From 8bf35a833afd9ffbab235fa6c5b738c3e81b56f5 Mon Sep 17 00:00:00 2001
From: dervoeti <lukas.krug@stackable.tech>
Date: Tue, 25 Aug 2026 06:59:36 +0000
Subject: [PATCH] fix(superset): Exclude superset-ui-switchboard from the
 frontend SBOM

---
 CHANGELOG.md        |  2 ++
 superset/Dockerfile | 18 ++++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ea959918..512e1ed36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ All notable changes to this project will be documented in this file.
 
 - spark: Propagate the entrypoint's exit code so failed applications are no longer reported as successful ([#1595]).
 - superset: Fix the broken builds by excluding the `cypress-base` end-to-end test project from the frontend SBOM ([#1616]).
+- superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1620]).
 
 ### Removed
 
@@ -29,6 +30,7 @@ All notable changes to this project will be documented in this file.
 [#1600]: https://github.com/stackabletech/docker-images/pull/1600
 [#1611]: https://github.com/stackabletech/docker-images/pull/1611
 [#1616]: https://github.com/stackabletech/docker-images/pull/1616
+[#1620]: https://github.com/stackabletech/docker-images/pull/1620
 
 ## [26.7.0] - 2026-07-21
 
diff --git a/superset/Dockerfile b/superset/Dockerfile
index 88d6b252d..6ea45e2ab 100644
--- a/superset/Dockerfile
+++ b/superset/Dockerfile
@@ -147,17 +147,23 @@ npm run build
 #   also drop all transitive runtime dependencies.
 # --project-version is passed because the frontends declare a placeholder version
 #   upstream.
-# --exclude skips cypress-base, which is an independent npm project (it has its own
-#   package-lock.json) for the end-to-end tests. Its dependencies are never installed
-#   or shipped in this image, so they have no place in the SBOM. Excluding it also
-#   avoids a cdxgen bug: for such nested projects it emits the `license` string from
-#   package.json verbatim instead of a CycloneDX `licenses` array, which makes cdxgen
-#   fail its own schema validation.
+# --exclude skips the directories that are independent npm projects, because they ship
+#   their own package-lock.json:
+#   * cypress-base holds the end-to-end tests. Its dependencies are never installed
+#     (`npm ci` runs in superset-frontend) nor shipped, so they have no place in the SBOM.
+#   * packages/superset-ui-switchboard (4.1.4 only) has a lock file without any
+#     dependencies. The package itself is already covered by the top-level lock file.
+#   Excluding them also avoids a cdxgen bug: for such nested projects it emits the
+#   `license` string from package.json verbatim instead of a CycloneDX `licenses` array,
+#   which makes cdxgen fail its own schema validation and write no SBOM at all. This is
+#   fixed upstream in cdxgen, but not in a released version yet, see
+#   https://github.com/cdxgen/cdxgen/issues/4326.
 PATH="/opt/node-cdxgen/bin:$PATH" cdxgen \
     --type js \
     --required-only \
     --no-babel \
     --exclude "**/cypress-base/**" \
+    --exclude "**/packages/superset-ui-switchboard/**" \
     --spec-version "${CDXGEN_SPEC_VERSION}" \
     --project-version "${PRODUCT_VERSION}" \
     --output "/stackable/app/superset-frontend-${PRODUCT_VERSION}.cdx.json"