[Ross-Sherlock]

DepsTreeToSbom can silently omit transitive components when multiple module trees contain the same artifact with different children, such as Maven modules with different dependency exclusions.

For example:
Module A → X (Y excluded)
Module B → X → Y

Previously, visiting X in module A marked its artifact ID as visited globally. The converter then skipped X’s subtree in module B, omitting Y from the SBOM. Component coverage could therefore depend on module order.

This change tracks visited graph nodes by pointer instead of artifact ID, allowing each distinct occurrence’s children to be traversed. Existing helpers continue to deduplicate components and merge dependency edges by reference. Revisiting the same node object still stops traversal, preserving cycle protection.

Regression tests cover:

• Different module orders and repeated artifacts with different children and grandchildren.
• Pointer cycles.
• Maven dependency-tree JSON with module-specific exclusions, verifying that SBOM components match the parser’s unique dependency inventory.

The converter regression failed before the fix, returning five of seven reachable components, and passes afterward.

• The pull request is targeting the dev branch.
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Advanced
• Run ID: e8e5ecd2-33fd-428e-b3f9-98b7cbf074df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Ross-Sherlock]

I have read the CLA Document and I hereby sign the CLA