# agent's SBOM omitted dev dependencies the scanner flagged: scope fix

## TL;DR

The SBOM generator excluded dev dependencies, but the scanner flags them (they ship in build containers), so the SBOM and the scanner disagreed. Include dev dependencies in the SBOM scope, or document exactly why a scope excludes them. An SBOM that omits what the scanner sees is incomplete.

```text
agent's SBOM omitted dev dependencies the scanner flagged
```

## Steps

1. Compare the SBOM component list against the scanner's findings.
   Expected: The omitted dev dependencies are identified.

2. Expand the SBOM generation scope to include dev dependencies.
   Expected: The SBOM covers them.

3. Regenerate and re-verify: the scanner's findings now appear in the SBOM.
   Expected: The two agree.

4. Document the SBOM scope explicitly: what is included and why.
   Expected: The scope is a decision, not an accident.

5. Align the generator and scanner configs so they cannot drift apart again.
   Expected: The scope stays consistent.

## When to use

- SBOMs miss scanner-flagged components
- dev dependencies are excluded
- the SBOM feeds compliance

## When not to use

- dev dependencies genuinely never ship (then document the exclusion)
- the scanner is wrong about the component (verify manually)
- the SBOM is for a different artifact than the scanner checked

## Tool compatibility

- any SBOM generator
- dependency scanners

## Variant phrasings

- "SBOM omitted dev dependencies"
- "SBOM scope scanner mismatch"
- "SBOM incomplete dev deps"

## Why it happens

SBOM generators default to production scopes, but scanners see the whole tree including dev dependencies that end up in build images. The two tools answered different questions, and the SBOM (the compliance artifact) was the narrower one. Scope is a decision that must be made once, explicitly, and shared by both tools.

## Edge cases

- the scope decision belongs in the build config, not in tribal knowledge
- some dev dependencies genuinely do not ship; the exclusion list needs reasons
- regeneration must be part of the release pipeline, not a manual step

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_euOnMKjKRBzAIXBifYD4Yw