Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix SBOM generation fails since v16.0.3 [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#86839•Fetched 2026-04-08 02:09:00
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
funnelfiascofunnelfiasco
Participants
funnelfiascofunnelfiascogithub-actions[bot]github-actions[bot]
Timeline (top)
closed ×1commented ×1issue_type_added ×1labeled ×1

Error Message

Found a duplicate workspace with the name: webpack-sources, ref: pkg:npm/webpack-sources at packages/next/src/compiled/webpack-sources1/package.json and packages/next/src/compiled/webpack-sources3/package.json. This is likely an error in the project that needs fixing. Duplicate workspace tracked as pkg:npm/webpack-sources#packages/next/src/compiled/webpack-sources1 under metadata.component.components Found a duplicate workspace with the name: web-vitals, ref: pkg:npm/web-vitals at packages/next/src/compiled/web-vitals/package.json and packages/next/src/compiled/web-vitals-attribution/package.json. This is likely an error in the project that needs fixing. Duplicate workspace tracked as pkg:npm/web-vitals#packages/next/src/compiled/web-vitals under metadata.component.components Found a duplicate workspace with the name: schema-utils, ref: pkg:npm/schema-utils at packages/next/src/compiled/schema-utils2/package.json and packages/next/src/compiled/schema-utils3/package.json. This is likely an error in the project that needs fixing. Duplicate workspace tracked as pkg:npm/schema-utils#packages/next/src/compiled/schema-utils2 under metadata.component.components Found a duplicate workspace with the name: loader-utils, ref: pkg:npm/loader-utils at packages/next/src/compiled/loader-utils2/package.json and packages/next/src/compiled/loader-utils3/package.json. This is likely an error in the project that needs fixing. Duplicate workspace tracked as pkg:npm/loader-utils#packages/next/src/compiled/loader-utils2 under metadata.component.components Unable to find any package.json files belonging to the workspace 'crates/js' referred in /Users/bcotton/devel/next.js/pnpm-workspace.yaml. To improve SBOM precision, run cdxgen from the directory containing the complete source code. Found a duplicate workspace with the name: exports, ref: pkg:npm/exports at turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a/package.json and turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-b/package.json. This is likely an error in the project that needs fixing. Duplicate workspace tracked as pkg:npm/exports#turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a under metadata.component.components /opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70 this.errors.push(new errors.YAMLParseError(pos, code, message)); ^

YAMLParseError: Map keys must be unique at line 444, column 3:

'@napi-rs/[email protected]': ^

at Composer.onError (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70:34)
at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:64:13)
at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
at composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:85:19)
at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
at Object.composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
at Object.composeDoc (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-doc.js:35:23) {

code: 'DUPLICATE_KEY', pos: [ 16542, 16543 ], linePos: [ { line: 444, col: 3 }, { line: 444, col: 4 } ] }

Code Example

Found a duplicate workspace with the name: webpack-sources, ref: pkg:npm/webpack-sources at packages/next/src/compiled/webpack-sources1/package.json and packages/next/src/compiled/webpack-sources3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/webpack-sources#packages/next/src/compiled/webpack-sources1 under metadata.component.components
Found a duplicate workspace with the name: web-vitals, ref: pkg:npm/web-vitals at packages/next/src/compiled/web-vitals/package.json and packages/next/src/compiled/web-vitals-attribution/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/web-vitals#packages/next/src/compiled/web-vitals under metadata.component.components
Found a duplicate workspace with the name: schema-utils, ref: pkg:npm/schema-utils at packages/next/src/compiled/schema-utils2/package.json and packages/next/src/compiled/schema-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/schema-utils#packages/next/src/compiled/schema-utils2 under metadata.component.components
Found a duplicate workspace with the name: loader-utils, ref: pkg:npm/loader-utils at packages/next/src/compiled/loader-utils2/package.json and packages/next/src/compiled/loader-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/loader-utils#packages/next/src/compiled/loader-utils2 under metadata.component.components
Unable to find any package.json files belonging to the workspace 'crates/js' referred in /Users/bcotton/devel/next.js/pnpm-workspace.yaml. To improve SBOM precision, run cdxgen from the directory containing the complete source code.
Found a duplicate workspace with the name: exports, ref: pkg:npm/exports at turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a/package.json and turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-b/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/exports#turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a under metadata.component.components
/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70
                this.errors.push(new errors.YAMLParseError(pos, code, message));
                                 ^

YAMLParseError: Map keys must be unique at line 444, column 3:


  '@napi-rs/[email protected]':
  ^

    at Composer.onError (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70:34)
    at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:64:13)
    at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
    at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
    at composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
    at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:85:19)
    at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
    at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
    at Object.composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
    at Object.composeDoc (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-doc.js:35:23) {
  code: 'DUPLICATE_KEY',
  pos: [ 16542, 16543 ],
  linePos: [ { line: 444, col: 3 }, { line: 444, col: 4 } ]
}

---

Operating system: Darwin
Architecture: arm
Kernel: Darwin Kernel Version 25.1.0
cdxgen version 12.0.0 (installed from `npm install -g @cyclonedx/cdxgen`
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/vercel/next.js

To Reproduce

  1. Checkout a git tag
  2. Run cdxgen -o next-$NEXT_VERSION.sbom.json .

Current vs. Expected behavior

Running the steps above for v16.0.2 produces an SBOM. Beginning with v16.0.3, the command fails with:

Found a duplicate workspace with the name: webpack-sources, ref: pkg:npm/webpack-sources at packages/next/src/compiled/webpack-sources1/package.json and packages/next/src/compiled/webpack-sources3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/webpack-sources#packages/next/src/compiled/webpack-sources1 under metadata.component.components
Found a duplicate workspace with the name: web-vitals, ref: pkg:npm/web-vitals at packages/next/src/compiled/web-vitals/package.json and packages/next/src/compiled/web-vitals-attribution/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/web-vitals#packages/next/src/compiled/web-vitals under metadata.component.components
Found a duplicate workspace with the name: schema-utils, ref: pkg:npm/schema-utils at packages/next/src/compiled/schema-utils2/package.json and packages/next/src/compiled/schema-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/schema-utils#packages/next/src/compiled/schema-utils2 under metadata.component.components
Found a duplicate workspace with the name: loader-utils, ref: pkg:npm/loader-utils at packages/next/src/compiled/loader-utils2/package.json and packages/next/src/compiled/loader-utils3/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/loader-utils#packages/next/src/compiled/loader-utils2 under metadata.component.components
Unable to find any package.json files belonging to the workspace 'crates/js' referred in /Users/bcotton/devel/next.js/pnpm-workspace.yaml. To improve SBOM precision, run cdxgen from the directory containing the complete source code.
Found a duplicate workspace with the name: exports, ref: pkg:npm/exports at turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a/package.json and turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-b/package.json. This is likely an error in the project that needs fixing.
Duplicate workspace tracked as pkg:npm/exports#turbopack/crates/turbopack-tests/tests/execution/turbopack/resolving/dynamic-module/input/node_modules/exports-a under metadata.component.components
/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70
                this.errors.push(new errors.YAMLParseError(pos, code, message));
                                 ^

YAMLParseError: Map keys must be unique at line 444, column 3:


  '@napi-rs/[email protected]':
  ^

    at Composer.onError (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/composer.js:70:34)
    at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:64:13)
    at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
    at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
    at composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
    at Object.resolveBlockMap (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/resolve-block-map.js:85:19)
    at resolveCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:13:27)
    at Object.composeCollection (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-collection.js:59:16)
    at Object.composeNode (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-node.js:33:38)
    at Object.composeDoc (/opt/homebrew/lib/node_modules/@cyclonedx/cdxgen/node_modules/yaml/dist/compose/compose-doc.js:35:23) {
  code: 'DUPLICATE_KEY',
  pos: [ 16542, 16543 ],
  linePos: [ { line: 444, col: 3 }, { line: 444, col: 4 } ]
}

Provide environment information

Operating system: Darwin
Architecture: arm
Kernel: Darwin Kernel Version 25.1.0
cdxgen version 12.0.0 (installed from `npm install -g @cyclonedx/cdxgen`

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

From a git bisect, it appears the failure first appeared in 88581b919eee416bedcb95cd89339becaceeca1a (PR #84210)

extent analysis

TL;DR

The most likely fix is to address the duplicate workspace issues and unique map key errors in the project configuration.

Guidance

  • Review the project's pnpm-workspace.yaml file and package.json files for duplicate workspaces and remove or rename them to resolve the conflicts.
  • Check the cdxgen configuration to ensure it is set up to handle the project's directory structure and dependencies correctly.
  • Run cdxgen from the root directory of the project to ensure it has access to all necessary files and dependencies.
  • Consider updating cdxgen to the latest version or checking for any known issues with version 12.0.0.

Example

No code snippet is provided as the issue is related to project configuration and dependencies.

Notes

The issue appears to be related to changes introduced in PR #84210, and resolving the duplicate workspace issues and unique map key errors should fix the problem. However, without more information about the project's configuration and dependencies, it is difficult to provide a more specific solution.

Recommendation

Apply a workaround by addressing the duplicate workspace issues and unique map key errors in the project configuration, as updating to a fixed version is not explicitly implied in the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#callback error#memory management#API rate limit#retriever error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

nextjs - 💡(How to fix) Fix SBOM generation fails since v16.0.3 [1 comments, 2 participants]