What would you like to be added:
We have file - pnpm-lock.yaml which is having all required and dev dependencies. Syft is giving SBOM which has all dependencies including required and dev dependencies without scope defined. Can we exclude dev and test dependencies and get only the actual one?

Why is this needed:
To have clean and required dependencies for direct and transitive SBOM.

Additional context:

Example : Purl for PNPM = "pkg:npm/[email protected]"