@ -57,15 +55,19 @@ public async Task DevDependency_IncludedByDefault()
                 new ToolRunOptions { NuGetFeedUrl = _fixture.NuGetFeedUrl });
 
             Assert.True(result.Success, $"Tool failed:\n{result.StdErr}");
-            Assert.Contains("TestPkg.Dev", result.BomContent);
             Assert.Contains("TestPkg.A", result.BomContent);
+            Assert.Contains("TestPkg.Dev", result.BomContent);
+            // Dev dep must appear with scope=excluded
+            Assert.Contains("<scope>excluded</scope>", result.BomContent);
+            // No formulation — dev deps stay in components
+            Assert.DoesNotContain("<formulation>", result.BomContent);
         }
 
         [Fact]
-        public async Task DevDependency_ExcludedWithFlag()
+        public async Task DevDependency_ScopeExcluded_RuntimePackage_ScopeRequired()
         {
-            // With --exclude-dev, packages marked PrivateAssets="all" should be absent
-            using var solution = await new SolutionBuilder("DevDepExcludeSln")
+            // Runtime packages must be scope=required; dev deps scope=excluded
+            using var solution = await new SolutionBuilder("DevDepScopeSln")
                 .AddProject("MyApp", p => p
                     .WithTargetFramework("net8.0")
                     .AddPackage("TestPkg.A", "1.0.0")
@@ -77,26 +79,24 @@ public async Task DevDependency_ExcludedWithFlag()
             var result = await _fixture.Runner.RunAsync(
                 solution.SolutionFile,
                 outputDir.Path,
-                new ToolRunOptions
-                {
-                    NuGetFeedUrl = _fixture.NuGetFeedUrl,
-                    ExcludeDev = true
-                });
+                new ToolRunOptions { NuGetFeedUrl = _fixture.NuGetFeedUrl });
 
             Assert.True(result.Success, $"Tool failed:\n{result.StdErr}");
-            Assert.Contains("TestPkg.A", result.BomContent);
-            Assert.DoesNotContain("TestPkg.Dev", result.BomContent);
 
-            await Verify(result.BomContent);
+            // TestPkg.A (runtime) must appear before scope=required; TestPkg.Dev before scope=excluded.
+            // The simplest check: both scope values are present in the BOM.
+            Assert.Contains("<scope>required</scope>", result.BomContent);
+            Assert.Contains("<scope>excluded</scope>", result.BomContent);
         }
 
         [Fact]
-        public async Task OnlyDevDependencies_ExcludeDevProducesEmptyComponents()
+        public async Task ExcludeDevFlag_IsDeprecatedAndHasNoEffect()
         {
-            // A project with only dev deps + --exclude-dev → no components section (or empty)
-            using var solution = await new SolutionBuilder("OnlyDevDepSln")
+            // --exclude-dev is deprecated; passing it must not change the output
+            using var solution = await new SolutionBuilder("DevDepFlagSln")
                 .AddProject("MyApp", p => p
                     .WithTargetFramework("net8.0")
+                    .AddPackage("TestPkg.A", "1.0.0")
                     .AddPackage("TestPkg.Dev", "1.0.0", devDependency: true))
                 .BuildAsync(_fixture.NuGetFeedUrl);
 
@@ -112,7 +112,36 @@ public async Task OnlyDevDependencies_ExcludeDevProducesEmptyComponents()
                 });
 
             Assert.True(result.Success, $"Tool failed:\n{result.StdErr}");
-            Assert.DoesNotContain("TestPkg.Dev", result.BomContent);
+            // Dev dep must still be present with scope=excluded, not omitted
+            Assert.Contains("TestPkg.Dev", result.BomContent);
+            Assert.Contains("<scope>excluded</scope>", result.BomContent);
+            Assert.DoesNotContain("<formulation>", result.BomContent);
+        }
+
+        [Fact]
+        public async Task TransitiveOfDevDependency_IncludedInComponents()
+        {
+            // A transitive dependency pulled in only through a dev dep must also
+            // appear in <components> (the BFS exclusion logic has been removed).
+            using var solution = await new SolutionBuilder("TransitiveDevDepSln")
+                .AddProject("MyApp", p => p
+                    .WithTargetFramework("net8.0")
+                    .AddPackage("TestPkg.A", "1.0.0")
+                    .AddPackage("TestPkg.DevWithDep", "1.0.0", devDependency: true))
+                .BuildAsync(_fixture.NuGetFeedUrl);
+
+            using var outputDir = solution.CreateOutputDir();
+
+            var result = await _fixture.Runner.RunAsync(
+                solution.SolutionFile,
+                outputDir.Path,
+                new ToolRunOptions { NuGetFeedUrl = _fixture.NuGetFeedUrl });
+
+            Assert.True(result.Success, $"Tool failed:\n{result.StdErr}");
+            Assert.Contains("TestPkg.A", result.BomContent);
+            Assert.Contains("TestPkg.DevWithDep", result.BomContent);
+            Assert.Contains("TestPkg.DevTransitive", result.BomContent);
+            Assert.DoesNotContain("<formulation>", result.BomContent);
         }
     }
 }

CycloneDX.Tests/CycloneDX.Tests.csproj

@@ -132,9 +132,15 @@
     <None Update="FunctionalTests\TestcaseFiles\DevDependencies_WithPackageConfig_CsProj.xml">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>
-    <None Update="FunctionalTests\TestcaseFiles\DevDependencies_WithPackageConfig_PackageConfig.xml">
-      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
-    </None>
+    <None Update="FunctionalTests\TestcaseFiles\DevDependencies_WithPackageConfig_PackageConfig.xml">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
+    <None Update="FunctionalTests\TestcaseFiles\DevDependencies_TransitiveOnlyViaDev.json">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
+    <None Update="FunctionalTests\TestcaseFiles\DevDependencies_SharedTransitive.json">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
     <None Update="FunctionalTests\TestcaseFiles\FloatingVersions.json">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>

CycloneDX.Tests/FunctionalTests/ExcludeDevDepenceny.cs

@@ -15,39 +15,39 @@ public class ExcludeDevDepenceny
         // E2E counterpart: CycloneDX.E2ETests.DevDependencyTests
         [Fact]
         [Trait("Status", "MigratedToE2E")]
-        public async Task DevDependenciesNormalyGoIntoTheBom()
+        public async Task DevDependenciesAreIncludedWithScopeExcluded()
         {
             var assetsJson = File.ReadAllText(Path.Combine("FunctionalTests", "TestcaseFiles", "DevDependencies.json"));
             var options = new RunOptions
             {
             };
 
-
             var bom = await FunctionalTestHelper.Test(assetsJson, options);
 
             Assert.True(bom.Components.Count == 1);
-            Assert.Contains(bom.Components, c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
-
+            var devDep = bom.Components.FirstOrDefault(c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
+            Assert.NotNull(devDep);
+            Assert.Equal(Component.ComponentScope.Excluded, devDep.Scope);
         }
 
         // E2E counterpart: CycloneDX.E2ETests.DevDependencyTests
         [Fact]
         [Trait("Status", "MigratedToE2E")]
-        public async Task DevDependenciesAreExcludedWithExcludeDevDependencies()
+        public async Task ExcludeDevFlag_IsDeprecatedAndHasNoEffect()
         {
             var assetsJson = File.ReadAllText(Path.Combine("FunctionalTests", "TestcaseFiles", "DevDependencies.json"));
             var options = new RunOptions
             {
                 excludeDev = true
             };
 
-
             var bom = await FunctionalTestHelper.Test(assetsJson, options);
 
-            Assert.True(bom.Components.Count == 0);
-            Assert.True(bom.Dependencies.Count == 1); // only the meta component
-
-
+            // flag is deprecated; dev dep must still appear with scope=excluded
+            Assert.True(bom.Components.Count == 1);
+            var devDep = bom.Components.FirstOrDefault(c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
+            Assert.NotNull(devDep);
+            Assert.Equal(Component.ComponentScope.Excluded, devDep.Scope);
         }
     }
 }

CycloneDX.Tests/FunctionalTests/ExcludeDevDependnciesWithPackageConfig.cs

@@ -28,7 +28,7 @@ private MockFileSystem getMockFS()
         }
 
         [Fact]
-        public async Task DevDependenciesNormalyGoIntoTheBom()
+        public async Task DevDependenciesAreIncludedWithScopeExcluded()
         {
             var options = new RunOptions
             {
@@ -37,26 +37,26 @@ public async Task DevDependenciesNormalyGoIntoTheBom()
             var bom = await FunctionalTestHelper.Test(options, getMockFS());
 
             Assert.True(bom.Components.Count == 1, $"Unexpected number of components. Expected 1, got {bom.Components.Count}");
-            Assert.Contains(bom.Components, c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
-
+            var devDep = bom.Components.FirstOrDefault(c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
+            Assert.NotNull(devDep);
+            Assert.Equal(Component.ComponentScope.Excluded, devDep.Scope);
         }
 
         [Fact]
-        public async Task DevDependenciesAreExcludedWithExcludeDevDependencies()
-        {            
+        public async Task ExcludeDevFlag_IsDeprecatedAndHasNoEffect()
+        {
             var options = new RunOptions
             {
                 excludeDev = true
             };
 
-
             var bom = await FunctionalTestHelper.Test(options, getMockFS());
 
-            Assert.True(bom.Components.Count == 0);
-
-
+            // flag is deprecated; dev dep must still appear with scope=excluded
+            Assert.True(bom.Components.Count == 1, $"Unexpected number of components. Expected 1, got {bom.Components.Count}");
+            var devDep = bom.Components.FirstOrDefault(c => string.Compare(c.Name, "SonarAnalyzer.CSharp", true) == 0 && c.Version == "9.16.0.82469");
+            Assert.NotNull(devDep);
+            Assert.Equal(Component.ComponentScope.Excluded, devDep.Scope);
         }
-
-
     }
 }

CycloneDX.Tests/FunctionalTests/TestcaseFiles/DevDependencies_SharedTransitive.json

@@ -0,0 +1,95 @@
+{
+  "version": 3,
+  "targets": {
+    "net6.0": {
+      "SonarAnalyzer.CSharp/9.16.0.82469": {
+        "type": "package",
+        "dependencies": {
+          "Google.Protobuf": "3.21.9"
+        }
+      },
+      "Newtonsoft.Json/13.0.1": {
+        "type": "package",
+        "dependencies": {
+          "Google.Protobuf": "3.21.9"
+        }
+      },
+      "Google.Protobuf/3.21.9": {
+        "type": "package"
+      }
+    }
+  },
+  "libraries": {
+    "SonarAnalyzer.CSharp/9.16.0.82469": {
+      "sha512": "abc123==",
+      "type": "package",
+      "path": "sonaranalyzer.csharp/9.16.0.82469",
+      "files": []
+    },
+    "Newtonsoft.Json/13.0.1": {
+      "sha512": "ghi789==",
+      "type": "package",
+      "path": "newtonsoft.json/13.0.1",
+      "files": []
+    },
+    "Google.Protobuf/3.21.9": {
+      "sha512": "def456==",
+      "type": "package",
+      "path": "google.protobuf/3.21.9",
+      "files": []
+    }
+  },
+  "projectFileDependencyGroups": {
+    "net6.0": [
+      "SonarAnalyzer.CSharp >= 9.16.0.82469",
+      "Newtonsoft.Json >= 13.0.1"
+    ]
+  },
+  "packageFolders": {
+    "C:\\Users\\user\\.nuget\\packages\\": {}
+  },
+  "project": {
+    "version": "1.0.0",
+    "restore": {
+      "projectUniqueName": "C:\\src\\TestProject\\TestProject.csproj",
+      "projectName": "TestProject",
+      "projectPath": "C:\\src\\TestProject\\TestProject.csproj",
+      "packagesPath": "C:\\Users\\user\\.nuget\\packages\\",
+      "outputPath": "C:\\src\\TestProject\\obj\\",
+      "projectStyle": "PackageReference",
+      "configFilePaths": [],
+      "originalTargetFrameworks": [ "net6.0" ],
+      "sources": { "https://api.nuget.org/v3/index.json": {} },
+      "frameworks": {
+        "net6.0": {
+          "targetAlias": "net6.0",
+          "projectReferences": {}
+        }
+      }
+    },
+    "frameworks": {
+      "net6.0": {
+        "targetAlias": "net6.0",
+        "dependencies": {
+          "SonarAnalyzer.CSharp": {
+            "include": "Runtime, Build, Native, ContentFiles, Analyzers, BuildTransitive",
+            "suppressParent": "All",
+            "target": "Package",
+            "version": "[9.16.0.82469, )"
+          },
+          "Newtonsoft.Json": {
+            "target": "Package",
+            "version": "[13.0.1, )"
+          }
+        },
+        "imports": [],
+        "assetTargetFallback": false,
+        "warn": false,
+        "frameworkReferences": {
+          "Microsoft.NETCore.App": { "privateAssets": "all" }
+        },
+        "runtimeIdentifierGraphPath": ""
+      }
+    }
+  }
+}