[suyash-jai]

A package's browser UI ships as minified bundles that Syft cannot see into, so the virtualization SBOM listed no npm components. This adds catalog_npm_lockfiles(), which scans each shipped lock file's directory on its own (Syft separates runtime from dev dependencies only at the scan root) with licenses from SBOM_NPM_REGISTRY, and adds +javascript-package-cataloger,+sbom-cataloger to the main scan. Of the other 31 deep-scanned .debs of #13252, only delphix-rust-src changes (+2 components).

Jira: DLPX-100122. Sub-task of DLPX-100120 (epic CP-13455), delivered in three PRs:

• DLPX-100121 Document the Phase 4 evaluation of Syft-on-deb for delphix-virtualization and delphix-masking appliance-build#938 (DLPX-100121): the evaluation write-up (docs/specs/2026-10-26-sbom-phase4-evaluation.md)
• DLPX-100122 Catalog npm lock files and embedded CycloneDX documents in package SBOMs #422 (DLPX-100122): catalog the shipped npm lock files and merge embedded CycloneDX documents into package SBOMs
• delphix/dlpx-app-gate#5068 (DLPX-100123): ship the UI lock files and a vendored-components list, generated from *.DESC.json, in delphix-virtualization

Comparison with the CSV BOM

CSV of stage0 pre-push #13252 (bom-internal-qa-aws.csv, product Virtualization) against the package SBOMs of virtualization and sso-app. Before: #13252. After: pre-push #15718 (virtualization package build #2548), with the linux-pkg and dlpx-app-gate changes.

	Before	After
virtualization components	415	1,256 (schema-valid, bom-refs unique)
npm components (with a license)	0	840 (805)
CSV names not in the SBOM	133	23

The 23 names of the per-variant CSV still not in the SBOM, none of which is a gap:

Names	Count	Status
spring-boot-starter-*	7	Not shipped
Maven BOM POMs (azure-sdk, grpc, jackson, netty)	4	No shipped code
grunt-angular-templates, npm-license-crawler	2	Build tools, not shipped
knockout-test, easymock	2	Test libraries, not shipped
jackson-dataformat-toml	1	No longer shipped (came with Flyway 9; develop is on Flyway 11)
okhttp, okio, jconnect, org.jacoco.agent, knockout, highstock-custom, karma-jasmine-old	7	Listed under another name at the CSV's version

"Not shipped" was checked against the file list of the .deb and of every .war in it.

One more CSV row: less.js 3.9.0. bom.csv, the CSV before the Ubuntu rows are added, has one Virtualization row the per-variant bom-<variant>.csv drop: Virtualization,less,3.9.0, apparently because the Ubuntu pager package is also named less. It is a real gap: less.js 3.9.0 ships in dxcore.war (lib/lessjs/less.js) and was in no SBOM. dlpx-app-gate#5068 now lists it from a new descriptor, client/dxcore/lib/lessjs/less.DESC.json. Verified in pre-push #15738 (virtualization package build #2550): pkg:npm/less@3.9.0 with Apache-2.0, 1,257 components, schema-valid. Compared with bom.csv (464 Virtualization names), the CSV-only names are the same 23 as above, so every CSV name is either in the SBOM or explained. Masking needs no change: its 5 CSV-only names are a renamed entry, 2 BOM POMs and 2 components that do not ship.

The components no scan can identify are listed from the generated vendored-components.cdx.json: jacl 1.4.1, javax.inject 1, handlebars 4.7.8, jasmine 1.3.1, karma-jasmine 0.1.6 and highlight.js 9.2.0 are in #15718's and #15735's SBOMs with purl and license; less.js 3.9.0 is in #15738's.

Third-party code that ships but is in neither the CSV nor the SBOM (jqTree, jquery.smooth-scroll 1.4.13, jasmine-jquery, rsync, PostgreSQL xlogdump, inih, jsmn, fonts, angular-mocks, angular-i18n, Glyphicons) is left to DLPX-100126.

🤖 Generated with Claude Code