[K9VULN-14776] Emit manifest metadata for range resolution

cmd/datadog-sbom-generator/__snapshots__/main_test.snap

@@ -2641,6 +2641,10 @@ Scanned <rootdir>/fixtures/integration-npm/with-workspace/yarn.lock file and fou
           "name": "datadog:package-manager",
           "value": "NPM"
         },
+        {
+          "name": "datadog:requires-transitive-enrichment",
+          "value": "true"
+        },
         {
           "name": "datadog:version-range",
           "value": "^4.17.21"
@@ -2698,6 +2702,10 @@ Scanned <rootdir>/fixtures/integration-package-json/package.json file and found
         {
           "name": "datadog:package-manager",
           "value": "uv"
+        },
+        {
+          "name": "datadog:requires-transitive-enrichment",
+          "value": "true"
         }
       ],
       "evidence": {
@@ -2708,6 +2716,37 @@ Scanned <rootdir>/fixtures/integration-package-json/package.json file and found
         ]
       }
     },
+    {
+      "bom-ref": "pkg:pypi/numpy",
+      "type": "library",
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy",
+      "properties": [
+        {
+          "name": "datadog:is-direct",
+          "value": "true"
+        },
+        {
+          "name": "datadog:package-manager",
+          "value": "uv"
+        },
+        {
+          "name": "datadog:requires-transitive-enrichment",
+          "value": "true"
+        },
+        {
+          "name": "datadog:version-range",
+          "value": "/u003e=1.24"
+        }
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "{/"block/":{/"file_name/":/"pyproject.toml/",/"line_start/":8,/"line_end/":8,/"column_start/":5,/"column_end/":19,/"role/":/"manifest/"},/"name/":{/"file_name/":/"pyproject.toml/",/"line_start/":8,/"line_end/":8,/"column_start/":6,/"column_end/":11,/"role/":/"manifest/"},/"version/":{/"file_name/":/"pyproject.toml/",/"line_start/":8,/"line_end/":8,/"column_start/":11,/"column_end/":17,/"role/":/"manifest/"}}"
+          }
+        ]
+      }
+    },
     {
       "bom-ref": "pkg:pypi/pytest@8.2.0",
       "type": "library",
@@ -2726,6 +2765,10 @@ Scanned <rootdir>/fixtures/integration-package-json/package.json file and found
         {
           "name": "datadog:package-manager",
           "value": "uv"
+        },
+        {
+          "name": "datadog:requires-transitive-enrichment",
+          "value": "true"
         }
       ],
       "evidence": {
@@ -2750,6 +2793,10 @@ Scanned <rootdir>/fixtures/integration-package-json/package.json file and found
         {
           "name": "datadog:package-manager",
           "value": "uv"
+        },
+        {
+          "name": "datadog:requires-transitive-enrichment",
+          "value": "true"
         }
       ],
       "evidence": {
@@ -2767,7 +2814,7 @@ Scanned <rootdir>/fixtures/integration-package-json/package.json file and found
 
 [TestRun/Scan_pyproject.toml_without_lock_file - 2]
 Scanning directory './fixtures/integration-pyproject', resolved absolute path '<rootdir>/fixtures/integration-pyproject'
-Scanned <rootdir>/fixtures/integration-pyproject/pyproject.toml file and found 3 packages
+Scanned <rootdir>/fixtures/integration-pyproject/pyproject.toml file and found 4 packages
 [reachability] Reachability analysis is disabled
 ---
 

pkg/lockfile/fixtures/pyproject-toml-extractor/poetry-pinned/pyproject.toml

@@ -12,3 +12,4 @@ requests = "==2.28.0"
 flask = "==2.3.2"
 boto3 = "1.26.0"
 numpy = "^1.24"
+scipy = "1.*"

pkg/lockfile/internal/testutil/helpers.go

@@ -47,9 +47,10 @@ func PackageToString(pkg lockfile.PackageDetails) string {
 	}
 
 	return fmt.Sprintf(
-		"%s@%s {ecosystem=%q targetVersions=%v packageManager=%q commit=%q depGroups=%v exclusions=%v targetFrameworks=%v isDirect=%t blockLocation=%s nameLocation=%s versionLocation=%s}",
+		"%s@%s {versionRange=%q ecosystem=%q targetVersions=%v packageManager=%q commit=%q depGroups=%v exclusions=%v targetFrameworks=%v isDirect=%t requiresTransitiveEnrichment=%t blockLocation=%s nameLocation=%s versionLocation=%s}",
 		pkg.Name,
 		pkg.Version,
+		pkg.VersionRange,
 		pkg.Ecosystem,
 		pkg.TargetVersions,
 		pkg.PackageManager,
@@ -58,6 +59,7 @@ func PackageToString(pkg lockfile.PackageDetails) string {
 		pkg.Exclusions,
 		pkg.TargetFrameworks,
 		pkg.IsDirect,
+		pkg.RequiresTransitiveEnrichment,
 		formatLoc(pkg.BlockLocation),
 		formatLocPtr(pkg.NameLocation),
 		formatLocPtr(pkg.VersionLocation),

pkg/lockfile/javascript/parse-package-json.go

@@ -268,17 +268,18 @@ func (e PackageJSONExtractor) Extract(f lockfile.DepFile, context lockfile.ScanC
 			}
 
 			packages[dedupKey] = lockfile.PackageDetails{
-				Name:            resolvedName,
-				Version:         version,
-				VersionRange:    versionRange,
-				PackageManager:  packageJSONPackageManager,
-				Ecosystem:       models.EcosystemNPM,
-				IsDirect:        true,
-				DepGroups:       []string{section.group},
-				BlockLocation:   blockLocation,
-				NameLocation:    nameLocation,
-				VersionLocation: versionLocation,
-				LocationRole:    models.LocationRoleManifest,
+				Name:                         resolvedName,
+				Version:                      version,
+				VersionRange:                 versionRange,
+				PackageManager:               packageJSONPackageManager,
+				Ecosystem:                    models.EcosystemNPM,
+				IsDirect:                     true,
+				RequiresTransitiveEnrichment: true,
+				DepGroups:                    []string{section.group},
+				BlockLocation:                blockLocation,
+				NameLocation:                 nameLocation,
+				VersionLocation:              versionLocation,
+				LocationRole:                 models.LocationRoleManifest,
 			}
 		}
 	}