🚀 Motivation

The datadog:version-constraint SBOM component property needs to be recognized and forwarded during SBOM uploads so it is not stripped from the payload. This is part of a broader effort to support dependency management version constraint tracking in SCA results.

📝 Summary

• Added VERSION_CONSTRAINT_KEY = 'datadog:version-constraint' constant to constants.ts
• Added handling of the new property key in the component extraction loop in payload.ts, mapping it to a version_constraint boolean field on Dependency
• Also refactored opaque to reuse the same parseTrueOrUndefined helper for consistency
• Added version_constraint to the Dependency interface in types.ts
• Added a fixture and test cases verifying the property is correctly extracted and that evidence.occurrences location data is preserved alongside it

🧪 Testing

• New tests were added for new logic.
• Existing tests were updated for new logic, and not only so that they pass!
• Benchmark results prove that performance is the same or better.

Run locally, field uploaded

🆘 Recovery

Notes for on-call - select only one:

• The change can be rolled back.
• Do not roll back. Why?: