Everything showed as successful, until I went to look at the output and found that it only had an entry for our application and nothing else.
Went and looked at the logs and found a log message that it could not parse the json from the package-lock.json file and included the following exception.
System.Text.Json.JsonException: The JSON value could not be converted to System.Collections.Generic.IDictionary`2[System.String,System.String]. Path: $.engines | LineNumber: 5 | BytePositionInLine: 18.
at System.Text.Json.ThrowHelper.ThrowJsonException_DeserializeUnableToConvertValue(Type propertyType)
at System.Text.Json.Serialization.JsonDictionaryConverter`3.OnTryRead(Utf8JsonReader& reader, Type typeToConvert, JsonSerializerOptions options, ReadStack& state, TDictionary& value)
at System.Text.Json.Serialization.JsonConverter`1.TryRead(Utf8JsonReader& reader, Type typeToConvert, JsonSerializerOptions options, ReadStack& state, T& value, Boolean& isPopulatedValue)
at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.ReadJsonAndSetMember(Object obj, ReadStack& state, Utf8JsonReader& reader)
at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryRead(Utf8JsonReader& reader, Type typeToConvert, JsonSerializerOptions options, ReadStack& state, T& value)
at System.Text.Json.Serialization.JsonConverter`1.TryRead(Utf8JsonReader& reader, Type typeToConvert, JsonSerializerOptions options, ReadStack& state, T& value, Boolean& isPopulatedValue)
at System.Text.Json.Serialization.JsonConverter`1.ReadCore(Utf8JsonReader& reader, T& value, JsonSerializerOptions options, ReadStack& state)
at System.Text.Json.Serialization.Metadata.JsonTypeInfo`1.Deserialize(Utf8JsonReader& reader, ReadStack& state)
at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 utf8Json, JsonTypeInfo`1 jsonTypeInfo, Nullable`1 actualByteCount)
at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 json, JsonTypeInfo`1 jsonTypeInfo)
at System.Text.Json.JsonSerializer.Deserialize[TValue](String json, JsonSerializerOptions options)
at Microsoft.ComponentDetection.Detectors.Npm.NpmLockfile3Detector.ProcessLockfile(ISingleFileComponentRecorder singleFileComponentRecorder, PackageJson packageJson, JsonDocument lockfile, Int32 lockfileVersion)
at Microsoft.ComponentDetection.Detectors.Npm.NpmLockfileDetectorBase.OnFileFoundAsync(ProcessRequest processRequest, IDictionary`2 detectorArgs, CancellationToken cancellationToken)
I changed up our pipeline to install v4.1.4 of the SBOM tool instead and it succeeded without any json parsing issues.
In preparation for our next release, utilized the latest sbom tool for linux (https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64) on an ADO pipeline agent to generate an SBOM of our Angular web app.
Everything showed as successful, until I went to look at the output and found that it only had an entry for our application and nothing else.
Went and looked at the logs and found a log message that it could not parse the json from the package-lock.json file and included the following exception.
I changed up our pipeline to install v4.1.4 of the SBOM tool instead and it succeeded without any json parsing issues.
Attached is the package-lock.json file:
package-lock.json