bug(cyclonedx): Regression in 0.67 leads to missing licenses for Node project

[twwd]

Description

Since the update to Trivy 0.67.0, some license are missing in our CycloneDX SBOMs for Node projects.

Desired Behavior

All licenses are detected.

Actual Behavior

Some licenses are suddenly missing.

Reproduction Steps

I've created an MRE with a short package.json that shows the bug.

1. Clone the repo
2. Run pnpm install or npm ci to fill the node_modules directory
3. Generate a CycloneDX SBOM with Trivy: trivy fs --scanners license -f cyclonedx -o bom.json .
4. Check the licences in the bom.json

Target

Filesystem

Scanner

License

Output Format

CycloneDX

Mode

Standalone

Debug Output

2025-10-14T08:55:36+02:00       DEBUG   No plugins loaded
2025-10-14T08:55:36+02:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-14T08:55:36+02:00       DEBUG   Cache dir       dir="/home/tim/.cache/trivy"
2025-10-14T08:55:36+02:00       DEBUG   Cache dir       dir="/home/tim/.cache/trivy"
2025-10-14T08:55:36+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-10-14T08:55:36+02:00       DEBUG   Ignore statuses statuses=[]
2025-10-14T08:55:36+02:00       DEBUG   [pkg] Package types     types=[os library]
2025-10-14T08:55:36+02:00       DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2025-10-14T08:55:36+02:00       INFO    [license] License scanning is enabled
2025-10-14T08:55:36+02:00       DEBUG   [notification] Running version check
2025-10-14T08:55:36+02:00       DEBUG   Initializing scan cache...      type="memory"
2025-10-14T08:55:36+02:00       DEBUG   [fs] Analyzing...       root="."
2025-10-14T08:55:36+02:00       DEBUG   [notification] Version check completed  latest_version="0.67.2"
2025-10-14T08:55:37+02:00       DEBUG   [fs] Repository is dirty, random cache key will be used
2025-10-14T08:55:37+02:00       DEBUG   Created process-specific temp directory path="/tmp/trivy-1843"
2025-10-14T08:55:37+02:00       DEBUG   Skipping path   path=".git"
2025-10-14T08:55:39+02:00       DEBUG   [npm] Unable to resolve the version     name="typescript" version="*"
2025-10-14T08:55:39+02:00       DEBUG   OS is not detected.
2025-10-14T08:55:39+02:00       DEBUG   Detected OS: unknown
2025-10-14T08:55:39+02:00       INFO    Number of language-specific files       num=2
2025-10-14T08:55:39+02:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-10-14T08:55:39+02:00       DEBUG   [vex] VEX filtering is disabled
2025-10-14T08:55:39+02:00       DEBUG   Cleaning up temp directory      path="/tmp/trivy-1843"

Operating System

Linux

Version

0.67.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @twwd
Thanks for your report and example!

Created #9660

Regards, Dmitriy