Shouldn't webpack be listed in the bom as runtime dependency?

[bpapez]

Looking at the vulnerability CVE-2024-43788 , which comes through a call to webpack's AutoPublicPathRuntimeModule (link) I was wondering why the bom file created by the cyclonedx-webpack-plugin does not list webpack as runtime dependency. Or is there an option how to make it be listed in the bom, which we use for monitoring possible 3rd party vulnerabilites at runtime?