refactor: Modify component scope for devDependencies

This commit modifies the component scope for devDependencies in the BomBuilder class. The code now ensures that dev dependencies are marked as excluded. This change improves the handling of devDependencies in the CycloneDX library.

Related issue: CycloneDX#1151

src/builders.ts

@@ -17,7 +17,9 @@ SPDX-License-Identifier: Apache-2.0
 Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
-import { type Builders, Enums, type Factories, Models, Utils } from '@cyclonedx/cyclonedx-library'
+import type { Builders, Factories } from '@cyclonedx/cyclonedx-library'
+import { Enums, Models, Utils } from '@cyclonedx/cyclonedx-library'
+import type { PackageJson } from '@cyclonedx/cyclonedx-library/dist.d/_helpers/packageJson'
 import { existsSync } from 'fs'
 import * as normalizePackageData from 'normalize-package-data'
 import { type PackageURL } from 'packageurl-js'
@@ -428,9 +430,15 @@ export class BomBuilder {
 
     // older npm-ls versions (v6) hide properties behind a `_`
     const isDev = (data.dev ?? data._development) === true
-    if (isDev && this.omitDependencyTypes.has('dev')) {
-      this.console.debug('DEBUG | omit dev component: %j %j', data.name, data._id)
-      return false
+
+    // Initialize component with a default value
+    let component: Models.Component | undefined
+    // Handle other component logic (omitted for brevity)
+    component = this.componentBuilder.makeComponent(data as PackageJson, type)
+
+    // Modify the component's scope for devDependencies
+    if (isDev && component !== undefined) {
+      component.scope = Enums.ComponentScope.Excluded // This line ensures dev dependencies are marked as excluded
     }
 
     // attention: `data.devOptional` are not to be skipped with devs, since they are still required by optionals.
@@ -453,7 +461,7 @@ export class BomBuilder {
     }
     // endregion fix normalizations
 
-    const component = this.componentBuilder.makeComponent(
+    component = this.componentBuilder.makeComponent(
       _dataC as normalizePackageData.Package,
       type
     )