@cdxgen/cdxgen 0.0.1 → 13.0.1

package/lib/cli/jvmBom.js

@@ -0,0 +1,1858 @@
+import { Buffer } from "node:buffer";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve, sep } from "node:path";
+import process from "node:process";
+
+import { build } from "@cdxgen/cdx-purl";
+import { gte, lte } from "semver";
+
+import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  hasAnyProjectType,
+  includeMavenTestScope,
+  isFeatureEnabled,
+  isPackageManagerAllowed,
+  PREFER_MAVEN_DEPS_TREE,
+  parseMavenArgs,
+} from "../core/env.js";
+import {
+  getAllFiles,
+  getTmpDir,
+  MAX_BUFFER,
+  safeExistsSync,
+  safeMkdirSync,
+  safeMkdtempSync,
+  safeRmSync,
+  safeSpawnSync,
+  safeUnlinkSync,
+  safeWriteSync,
+} from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
+import { dirNameStr } from "../core/paths.js";
+import { extractJarArchive, getMvnMetadata } from "../ecosystems/ecosystems.js";
+import {
+  buildGradleCommandArguments,
+  buildObjectForGradleModule,
+  collectGradleDependencies,
+  executeParallelGradleProperties,
+  getGradleCommand,
+  getMavenCommand,
+  getMillCommand,
+  parseGradleDep,
+  parseGradleInfoLogsForUrls,
+  parseGradleProperties,
+  parseGradleResolvedDistributions,
+  splitOutputByGradleProjects,
+} from "../ecosystems/gradleutils.js";
+import {
+  parseModuleBazel,
+  parseModuleBazelLock,
+} from "../ecosystems/parsers-bazel.js";
+import {
+  parseBazelActionGraph,
+  parseBazelSkyframe,
+  parseMavenTree,
+  parseMavenTreeJson,
+  parseMillDependency,
+  parsePom,
+} from "../ecosystems/parsers-jvm.js";
+import {
+  addPlugin,
+  cleanupPlugin,
+  determineSbtVersion,
+  discoverSbtProjects,
+  parseSbtLock,
+  parseSbtProjects,
+  parseSbtRootProject,
+  parseSbtTree,
+} from "../ecosystems/sbtutils.js";
+import {
+  collectJarNS,
+  collectMvnDependencies,
+  convertJarNSToPackages,
+} from "../inventory/deps.js";
+import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
+import {
+  attachIdentityTools,
+  extractToolRefs,
+} from "../inventory/evidenceUtils.js";
+import { applyPurl, mavenPurl } from "../inventory/purl.js";
+import {
+  buildBomNSData,
+  createDefaultParentComponent,
+  shouldIncludeNodeModulesDir,
+} from "./bomAssembly.js";
+
+const isWin = process.platform === "win32";
+
+/**
+ * Resolved path to the Gradle modules cache directory, derived from
+ * `GRADLE_CACHE_DIR`, `GRADLE_USER_HOME`, or `~/.gradle/caches/modules-2/files-2.1`.
+ *
+ * @type {string}
+ */
+export let GRADLE_CACHE_DIR =
+  readEnvironmentVariable("GRADLE_CACHE_DIR") ||
+  join(homedir(), ".gradle", "caches", "modules-2", "files-2.1");
+if (readEnvironmentVariable("GRADLE_USER_HOME")) {
+  GRADLE_CACHE_DIR = join(
+    readEnvironmentVariable("GRADLE_USER_HOME"),
+    "caches",
+    "modules-2",
+    "files-2.1",
+  );
+}
+
+/**
+ * Absolute path to the bundled `init.gradle` helper script under `data/helpers`.
+ *
+ * @type {string}
+ */
+// Construct path to gradle init script
+export const GRADLE_INIT_SCRIPT = resolve(
+  dirNameStr,
+  "data",
+  "helpers",
+  "init.gradle",
+);
+
+/**
+ * Resolved path to the sbt/Ivy2 cache directory, derived from `SBT_CACHE_DIR`
+ * or `~/.ivy2/cache`.
+ *
+ * @type {string}
+ */
+// Construct sbt cache directory
+export const SBT_CACHE_DIR =
+  readEnvironmentVariable("SBT_CACHE_DIR") || join(homedir(), ".ivy2", "cache");
+
+/**
+ * Function to create bom string for Java jars
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ *
+ * @returns {Object} BOM with namespace mapping
+ */
+export async function createJarBom(path, options) {
+  let pkgList = [];
+  let jarFiles;
+  let nsMapping = {};
+  const searchOptions = {
+    ...options,
+    exclude: [...(options.exclude || [])],
+  };
+  if (typeof searchOptions.includeNodeModulesDir === "undefined") {
+    searchOptions.includeNodeModulesDir = shouldIncludeNodeModulesDir(options, [
+      "jar",
+      "war",
+      "ear",
+    ]);
+  }
+  // Exclude certain directories during oci sbom generation
+  if (hasAnyProjectType(["oci"], options, false)) {
+    searchOptions.exclude.push("**/android-sdk*/**");
+    searchOptions.exclude.push("**/.sdkman/**");
+  }
+  const parentComponent = createDefaultParentComponent(path, "maven", options);
+  if (options.useGradleCache) {
+    nsMapping = await collectGradleDependencies(
+      getGradleCommand(path, null),
+      path,
+      false,
+      true,
+    );
+  } else if (options.useMavenCache) {
+    nsMapping = await collectMvnDependencies(
+      getMavenCommand(path, null),
+      null,
+      false,
+      true,
+    );
+  }
+  if (path.endsWith(".jar")) {
+    jarFiles = [resolve(path)];
+  } else {
+    jarFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}*.[jw]ar`,
+      searchOptions,
+    );
+  }
+  // Jenkins plugins
+  const hpiFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.hpi`,
+    searchOptions,
+  );
+  if (hpiFiles.length) {
+    jarFiles = jarFiles.concat(hpiFiles);
+  }
+  for (const jar of jarFiles) {
+    const tempDir = safeMkdtempSync(join(getTmpDir(), "jar-deps-"));
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${jar}`);
+    }
+    const dlist = await extractJarArchive(jar, tempDir);
+    if (dlist?.length) {
+      pkgList = pkgList.concat(dlist);
+    }
+    if (pkgList.length) {
+      pkgList = await getMvnMetadata(pkgList);
+    }
+    // Clean up
+    if (tempDir?.startsWith(getTmpDir())) {
+      safeRmSync(tempDir, { recursive: true, force: true });
+    }
+  }
+  pkgList = pkgList.concat(await convertJarNSToPackages(nsMapping));
+  return buildBomNSData(options, pkgList, "maven", {
+    src: path,
+    parentComponent,
+  });
+}
+
+/**
+ * Discover the real sbt project ids for a build by invoking sbt's own
+ * `projects` command. This is more reliable than scraping the build files with
+ * a regex, since it uses sbt's project resolution and avoids false positives
+ * (commented-out code, examples, values that merely resemble project defs) that
+ * can lead to hangs when those bogus scopes are later passed to `dependencyTree`.
+ *
+ * Falls back to the regex-based {@link discoverSbtProjects} heuristic when the
+ * sbt invocation fails or yields nothing useful.
+ *
+ * @param {string} basePath Directory of the sbt build
+ * @param {string} sbtCmd sbt executable
+ * @param {Object} env Environment for the spawned process
+ * @returns {string[]} List of sbt project ids
+ */
+export function discoverSbtProjectsFromCmd(basePath, sbtCmd, env) {
+  try {
+    const result = safeSpawnSync(
+      sbtCmd,
+      ["-batch", "-no-colors", '"projects"'],
+      {
+        cwd: basePath,
+        shell: true,
+        env,
+        encoding: "utf-8",
+      },
+    );
+    if (result.status === 0 && !result.error) {
+      const { projects, root } = parseSbtProjects(result.stdout || "");
+      // Exclude the aggregating root project - its own dependencyTree is
+      // usually a subset of the aggregated subprojects and re-resolving it
+      // only adds noise/time.
+      const subprojects = projects.filter((p) => p !== root);
+      if (subprojects.length > 0) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Discovered sbt projects via sbt: ${subprojects.join(", ")}`,
+          );
+        }
+        return subprojects;
+      }
+      // Single-project builds (root only): resolve at the root scope.
+      if (projects.length > 0) {
+        return [];
+      }
+    } else if (DEBUG_MODE) {
+      console.log(
+        "sbt projects command did not succeed. Falling back to heuristic project discovery.",
+      );
+    }
+  } catch (err) {
+    if (DEBUG_MODE) {
+      console.log("Unable to run sbt projects command.", err);
+    }
+  }
+  // Fallback to the regex-based heuristic.
+  return discoverSbtProjects(basePath);
+}
+
+/**
+ * Function to create bom string for Java projects
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export async function createJavaBom(path, options) {
+  let jarNSMapping = {};
+  let pkgList = [];
+  let dependencies = [];
+  // cyclone-dx-maven plugin creates a component for the app under metadata
+  // This is subsequently referred to in the dependencies list
+  let parentComponent = {};
+  // Support for tracking all the tools that created the BOM
+  // For java, this would correctly include the cyclonedx maven plugin.
+  let tools;
+  let possible_misses = false;
+  let parallelPropTaskOut = "";
+  // war/ear mode
+  if (path.endsWith(".war") || path.endsWith(".jar")) {
+    // Check if the file exists
+    if (safeExistsSync(path)) {
+      if (DEBUG_MODE) {
+        console.log(`Retrieving packages from ${path}`);
+      }
+      const tempDir = safeMkdtempSync(join(getTmpDir(), "war-deps-"));
+      jarNSMapping = await collectJarNS(tempDir);
+      pkgList = await extractJarArchive(path, tempDir, jarNSMapping);
+      if (pkgList.length) {
+        pkgList = await getMvnMetadata(pkgList);
+      }
+      // Clean up
+      if (tempDir?.startsWith(getTmpDir())) {
+        console.log(`Cleaning up ${tempDir}`);
+        safeRmSync(tempDir, { recursive: true, force: true });
+      }
+    } else {
+      console.log(`${path} doesn't exist`);
+    }
+    return buildBomNSData(options, pkgList, "maven", {
+      src: dirname(path),
+      filename: path,
+      nsMapping: jarNSMapping,
+      dependencies,
+      parentComponent,
+    });
+  }
+  // -t quarkus is supported
+  let isQuarkus = options?.projectType?.includes("quarkus");
+  let useMavenDepsTree = isQuarkus ? false : PREFER_MAVEN_DEPS_TREE;
+  // Is this a multi-module project
+  let rootModules;
+  // maven - pom.xml
+  const pomFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}pom.xml`,
+    options,
+  );
+  // gradle
+  const gradleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}build.gradle*`,
+    options,
+  );
+  // mill
+  const millFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}build.mill`,
+    options,
+  );
+  let bomJsonFiles = [];
+  if (
+    pomFiles?.length &&
+    isPackageManagerAllowed(
+      "maven",
+      ["bazel", "sbt", "gradle", "mill"],
+      options,
+    )
+  ) {
+    if (gradleFiles.length) {
+      thoughtLog(
+        `Is this a Gradle project? I recommend invoking cdxgen with the "-t gradle" option if you're encountering build errors.`,
+      );
+    }
+    if (!isQuarkus) {
+      // Quarkus projects require special treatment. To detect quarkus, we parse the first 3 maven file to look for a hit
+      for (const pf of pomFiles.slice(0, 3)) {
+        const pomMap = parsePom(pf);
+        if (!rootModules && pomMap?.modules?.length) {
+          rootModules = pomMap.modules;
+        }
+        // In quarkus mode, we cannot use the maven deps tree
+        if (pomMap.isQuarkus) {
+          isQuarkus = true;
+          useMavenDepsTree = false;
+          break;
+        }
+      }
+    }
+    let result;
+    let mvnArgs;
+    // FIXME: How do we motivate everyone to upgrade to 1.7?
+    const toolsSpecVersion = 1.6;
+    if (isQuarkus) {
+      thoughtLog(
+        "This appears to be a Quarkus project. Let's use the right Maven plugin.",
+      );
+      // disable analytics. See: https://quarkus.io/usage/
+      mvnArgs = [
+        "-fn",
+        "quarkus:dependency-sbom",
+        "-Dquarkus.analytics.disabled=true",
+      ];
+      if (options.specVersion >= 1.6) {
+        mvnArgs = mvnArgs.concat(
+          `-Dquarkus.dependency.sbom.schema-version=${toolsSpecVersion}`,
+        );
+      }
+    } else {
+      // FIXME: The last maven plugin release was on November 28th, 2024.
+      // Should we fork this repo and maintain it ourselves?
+      const cdxMavenPlugin =
+        readEnvironmentVariable("CDX_MAVEN_PLUGIN") ||
+        "org.cyclonedx:cyclonedx-maven-plugin:2.9.1";
+      const cdxMavenGoal =
+        readEnvironmentVariable("CDX_MAVEN_GOAL") || "makeAggregateBom";
+      mvnArgs = [
+        "-fn",
+        `${cdxMavenPlugin}:${cdxMavenGoal}`,
+        "-DoutputName=bom",
+      ];
+      if (includeMavenTestScope) {
+        mvnArgs.push("-DincludeTestScope=true");
+      }
+      // By using quiet mode we can reduce the maxBuffer used and avoid crashes
+      if (!DEBUG_MODE) {
+        mvnArgs.push("-q");
+      }
+      // Support for passing additional settings and profile to maven
+      if (readEnvironmentVariable("MVN_ARGS")) {
+        const addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
+        mvnArgs = mvnArgs.concat(addArgs);
+      }
+      // specVersion 1.4 doesn't support externalReferences.type=distribution-intake
+      // so we need to run the plugin with the correct version
+      if (options.specVersion >= 1.6) {
+        mvnArgs = mvnArgs.concat(`-DschemaVersion=${toolsSpecVersion}`);
+      } else if (options.specVersion > 1.4) {
+        mvnArgs = mvnArgs.concat(`-DschemaVersion=${options.specVersion}`);
+      }
+    }
+    const firstPom = pomFiles.length ? pomFiles[0] : undefined;
+    let mavenCmd = getMavenCommand(path, path);
+    for (const f of pomFiles) {
+      const basePath = dirname(f);
+      if (
+        isQuarkus &&
+        !options.deep &&
+        rootModules?.includes(basename(basePath))
+      ) {
+        if (DEBUG_MODE) {
+          console.log("Skipped sub-module", basePath);
+        }
+        continue;
+      }
+      const settingsXml = join(basePath, "settings.xml");
+      if (safeExistsSync(settingsXml)) {
+        console.log(
+          `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`,
+        );
+      }
+      if (mavenCmd?.endsWith("mvn")) {
+        mavenCmd = getMavenCommand(basePath, path);
+      }
+      // Should we attempt to resolve class names
+      if (options.resolveClass || options.deep) {
+        const tmpjarNSMapping = await collectMvnDependencies(
+          mavenCmd,
+          basePath,
+          true,
+          false,
+        );
+        if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+          jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+        }
+      }
+      // Use the cyclonedx maven plugin if there is no preference for maven deps tree
+      if (!useMavenDepsTree) {
+        thoughtLog("The user wants me to use the cyclonedx-maven plugin.");
+        console.log(`Executing '${mavenCmd}' in`, basePath);
+        result = safeSpawnSync(mavenCmd, mvnArgs, {
+          cwd: basePath,
+          shell: isWin,
+        });
+        // Check if the cyclonedx plugin created the required bom.json file
+        // Sometimes the plugin fails silently for complex maven projects
+        bomJsonFiles = getAllFiles(
+          path,
+          "**/target/*{cdx,bom,cyclonedx}*.json",
+          options,
+        );
+        // Check if the bom json files got created in a directory other than target
+        if (!bomJsonFiles.length) {
+          bomJsonFiles = getAllFiles(
+            path,
+            "target/**/*{cdx,bom,cyclonedx}*.json",
+            options,
+          );
+        }
+      }
+      // Also check if the user has a preference for maven deps tree command
+      if (
+        useMavenDepsTree ||
+        !bomJsonFiles.length ||
+        result?.status !== 0 ||
+        result?.error
+      ) {
+        const tempRoot = getTmpDir();
+        const tempDir = safeMkdtempSync(join(tempRoot, "cdxgen-mvn-"));
+        const tempMvnTree = join(tempDir, "cdxgen-mvn-tree.json");
+        const tempMvnTreeText = join(tempDir, "cdxgen-mvn-tree.txt");
+        const tempMvnParentTree = join(tempDir, "cdxgen-mvn-parent-tree.json");
+        const tempMvnParentTreeText = join(
+          tempDir,
+          "cdxgen-mvn-parent-tree.txt",
+        );
+        try {
+          let mvnTreeArgs = [
+            "dependency:tree",
+            `-DoutputFile=${tempMvnTree}`,
+            "-DoutputType=json",
+          ];
+          let addArgs = [];
+          if (readEnvironmentVariable("MVN_ARGS")) {
+            addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
+            mvnTreeArgs = mvnTreeArgs.concat(addArgs);
+          }
+          // Automatically use settings.xml to improve the success for fallback
+          if (safeExistsSync(settingsXml)) {
+            mvnTreeArgs.push("-s");
+            mvnTreeArgs.push(settingsXml);
+          }
+          // For the first pom alone, we need to execute first in non-recursive mode to capture
+          // the parent component. Then, we execute all of them in recursive mode
+          if (f === firstPom) {
+            thoughtLog(
+              "What is the parent component here? Let's use maven command to find out.",
+            );
+            let findParentComponentArgs = [
+              "dependency:tree",
+              "-N",
+              `-DoutputFile=${tempMvnParentTree}`,
+              "-DoutputType=json",
+            ];
+            if (addArgs.length) {
+              findParentComponentArgs = findParentComponentArgs.concat(addArgs);
+            }
+            result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
+              cwd: basePath,
+              shell: isWin,
+            });
+            // If json is empty or unparseable, fallback to text parsing
+            let emptyJson = !safeExistsSync(tempMvnParentTree);
+            if (safeExistsSync(tempMvnParentTree)) {
+              const mvnTreeString = readFileSync(tempMvnParentTree, {
+                encoding: "utf-8",
+              });
+              const parsedList = parseMavenTreeJson(mvnTreeString, f);
+              if (!parsedList?.pkgList?.length) {
+                emptyJson = true;
+                // Remove the invalid json file so text output is preferred below.
+                if (safeExistsSync(tempMvnParentTree)) {
+                  safeUnlinkSync(tempMvnParentTree);
+                }
+              }
+            }
+            if (result.status !== 0 || result.error || emptyJson) {
+              findParentComponentArgs = [
+                "dependency:tree",
+                "-N",
+                `-DoutputFile=${tempMvnParentTreeText}`,
+              ];
+              if (addArgs.length) {
+                findParentComponentArgs =
+                  findParentComponentArgs.concat(addArgs);
+              }
+              result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
+                cwd: basePath,
+                shell: isWin,
+              });
+            }
+            if (result.status === 0) {
+              const parentTreeFile = safeExistsSync(tempMvnParentTreeText)
+                ? tempMvnParentTreeText
+                : tempMvnParentTree;
+              if (safeExistsSync(parentTreeFile)) {
+                const mvnTreeString = readFileSync(parentTreeFile, {
+                  encoding: "utf-8",
+                });
+                const parsedList = parentTreeFile.endsWith(".json")
+                  ? parseMavenTreeJson(mvnTreeString, f)
+                  : parseMavenTree(mvnTreeString, f);
+                const dlist = parsedList.pkgList || [];
+                if (dlist.length) {
+                  const tmpParentComponent = dlist.splice(0, 1)[0];
+                  tmpParentComponent.type = "application";
+                  parentComponent = tmpParentComponent;
+                  parentComponent.components = [];
+                  if (parentComponent.name) {
+                    thoughtLog(
+                      `Parent component is called ${parentComponent.name}!`,
+                    );
+                  }
+                }
+              }
+            }
+          }
+          thoughtLog(
+            `**MAVEN**: Let's use Maven to collect packages from ${basePath}.`,
+          );
+          if (DEBUG_MODE) {
+            console.log(
+              `Executing '${basename(mavenCmd)} dependency:tree ...' in ${basePath}`,
+            );
+          }
+          result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
+            cwd: basePath,
+            shell: isWin,
+          });
+          let emptyJson = !safeExistsSync(tempMvnTree);
+          if (safeExistsSync(tempMvnTree)) {
+            const mvnTreeString = readFileSync(tempMvnTree, {
+              encoding: "utf-8",
+            });
+            const parsedList = parseMavenTreeJson(mvnTreeString, f);
+            if (!parsedList?.pkgList?.length) {
+              emptyJson = true;
+              // Remove the invalid json file so text output is preferred below.
+              if (safeExistsSync(tempMvnTree)) {
+                safeUnlinkSync(tempMvnTree);
+              }
+            }
+          }
+          if (result.status !== 0 || result.error || emptyJson) {
+            mvnTreeArgs = [
+              "dependency:tree",
+              `-DoutputFile=${tempMvnTreeText}`,
+            ];
+            if (addArgs.length) {
+              mvnTreeArgs = mvnTreeArgs.concat(addArgs);
+            }
+            if (safeExistsSync(settingsXml)) {
+              mvnTreeArgs.push("-s");
+              mvnTreeArgs.push(settingsXml);
+            }
+            result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
+              cwd: basePath,
+              shell: isWin,
+            });
+          }
+          if (result.status !== 0 || result.error) {
+            possible_misses = true;
+            // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
+            // These could be due to a range of reasons that are covered below.
+            if (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE) {
+              if (result.stdout) {
+                console.log(result.stdout);
+              }
+              if (result.stderr) {
+                console.log(result.stderr);
+                console.log("The above build errors could be due to:\n");
+              }
+              if (
+                result.stdout &&
+                (result.stdout.includes("Non-resolvable parent POM") ||
+                  result.stdout.includes("points at wrong local POM"))
+              ) {
+                console.log(
+                  "1. Check if the pom.xml contains valid settings for parent and modules. Some projects can be built only from a specific directory.",
+                );
+              } else if (
+                result.stdout &&
+                (result.stdout.includes("Could not resolve dependencies") ||
+                  result.stdout.includes(
+                    "no dependency information available",
+                  ) ||
+                  result.stdout.includes(
+                    "The following artifacts could not be resolved",
+                  ))
+              ) {
+                console.log(
+                  "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
+                );
+              } else if (
+                result.stdout?.includes(
+                  "Could not resolve target platform specification",
+                )
+              ) {
+                console.log(
+                  "1. Some projects can be built only from the root directory. Invoke cdxgen with --no-recurse option",
+                );
+              } else {
+                console.log(
+                  "1. Java version requirement: cdxgen container image bundles Java 24 with maven 3.9 which might be incompatible. Try running cdxgen with the custom JDK11-based image `ghcr.io/cdxgen/cdxgen-java11:v13`.",
+                );
+              }
+              console.log(
+                "2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.",
+              );
+              console.log(
+                "3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.",
+              );
+            }
+            // Do not fall back to methods that can produce incomplete results when failOnError is set
+            options.failOnError && process.exit(1);
+            console.log(
+              "\nFalling back to parsing pom.xml files. Only direct dependencies would get included!",
+            );
+            thoughtLog(
+              "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
+            );
+            const pomMap = parsePom(f);
+            const dlist = pomMap?.dependencies || [];
+            if (dlist.length) {
+              pkgList = pkgList.concat(dlist);
+            }
+          } else {
+            const treeFile = safeExistsSync(tempMvnTreeText)
+              ? tempMvnTreeText
+              : tempMvnTree;
+            if (safeExistsSync(treeFile)) {
+              const mvnTreeString = readFileSync(treeFile, {
+                encoding: "utf-8",
+              });
+              const parsedList = treeFile.endsWith(".json")
+                ? parseMavenTreeJson(mvnTreeString, f)
+                : parseMavenTree(mvnTreeString, f);
+              const dlist = parsedList.pkgList || [];
+              const tmpParentComponent = dlist.splice(0, 1)[0];
+              if (tmpParentComponent) {
+                tmpParentComponent.type = "application";
+              }
+              if (dlist.length) {
+                pkgList = pkgList.concat(dlist);
+                if (dlist.length > 1) {
+                  thoughtLog(`Obtained ${dlist.length} components from maven.`);
+                } else {
+                  thoughtLog(
+                    `"Received very few components from the maven dependency tree command for ${basePath}."`,
+                  );
+                }
+              }
+              // Retain the parent hierarchy
+              if (!tmpParentComponent) {
+                thoughtLog(
+                  `No parseable components were found after executing '${basename(mavenCmd)}'.`,
+                );
+              } else if (!Object.keys(parentComponent).length) {
+                parentComponent = tmpParentComponent;
+                parentComponent.components = [];
+              } else {
+                parentComponent.components.push(tmpParentComponent);
+              }
+              if (parsedList?.dependenciesList?.length) {
+                dependencies = mergeDependencies(
+                  dependencies,
+                  parsedList.dependenciesList,
+                  tmpParentComponent,
+                );
+              } else {
+                if (dlist?.length) {
+                  thoughtLog(
+                    `Hmm, I didn't find any dependencies after executing '${basename(mavenCmd)}'. However, I did get ${dlist.length} components, which is confusing.`,
+                  );
+                }
+              }
+            }
+          }
+        } finally {
+          if (!DEBUG_MODE && tempDir?.startsWith(tempRoot)) {
+            safeRmSync(tempDir, { recursive: true, force: true });
+          }
+        }
+      }
+    } // for
+    // Locate and parse all bom.json files from the maven plugin
+    if (!useMavenDepsTree) {
+      for (const abjson of bomJsonFiles) {
+        let bomJsonObj;
+        try {
+          if (DEBUG_MODE) {
+            console.log(`Extracting data from generated bom file ${abjson}`);
+          }
+          bomJsonObj = JSON.parse(
+            readFileSync(abjson, {
+              encoding: "utf-8",
+            }),
+          );
+          if (bomJsonObj) {
+            if (
+              !tools &&
+              bomJsonObj.metadata &&
+              bomJsonObj.metadata.tools &&
+              (Array.isArray(bomJsonObj.metadata.tools) ||
+                bomJsonObj.metadata.tools.components ||
+                bomJsonObj.metadata.tools.services)
+            ) {
+              tools = bomJsonObj.metadata.tools;
+            }
+            const toolRefs = extractToolRefs(
+              bomJsonObj?.metadata?.tools,
+              (tool) => tool?.name !== "cdxgen",
+            );
+            if (
+              bomJsonObj.metadata?.component &&
+              !Object.keys(parentComponent).length
+            ) {
+              parentComponent = bomJsonObj.metadata.component;
+              options.parentComponent = parentComponent;
+            }
+            if (bomJsonObj.components) {
+              // Inject evidence into the components. #994
+              if (options.specVersion >= 1.5) {
+                // maven would usually generate a target directory closest to the pom.xml
+                // I am sure there would be cases where this assumption is not true :)
+                const srcPomFile = join(dirname(abjson), "..", "pom.xml");
+                for (const acomp of bomJsonObj.components) {
+                  if (!acomp.evidence) {
+                    acomp.evidence = {
+                      identity: {
+                        field: "purl",
+                        confidence: 0.8,
+                        methods: [
+                          {
+                            technique: "manifest-analysis",
+                            confidence: 0.8,
+                            value: srcPomFile,
+                          },
+                        ],
+                      },
+                    };
+                  }
+                  if (!acomp.properties) {
+                    acomp.properties = [];
+                  }
+                  acomp.properties.push({
+                    name: "internal:SrcFile",
+                    value: srcPomFile,
+                  });
+                  attachIdentityTools(acomp, toolRefs);
+                }
+              }
+              pkgList = pkgList.concat(bomJsonObj.components);
+            }
+            if (bomJsonObj.dependencies) {
+              dependencies = mergeDependencies(
+                dependencies,
+                bomJsonObj.dependencies,
+                parentComponent,
+              );
+            }
+          }
+        } catch (err) {
+          if (options.failOnError || DEBUG_MODE) {
+            console.log(err);
+            options.failOnError && process.exit(1);
+          }
+        }
+      }
+    }
+    if (possible_misses) {
+      if (gradleFiles.length) {
+        console.log(
+          "Is this a gradle project? Try running cdxgen with `-t gradle`.",
+        );
+      } else if (!DEBUG_MODE) {
+        console.warn(
+          "Multiple errors occurred while building this project with maven. The SBOM is therefore incomplete!",
+        );
+      }
+    }
+  }
+  const allProjects = [];
+  const allProjectsAddedPurls = [];
+  const rootDependsOn = new Set();
+  const gradleModules = new Map();
+  // Determine the root path for gradle
+  // Fixes gradle invocation for microservices-demo
+  let gradleRootPath = path;
+  if (
+    gradleFiles?.length &&
+    !safeExistsSync(join(path, "settings.gradle")) &&
+    !safeExistsSync(join(path, "settings.gradle.kts")) &&
+    !safeExistsSync(join(path, "build.gradle")) &&
+    !safeExistsSync(join(path, "build.gradle.kts"))
+  ) {
+    gradleRootPath = dirname(gradleFiles[0]);
+  }
+  if (safeExistsSync(join(gradleRootPath, "gradle.properties"))) {
+    thoughtLog(
+      "Hmm, there is a gradle.properties file. Do we need any private modules or custom JVM arguments for this project 🤔?",
+    );
+  }
+  // Execute gradle properties
+  if (
+    gradleFiles?.length &&
+    isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    )
+  ) {
+    const wrapperPropPath = join(
+      gradleRootPath,
+      "gradle",
+      "wrapper",
+      "gradle-wrapper.properties",
+    );
+    if (safeExistsSync(wrapperPropPath)) {
+      try {
+        const propContent = readFileSync(wrapperPropPath, "utf-8");
+        const distUrlLine = propContent
+          .split("\n")
+          .find((l) => l.startsWith("distributionUrl="));
+        if (distUrlLine) {
+          const distributionUrl = distUrlLine
+            .split("=")[1]
+            .trim()
+            .replace(/\\:/g, ":");
+          const versionMatch = distributionUrl.match(
+            /gradle-(.*?)-(bin|all)\.zip/,
+          );
+          const gradleVersion = versionMatch ? versionMatch[1] : "unknown";
+          thoughtLog(
+            `Found Gradle wrapper with distributionUrl: ${distributionUrl}, version: ${gradleVersion}`,
+          );
+          if (!tools) {
+            tools = [];
+          }
+          let toolsArr = tools;
+          if (!Array.isArray(toolsArr)) {
+            if (toolsArr.components) {
+              toolsArr = toolsArr.components;
+            } else {
+              toolsArr = [];
+            }
+          }
+          if (!toolsArr.find((c) => c.name === "gradle")) {
+            const distShaLine = propContent
+              .split("\n")
+              .find((l) => l.startsWith("distributionSha256Sum="));
+            let hashes;
+            if (distShaLine) {
+              const sha256Sum = distShaLine.split("=")[1].trim();
+              if (sha256Sum) {
+                hashes = [
+                  {
+                    alg: "SHA-256",
+                    content: sha256Sum,
+                  },
+                ];
+              }
+            }
+            const gradleComponent = {
+              type: "application",
+              group: "org.gradle",
+              name: "gradle",
+              version: gradleVersion,
+              externalReferences: [
+                {
+                  type: "distribution",
+                  url: distributionUrl,
+                },
+              ],
+              isExternal: true,
+            };
+            applyPurl(
+              gradleComponent,
+              mavenPurl("org.gradle", "gradle", gradleVersion, {
+                type: "bin",
+              }),
+            );
+            if (hashes) {
+              gradleComponent.hashes = hashes;
+            }
+            toolsArr.push(gradleComponent);
+          }
+          if (Array.isArray(tools)) {
+            tools = toolsArr;
+          } else {
+            tools.components = toolsArr;
+          }
+        }
+      } catch (_err) {
+        // ignore
+      }
+    }
+    let includedBuilds = [];
+    let allProjectsStr = [];
+    if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")) {
+      includedBuilds = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
+        .split(",")
+        .map((b) => (!b.startsWith(":") ? `:${b}` : b));
+    }
+    const resolveGradleDistribution = isFeatureEnabled(
+      options,
+      "resolve-gradle-distribution",
+    );
+    const gradleInitArgs = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
+      ? []
+      : ["--init-script", GRADLE_INIT_SCRIPT];
+    if (resolveGradleDistribution && gradleInitArgs.length) {
+      gradleInitArgs.push("-PcdxgenResolveDistribution=true");
+    }
+    parallelPropTaskOut = executeParallelGradleProperties(
+      gradleRootPath,
+      [null].concat(includedBuilds),
+      gradleInitArgs,
+    );
+    if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
+      const outputLines = parallelPropTaskOut.split("\n");
+      for (const [_i, line] of outputLines.entries()) {
+        if (line.startsWith("Root project '") || line.startsWith("Project '")) {
+          break;
+        }
+        if (line.startsWith("<CDXGEN:includedBuild>")) {
+          const includedBuild = line.split(">");
+          if (!includedBuilds.includes(includedBuild[1].trim())) {
+            includedBuilds.push(includedBuild[1].trim());
+          }
+        }
+      }
+      if (includedBuilds.length > 0) {
+        thoughtLog(
+          `Wait, this gradle project uses composite builds. I must carefully process these ${includedBuilds.length} projects, in addition to the root.`,
+        );
+        if (DEBUG_MODE) {
+          console.log(`Composite builds: ${includedBuilds.join(" ").trim()}.`);
+        }
+        parallelPropTaskOut = parallelPropTaskOut.concat(
+          "\n",
+          executeParallelGradleProperties(gradleRootPath, includedBuilds),
+        );
+      }
+    }
+    const splitPropTaskOut = splitOutputByGradleProjects(parallelPropTaskOut, [
+      "properties",
+    ]);
+    for (const [key, propTaskOut] of splitPropTaskOut.entries()) {
+      const retMap = parseGradleProperties(propTaskOut);
+      const rootProject = retMap.rootProject;
+      if (rootProject) {
+        const rootComponent = await buildObjectForGradleModule(
+          rootProject,
+          retMap.metadata,
+        );
+        if (!includedBuilds.includes(key)) {
+          parentComponent = rootComponent;
+        }
+        gradleModules.set(key, rootComponent);
+        if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
+          allProjects.push(rootComponent);
+          rootDependsOn.add(rootComponent["bom-ref"]);
+          allProjectsAddedPurls.push(rootComponent["purl"]);
+        }
+        allProjectsStr = allProjectsStr.concat(retMap.projects);
+      }
+    }
+    // Get the sub-project properties and set the root dependencies
+    if (allProjectsStr?.length) {
+      const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+        ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+        : [];
+      if (modulesToSkip.length) {
+        thoughtLog(
+          `Good news. I know there are ${allProjectsStr.length} gradle modules at ${gradleRootPath}. I must skip ${modulesToSkip.length} out of these.`,
+        );
+      }
+      parallelPropTaskOut = executeParallelGradleProperties(
+        gradleRootPath,
+        allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+      );
+      const splitPropTaskOut = splitOutputByGradleProjects(
+        parallelPropTaskOut,
+        ["properties"],
+      );
+
+      for (const subProject of allProjectsStr) {
+        const retMap = parseGradleProperties(
+          splitPropTaskOut.get(subProject),
+          subProject,
+        );
+        const rootSubProject = retMap.rootProject;
+        if (rootSubProject) {
+          const rootSubProjectObj = await buildObjectForGradleModule(
+            rootSubProject === "root" ? subProject : rootSubProject,
+            retMap.metadata,
+          );
+          if (!allProjectsAddedPurls.includes(rootSubProjectObj["purl"])) {
+            allProjects.push(rootSubProjectObj);
+            rootDependsOn.add(rootSubProjectObj["bom-ref"]);
+            allProjectsAddedPurls.push(rootSubProjectObj["purl"]);
+          }
+          gradleModules.set(subProject, rootSubProjectObj);
+        }
+      }
+      // Bug #317 fix
+      parentComponent.components = allProjects.flatMap((s) => {
+        delete s.qualifiers;
+        delete s.evidence;
+        return s;
+      });
+      dependencies.push({
+        ref: parentComponent["bom-ref"],
+        dependsOn: [...rootDependsOn].sort(),
+      });
+    }
+  }
+  if (
+    gradleFiles?.length &&
+    options.installDeps &&
+    isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    )
+  ) {
+    allProjects.push(parentComponent);
+    const gradleCmd = getGradleCommand(gradleRootPath, null);
+    const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
+      ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
+      : "dependencies";
+
+    const gradleSubCommands = [];
+    let modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+      ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+      : [];
+    if (readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES")) {
+      modulesToSkip = modulesToSkip.concat(
+        readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES").split(","),
+      );
+    }
+    if (!modulesToSkip.includes("root")) {
+      gradleSubCommands.push(gradleDepTask);
+    }
+    for (const [key, sp] of gradleModules) {
+      //create single command for dependencies tasks on all subprojects
+      if (sp.purl !== parentComponent.purl && !modulesToSkip.includes(key)) {
+        gradleSubCommands.push(`${key}:${gradleDepTask}`);
+      }
+    }
+    const gradleArguments = buildGradleCommandArguments(
+      readEnvironmentVariable("GRADLE_ARGS")
+        ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
+        : [],
+      gradleSubCommands,
+      readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES")
+        ? readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES").split(" ")
+        : [],
+      gradleCmd.length,
+    );
+    const allOutputs = [];
+    for (const gradleArg of gradleArguments) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Executing ${gradleCmd} with arguments ${gradleArg.join(" ").substring(0, 150)}... in ${gradleRootPath}`,
+        );
+      }
+      thoughtLog(
+        `Let's invoke '${basename(gradleCmd)}' with the arguments '${gradleArg.join(" ").substring(0, 100)} ...'.`,
+      );
+      const finalGradleArg = gradleArg.includes("--info")
+        ? gradleArg
+        : gradleArg.concat(["--info"]);
+      const sresult = safeSpawnSync(gradleCmd, finalGradleArg, {
+        cwd: gradleRootPath,
+        shell: isWin,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+      if (sresult.stdout !== null) {
+        allOutputs.push(sresult.stdout);
+      }
+    }
+    const sstdout = allOutputs.join("\n");
+    if (sstdout) {
+      const cmdOutput = Buffer.from(sstdout).toString();
+      const perProjectOutput = splitOutputByGradleProjects(cmdOutput, [
+        gradleDepTask,
+      ]);
+      for (const key of gradleModules.keys()) {
+        const parsedList = await parseGradleDep(
+          perProjectOutput.has(key) ? perProjectOutput.get(key) : "",
+          key,
+          gradleModules,
+          gradleRootPath,
+        );
+        const dlist = parsedList.pkgList;
+        if (parsedList?.dependenciesList?.length) {
+          dependencies = mergeDependencies(
+            dependencies,
+            parsedList.dependenciesList,
+            parentComponent,
+          );
+        } else {
+          if (dlist?.length) {
+            thoughtLog(
+              `Hmm, I didn't find any dependencies after executing '${basename(gradleCmd)}' for the project ${key}. However, I did get ${dlist.length} components, which is confusing.`,
+            );
+          }
+        }
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+      }
+    }
+    if (pkgList.length) {
+      const fileToUrlMap = parseGradleInfoLogsForUrls(sstdout);
+      // When the `resolve-gradle-distribution` feature flag is enabled, the init script
+      // probes each repository for the actual artifact and emits the resolved URL keyed
+      // by `group:name:version`. This is more accurate than guessing the first repository.
+      const resolvedDistributions =
+        parseGradleResolvedDistributions(parallelPropTaskOut);
+
+      for (const p of pkgList) {
+        if (!p.externalReferences) {
+          p.externalReferences = [];
+        }
+        if (!p.externalReferences.find((r) => r.type === "distribution")) {
+          const groupPath = p.group.replace(/\./g, "/");
+          const matchPath = `${groupPath}/${p.name}/${p.version}/`;
+          let matchedUrl = Object.values(fileToUrlMap).find((url) =>
+            url.includes(matchPath),
+          );
+          if (!matchedUrl) {
+            matchedUrl =
+              resolvedDistributions[`${p.group}:${p.name}:${p.version}`];
+          }
+          if (matchedUrl) {
+            p.externalReferences.push({
+              type: "distribution",
+              url: matchedUrl,
+            });
+          }
+        }
+      }
+      if (parentComponent.components?.length) {
+        for (const subProj of parentComponent.components) {
+          pkgList = pkgList.filter(
+            (pkg) =>
+              pkg["bom-ref"] !== subProj["bom-ref"] &&
+              pkg["bom-ref"] !== parentComponent["bom-ref"],
+          );
+        }
+      }
+      thoughtLog(
+        `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`,
+      );
+      if (DEBUG_MODE) {
+        console.log("Obtained", pkgList.length, "from this gradle project.");
+      }
+    } else {
+      thoughtLog(
+        "**GRADLE:** SBOM is incomplete. I recommend troubleshooting the issue to improve the BOM precision.",
+      );
+      if (!DEBUG_MODE) {
+        console.log(
+          "No packages found. Set the environment variable 'CDXGEN_DEBUG_MODE=debug' to troubleshoot any gradle related errors.",
+        );
+      }
+      options.failOnError && process.exit(1);
+    }
+    if (
+      (!readEnvironmentVariable("GRADLE_STOP_DAEMON") &&
+        (!readEnvironmentVariable("GRADLE_USE_DAEMON") ||
+          ["true", "1"].includes(
+            readEnvironmentVariable("GRADLE_USE_DAEMON"),
+          ))) ||
+      ["true", "1"].includes(readEnvironmentVariable("GRADLE_STOP_DAEMON"))
+    ) {
+      if (DEBUG_MODE) {
+        console.log("Stopping gradle daemon...");
+      }
+      const sresult = safeSpawnSync(gradleCmd, ["--stop"], {
+        cwd: gradleRootPath,
+        shell: isWin,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+    }
+    // Should we attempt to resolve class names
+    if (options.resolveClass || options.deep) {
+      const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
+      if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+        jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+      }
+    }
+  }
+
+  // Bazel
+  // Look for the BUILD file only in the root directory
+  // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
+  const bazelFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}{WORKSPACE{,.bazel},MODULE.bazel}`,
+    options,
+  );
+  if (
+    bazelFiles?.length &&
+    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
+    isPackageManagerAllowed(
+      "bazel",
+      ["maven", "gradle", "sbt", "mill"],
+      options,
+    )
+  ) {
+    let BAZEL_CMD = "bazel";
+    const bazelHome = readEnvironmentVariable("BAZEL_HOME");
+    if (bazelHome) {
+      BAZEL_CMD = join(bazelHome, "bin", "bazel");
+    }
+
+    // bzlmod: parse MODULE.bazel and MODULE.bazel.lock for BCR modules and
+    // ecosystem dependencies (Maven, etc.). This works from the manifest and
+    // lock alone, so BCR/Maven packages are extracted even when the bazel
+    // toolchain is absent. Resolved third-party deps map to their true
+    // ecosystem purl (pkg:maven, ...); only BCR modules use pkg:bazel.
+    const moduleBazelFiles = bazelFiles.filter(
+      (f) => basename(f) === "MODULE.bazel",
+    );
+    for (const moduleFile of moduleBazelFiles) {
+      const baseDir = dirname(moduleFile);
+      const moduleResult = parseModuleBazel(moduleFile);
+      if (moduleResult.pkgList?.length) {
+        pkgList = pkgList.concat(moduleResult.pkgList);
+      }
+      if (moduleResult.parentComponent?.name) {
+        parentComponent = moduleResult.parentComponent;
+      }
+      const lockFile = join(baseDir, "MODULE.bazel.lock");
+      if (safeExistsSync(lockFile)) {
+        const lockResult = parseModuleBazelLock(lockFile);
+        if (lockResult.pkgList?.length) {
+          pkgList = pkgList.concat(lockResult.pkgList);
+        }
+        if (lockResult.dependencies?.length) {
+          dependencies = mergeDependencies(
+            dependencies,
+            lockResult.dependencies,
+          );
+        }
+      }
+    }
+
+    // Querying bazel means building the project first, which is the most
+    // expensive thing cdxgen can do and needs network access. Like every other
+    // package-manager invocation it therefore runs only when dependency
+    // installation is permitted; `--lifecycle pre-build` and secure mode both
+    // turn it off, leaving the manifest and lock as the inventory source.
+    for (const f of options.installDeps ? bazelFiles : []) {
+      const basePath = dirname(f);
+      // Invoke bazel build first
+      const bazelTarget = readEnvironmentVariable("BAZEL_TARGET") || "//...";
+      let bArgs = [
+        ...(readEnvironmentVariable("BAZEL_ARGS")?.split(" ") || []),
+        "build",
+        bazelTarget,
+      ];
+      // Automatically load any bazelrc file
+      if (
+        !readEnvironmentVariable("BAZEL_ARGS") &&
+        safeExistsSync(join(basePath, ".bazelrc"))
+      ) {
+        bArgs = ["--bazelrc=.bazelrc", "build", bazelTarget];
+      }
+      console.log("Executing", BAZEL_CMD, "in", basePath);
+      let result = safeSpawnSync(BAZEL_CMD, bArgs, {
+        cwd: basePath,
+        shell: isWin,
+      });
+      if (result.status !== 0 || result.error) {
+        if (result.stderr) {
+          console.error(result.stdout, result.stderr);
+        }
+        console.log(
+          "1. Check if bazel is installed and available in PATH.\n2. Try building your app with bazel prior to invoking cdxgen",
+        );
+        options.failOnError && process.exit(1);
+      } else {
+        const target = readEnvironmentVariable("BAZEL_TARGET") || "//...";
+        let query = [
+          ...(readEnvironmentVariable("BAZEL_ARGS")?.split(" ") || []),
+        ];
+        let bazelParser;
+        // Automatically load any bazelrc file
+        if (
+          !readEnvironmentVariable("BAZEL_ARGS") &&
+          safeExistsSync(join(basePath, ".bazelrc"))
+        ) {
+          query = ["--bazelrc=.bazelrc"];
+        }
+        if (
+          ["true", "1"].includes(
+            readEnvironmentVariable("BAZEL_USE_ACTION_GRAPH"),
+          )
+        ) {
+          query = query.concat(["query", `deps(${target})`, "--output=label"]);
+          bazelParser = parseBazelActionGraph;
+        } else {
+          query = query.concat([
+            "aquery",
+            "--output=textproto",
+            "--skyframe_state",
+          ]);
+          bazelParser = parseBazelSkyframe;
+        }
+        console.log("Executing", BAZEL_CMD, `${query.join(" ")} in`, basePath);
+        result = safeSpawnSync(BAZEL_CMD, query, {
+          cwd: basePath,
+        });
+        if (result.status !== 0 || result.error) {
+          console.error(result.stdout, result.stderr);
+          options.failOnError && process.exit(1);
+        }
+        const stdout = result.stdout;
+        if (stdout) {
+          const cmdOutput = Buffer.from(stdout).toString();
+          const dlist = bazelParser(cmdOutput);
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          } else {
+            console.log(
+              "No packages were detected.\n1. Build your project using bazel build command before running cdxgen\n2. Try running the bazel aquery command manually to see if skyframe state can be retrieved.",
+            );
+            console.log(
+              "If your project requires a different query, please file a bug at cyclonedx/cdxgen repo!",
+            );
+            options.failOnError && process.exit(1);
+          }
+        } else {
+          console.log("Bazel unexpectedly didn't produce any output");
+          options.failOnError && process.exit(1);
+        }
+      }
+    }
+  }
+
+  // scala sbt
+  // Identify sbt projects via its `project` directory:
+  // - all SBT project _should_ define build.properties file with sbt version info
+  // - SBT projects _typically_ have some configs/plugins defined in .sbt files
+  // - SBT projects that are still on 0.13.x, can still use the old approach,
+  //   where configs are defined via Scala files
+  // Detecting one of those should be enough to determine an SBT project.
+  let sbtProjectFiles = getAllFiles(
+    path,
+    `${
+      options.multiProject ? "**/" : ""
+    }project/{build.properties,*.sbt,*.scala}`,
+    options,
+  );
+
+  let sbtProjects = [];
+  for (const i in sbtProjectFiles) {
+    // parent dir of sbtProjectFile is the `project` directory
+    // parent dir of `project` is the sbt root project directory
+    const baseDir = dirname(dirname(sbtProjectFiles[i]));
+    sbtProjects = sbtProjects.concat(baseDir);
+  }
+
+  // Fallback in case sbt's project directory is non-existent
+  if (!sbtProjects.length) {
+    sbtProjectFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}*.sbt`,
+      options,
+    );
+    for (const i in sbtProjectFiles) {
+      const baseDir = dirname(sbtProjectFiles[i]);
+      sbtProjects = sbtProjects.concat(baseDir);
+    }
+  }
+  // eliminate duplicates and ignore project directories
+  sbtProjects = [...new Set(sbtProjects)].filter(
+    (p) => !p.endsWith(`${sep}project`) && !p.includes(`target${sep}`),
+  );
+  const sbtLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}build.sbt.lock`,
+    options,
+  );
+  const tempCacheDir = safeMkdtempSync(join(getTmpDir(), "sbt-cache-"));
+  safeMkdirSync(tempCacheDir, { recursive: true });
+  if (
+    sbtProjects?.length &&
+    isPackageManagerAllowed(
+      "sbt",
+      ["bazel", "maven", "gradle", "mill"],
+      options,
+    )
+  ) {
+    // If the project use sbt lock files
+    if (sbtLockFiles?.length) {
+      for (const f of sbtLockFiles) {
+        const dlist = await parseSbtLock(f);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+      }
+    } else {
+      const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
+      let sbtVersion = determineSbtVersion(path);
+      // If can't find sbt version at the root of repository then search in
+      // sbt project array too because sometimes the project folder isn't at
+      // root of repository
+      if (sbtVersion == null) {
+        for (const i in sbtProjects) {
+          sbtVersion = determineSbtVersion(sbtProjects[i]);
+          if (sbtVersion != null) {
+            break;
+          }
+        }
+      }
+      if (DEBUG_MODE) {
+        console.log(`Detected sbt version: ${sbtVersion}`);
+      }
+      // Introduced in 1.2.0 https://www.scala-sbt.org/1.x/docs/sbt-1.2-Release-Notes.html#addPluginSbtFile+command,
+      // however working properly for real only since 1.3.4: https://github.com/sbt/sbt/releases/tag/v1.3.4
+      const standalonePluginFile =
+        sbtVersion != null &&
+        gte(sbtVersion, "1.3.4") &&
+        lte(sbtVersion, "1.4.0");
+      const useSlashSyntax = !sbtVersion || gte(sbtVersion, "1.5.0");
+      const isDependencyTreeBuiltIn =
+        sbtVersion != null && gte(sbtVersion, "1.4.0");
+      const tempDir = safeMkdtempSync(join(getTmpDir(), "cdxsbt-"));
+      const tempSbtgDir = safeMkdtempSync(join(getTmpDir(), "cdxsbtg-"));
+      safeMkdirSync(tempSbtgDir, { recursive: true });
+      // Create temporary plugins file
+      const tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
+
+      // Requires a custom version of `sbt-dependency-graph` that
+      // supports `--append` for `toFile` subtask.
+      let sbtPluginDefinition = `\naddSbtPlugin("io.shiftleft" % "sbt-dependency-graph" % "0.10.0-append-to-file3")\n`;
+      if (isDependencyTreeBuiltIn) {
+        sbtPluginDefinition = "\naddDependencyTreePlugin\n";
+        if (DEBUG_MODE) {
+          console.log("Using addDependencyTreePlugin as the custom plugin");
+        }
+      }
+      safeWriteSync(tempSbtPlugins, sbtPluginDefinition);
+      let sbtExtraArgs = "";
+      const env = { ...process.env };
+      // We need to collect the jars from the cache
+      if (options.deep) {
+        sbtExtraArgs = " updateClassifiers";
+        env["COURSIER_CACHE"] = tempCacheDir;
+        env["SBT_IVY_HOME"] = tempCacheDir;
+      }
+      for (const i in sbtProjects) {
+        const basePath = sbtProjects[i];
+        const dlFile = join(tempDir, `dl-${i}.tmp`);
+        let sbtArgs = [];
+        let pluginFile = null;
+        const subDlFiles = [];
+        if (standalonePluginFile) {
+          sbtArgs = [
+            `-addPluginSbtFile=${tempSbtPlugins}`,
+            `"dependencyList::toFile ${dlFile} --force"`,
+          ];
+          subDlFiles.push(dlFile);
+        } else {
+          // write to the existing plugins file
+          // Discover the real sbt project ids by asking sbt itself, falling
+          // back to the regex-based heuristic if that fails. A per-subproject
+          // `dependencyTree` fan-out yields a far more complete tree than a
+          // single root resolution (which only captures the root project's own
+          // libraryDependencies). See https://github.com/cdxgen/cdxgen/issues/4291
+          const subprojects = discoverSbtProjectsFromCmd(
+            basePath,
+            SBT_CMD,
+            env,
+          );
+          if (subprojects.length > 0 && useSlashSyntax) {
+            sbtArgs = [
+              `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs}`,
+            ];
+            for (const sp of subprojects) {
+              const subDlFile = join(tempDir, `dl-${i}-${sp}.tmp`);
+              subDlFiles.push(subDlFile);
+              sbtArgs.push(
+                `"${sp}/dependencyTree / toFile ${subDlFile} --force"`,
+              );
+            }
+          } else if (useSlashSyntax) {
+            sbtArgs = [
+              `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs} "dependencyTree / toFile ${dlFile} --force"`,
+            ];
+            subDlFiles.push(dlFile);
+          } else {
+            sbtArgs = [
+              `'set asciiGraphWidth in ThisBuild := 800'${sbtExtraArgs} "dependencyTree::toFile ${dlFile} --force"`,
+            ];
+            subDlFiles.push(dlFile);
+          }
+          pluginFile = addPlugin(basePath, sbtPluginDefinition);
+        }
+        // Run sbt in non-interactive batch mode so it never blocks waiting for
+        // input on stdin (which can otherwise appear as an indefinite hang) and
+        // does not emit ANSI colour codes into the dependency tree output.
+        sbtArgs = ["-batch", "-no-colors", ...sbtArgs];
+        console.log(
+          "Executing",
+          SBT_CMD,
+          sbtArgs.join(" "),
+          "in",
+          basePath,
+          "using plugins",
+          tempSbtgDir,
+        );
+        // Note that the command has to be invoked with `shell: true` to properly execut sbt
+        const result = safeSpawnSync(SBT_CMD, sbtArgs, {
+          cwd: basePath,
+          shell: true,
+          env,
+        });
+        if (result.status !== 0 || result.error) {
+          console.error(result.stdout, result.stderr);
+          console.log(
+            "1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.",
+          );
+          console.log(
+            "2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment",
+          );
+          console.log(
+            "3. Consider creating a lockfile using sbt-dependency-lock plugin. See https://github.com/stringbean/sbt-dependency-lock",
+          );
+          options.failOnError && process.exit(1);
+        }
+        if (!standalonePluginFile) {
+          cleanupPlugin(basePath, pluginFile);
+        }
+        const sbtSubprojectRoots = [];
+        for (const subDlFile of subDlFiles) {
+          if (safeExistsSync(subDlFile)) {
+            const retMap = await parseSbtTree(subDlFile);
+            if (retMap.pkgList?.length) {
+              const tmpParentComponent = retMap.pkgList.splice(0, 1)[0];
+              tmpParentComponent.type = "application";
+              pkgList = pkgList.concat(retMap.pkgList);
+              pkgList.push(tmpParentComponent);
+              sbtSubprojectRoots.push(tmpParentComponent);
+            }
+            if (retMap.dependenciesList) {
+              dependencies = mergeDependencies(
+                dependencies,
+                retMap.dependenciesList,
+                parentComponent,
+              );
+            }
+          } else {
+            if (options.failOnError || DEBUG_MODE) {
+              console.log(`sbt dependencyList did not yield ${subDlFile}`);
+            }
+            options.failOnError && process.exit(1);
+          }
+        }
+        // Construct a synthetic root component from build.sbt name/org/version
+        // that aggregates all subproject roots as its direct dependencies.
+        const sbtRoot = parseSbtRootProject(basePath);
+        if (sbtRoot && sbtSubprojectRoots.length > 0) {
+          const rootPurl = build({
+            type: "maven",
+            namespace: sbtRoot.group || null,
+            name: sbtRoot.name,
+            version: sbtRoot.version || null,
+            qualifiers: { type: "jar" } || null,
+          });
+          const rootComponent = {
+            group: sbtRoot.group,
+            name: sbtRoot.name,
+            version: sbtRoot.version,
+            type: "application",
+            purl: rootPurl,
+            "bom-ref": decodeURIComponent(rootPurl),
+          };
+          parentComponent = rootComponent;
+          dependencies.push({
+            ref: decodeURIComponent(rootPurl),
+            dependsOn: sbtSubprojectRoots
+              .map((c) => c["bom-ref"])
+              .filter(Boolean),
+          });
+        } else if (sbtSubprojectRoots.length > 0 && !parentComponent) {
+          parentComponent = sbtSubprojectRoots[0];
+        }
+      }
+
+      // Cleanup
+      safeUnlinkSync(tempSbtPlugins);
+    } // else
+
+    if (DEBUG_MODE) {
+      console.log(`Found ${pkgList.length} packages`);
+    }
+    // Should we attempt to resolve class names
+    if (options.resolveClass || options.deep) {
+      const tmpjarNSMapping = await collectJarNS(tempCacheDir);
+      if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+        jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+      }
+      // sbt can store jars in the target directory
+      const jarNSData = await createJarBom(path, options);
+      if (jarNSData?.bomJson?.components) {
+        pkgList = pkgList.concat(jarNSData?.bomJson?.components);
+        const targetJarNSMapping = {};
+        for (const p of jarNSData.bomJson.components) {
+          if (!p?.purl || !p?.properties?.length) {
+            continue;
+          }
+          const nsProp = p.properties.filter(
+            (prop) => prop.name === "internal:Namespaces",
+          );
+          if (nsProp.length) {
+            targetJarNSMapping[p.purl] = nsProp[0].value;
+          }
+        }
+        jarNSMapping = { ...jarNSMapping, ...targetJarNSMapping };
+      }
+    }
+  }
+  if (tempCacheDir?.startsWith(getTmpDir())) {
+    safeRmSync(tempCacheDir, {
+      recursive: true,
+      force: true,
+    });
+  }
+
+  if (
+    millFiles?.length &&
+    isPackageManagerAllowed(
+      "mill",
+      ["bazel", "sbt", "gradle", "maven"],
+      options,
+    )
+  ) {
+    const millRootPath = dirname(millFiles[0]);
+    parentComponent = createDefaultParentComponent(
+      millRootPath,
+      "maven",
+      options,
+    );
+    const millCmd = getMillCommand(millRootPath);
+    const millCommonArgs = [
+      "--color",
+      "false",
+      "--disable-callgraph",
+      "--disable-prompt",
+      "--keep-going",
+      "--silent",
+    ];
+    if (!["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) {
+      millCommonArgs.unshift("--no-server");
+    }
+    const millArgs = [...millCommonArgs, "__.ivyDepsTree"];
+    if (DEBUG_MODE) {
+      console.log("Executing", millCmd, "in", millRootPath);
+    }
+    let sresult = safeSpawnSync(millCmd, millArgs, {
+      cwd: millRootPath,
+      shell: isWin,
+      maxBuffer: MAX_BUFFER * 10,
+    });
+    if (sresult.status !== 0 || sresult.error) {
+      if (options.failOnError || DEBUG_MODE) {
+        console.error(sresult.stdout, sresult.stderr);
+      }
+      options.failOnError && process.exit(1);
+    }
+    const millResolveArgs = [...millCommonArgs, "resolve", "__.ivyDepsTree"];
+    if (DEBUG_MODE) {
+      console.log(
+        "Executing",
+        millCmd,
+        millResolveArgs.join(" "),
+        "in",
+        millRootPath,
+      );
+    }
+    sresult = safeSpawnSync(millCmd, millResolveArgs, {
+      cwd: millRootPath,
+      shell: isWin,
+    });
+    if (sresult.status !== 0 || sresult.error) {
+      if (options.failOnError || DEBUG_MODE) {
+        console.error(sresult.stdout, sresult.stderr);
+      }
+      options.failOnError && process.exit(1);
+    }
+    const sstdout = sresult.stdout;
+    if (sstdout) {
+      parentComponent.components = [];
+      const modules = sstdout
+        .trim()
+        .split("\n")
+        .map((a) => a.substring(0, a.lastIndexOf(".")))
+        .filter((a) =>
+          ["true", "1"].includes(readEnvironmentVariable("MILL_EXCLUDE_TEST"))
+            ? !a.endsWith(".test")
+            : true,
+        );
+      const moduleBomRefs = [];
+      const packages = new Map();
+      const relations = new Map();
+      relations.set(parentComponent["bom-ref"], []);
+      for (const module of modules) {
+        moduleBomRefs.push(
+          parseMillDependency(module, packages, relations, millRootPath),
+        );
+      }
+      for (const module of moduleBomRefs) {
+        parentComponent.components.push(packages.get(module));
+        relations.get(parentComponent["bom-ref"]).push(module);
+        packages.delete(module);
+      }
+      const newDependencies = [];
+      for (const [ref, dependsOn] of relations.entries()) {
+        newDependencies.push({
+          ref,
+          dependsOn,
+        });
+      }
+      if (DEBUG_MODE) {
+        console.log(
+          `Obtained ${packages.size} components and ${relations.size} dependencies from mill.`,
+        );
+      }
+      pkgList = pkgList.concat(...packages.values());
+      dependencies = mergeDependencies(
+        dependencies,
+        newDependencies,
+        parentComponent,
+      );
+    }
+    if (
+      (!readEnvironmentVariable("MILL_SHUTDOWN_SERVER") &&
+        ["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) ||
+      ["true", "1"].includes(readEnvironmentVariable("MILL_SHUTDOWN_SERVER"))
+    ) {
+      if (DEBUG_MODE) {
+        console.log("Shutting down mill server...");
+      }
+      const sresult = safeSpawnSync(millCmd, ["shutdown"], {
+        cwd: millRootPath,
+        shell: isWin,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+    }
+  }
+
+  pkgList = trimComponents(pkgList);
+  pkgList = await getMvnMetadata(pkgList, jarNSMapping, options.deep);
+  return buildBomNSData(options, pkgList, "maven", {
+    src: path,
+    nsMapping: jarNSMapping,
+    dependencies,
+    parentComponent,
+    tools,
+  });
+}