fix: explicitely prevent self-references in dependency graph (#1472)

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

HISTORY.md

@@ -6,6 +6,11 @@ All notable changes to this project will be documented in this file.
 
 <!-- unreleased changes go here -->
 
+* Fixed
+  * Explicitly prevent self-reference dependency graph (via [#1472]) 
+
+[#1472]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1472
+
 ## 5.2.2 - 2025-11-11
 
 * Fixed

src/extractor.ts

@@ -129,7 +129,7 @@ export class Extractor {
     for (const [module, component] of modulesComponents) {
       for (const dependencyModule of module.dependencies.map(d => this.#compilation.moduleGraph.getModule(d)).filter(isNonNullable)) {
         const dependencyBomRef = modulesComponents.get(dependencyModule)?.bomRef
-        if (dependencyBomRef !== undefined) {
+        if (dependencyBomRef !== undefined && dependencyBomRef !== component.bomRef) {
           component.dependencies.add(dependencyBomRef)
         }
       }