Using --required-only results in cdxgen seeing required and used dependencies as 'optional' and ignoring these

[cgnl]

We are using cdxgen with --required-only but this seems to ignore the dependency 'body-parser', while this is not an optional dependency and not a dev dependency.

Please help me to understand why --required-only results in ignoring this dependency. A code search also confirms that the dependency is being used in our project.

The package.json is as follows:

{
  "name": "example-project",
  "private": true,
  "version": "1.0.0",
  "description": "Example component",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
  "author": "Test",
  "dependencies": {
    "@aws-sdk/client-eks": "3.635.0",
    "@aws-sdk/client-s3": "3.635.0",
    "@aws-sdk/types": "3.609.0",
    "@datadog/datadog-api-client": "1.10.0",
    "@kubernetes/client-node": "0.21.0",
    "@sentry/node": "6.19.7",
    "@ts-stack/markdown": "1.4.0",
    "async-mutex": "0.2.6",
    "body-parser": "1.20.2",
    "compression": "1.7.4",
    "cookie-parser": "1.4.6",
    "cors": "2.8.5",
    "express": "4.17.3",
    "express-session": "1.18.0",
    "ioredis": "4.28.5",
    "js-yaml": "4.1.0",
    "jsonwebtoken": "9.0.2",
    "md5": "2.3.0",
    "mime-types": "2.1.35",
    "pg": "8.12.0",
    "redlock": "4.2.0",
    "signalfx-tracing": "0.13.0",
    "tsee": "1.3.4",
    "typescript-json-serializer": "2.5.2"
  },
  "devDependencies": {
    "@stylistic/eslint-plugin": "2.8.0",
    "@types/babel__core": "7.1.12",
    "@types/body-parser": "1.17.1",
    "@types/cbor": "5.0.0",
    "@types/compression": "1.0.1",
    "@types/cookie-parser": "1.4.2",
    "@types/cors": "2.8.6",
    "@types/estree": "0.0.45",
    "@types/events": "3.0.0",
    "@types/ioredis": "4.28.10",
    "@types/jsonwebtoken": "9.0.6",
    "@types/mime-types": "2.1.0",
    "@types/mocha": "9.0.0",
    "@types/node": "20.14.14",
    "@types/pg": "8.11.6",
    "@types/redis": "2.8.32",
    "@types/redlock": "4.0.7",
    "@types/shelljs": "0.8.12",
    "@typescript-eslint/eslint-plugin": "7.12.0",
    "@typescript-eslint/parser": "7.12.0",
    "commander": "11.0.0",
    "env-cmd": "10.1.0",
    "eslint": "8.57.0",
    "mocha": "9.2.2",
    "mochawesome": "6.3.1",
    "node-worker-threads-pool": "1.5.1",
    "oxlint": "0.5.2",
    "shelljs": "0.8.5",
    "ts-node": "10.9.2",
    "tsc-watch": "6.2.0",
    "typed-emitter": "1.3.1",
    "typescript": "4.9.5"
  }
}

package.json

[aryan-rajoria]

Hello @cgnl, could you please try running with --no-babel command.

also, could you please share any simple example repository so we can reproduce this error?

[cgnl]

Thanks for your reply @aryan-rajoria.
Running with --no-babel and --required-only results in 433 dependencies compared to 12 dependencies with just --required-only.
So it seems that the babel usage analysis does not find the import.

When I make a usage slice with Atom, the usage is found. Is it possible to use Atom instead of Babel to decide if dependencies are used?

I will try to make a simple example repository..