@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/ecosystems/parsers-jvm.js

@@ -5,6 +5,7 @@ import { build } from "@cdxgen/cdx-purl";
 import { parseEDNString } from "edn-data";
 
 import { readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { includeMavenTestScope } from "../core/env.js";
 import { thoughtLog } from "../core/logger.js";
 import { applyPurl } from "../inventory/purl.js";
@@ -309,6 +310,14 @@ export function parseMavenTreeJson(rawOutput, pomFile) {
     try {
       rootNode = JSON.parse(rawOutput);
     } catch (_err) {
+      recordDegradation("jvm.maven.tree-unparseable", {
+        ecosystem: "java",
+        tool: "maven",
+        impact: "transitive-deps",
+        path: pomFile,
+        detail:
+          "The maven dependency:tree JSON output could not be parsed, so the text output is parsed instead.",
+      });
       thoughtLog("Unable to parse Maven dependency:tree JSON output");
       return {};
     }

package/lib/ecosystems/parsers-misc.js

@@ -8,7 +8,6 @@ import {
   relative,
   resolve,
 } from "node:path";
-import process from "node:process";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
@@ -18,6 +17,8 @@ import {
   DEBUG_MODE,
   readEnvironmentVariable,
 } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
 import {
   safeExistsSync,
@@ -2652,6 +2653,15 @@ export function executePodCommand(parameters, path, options) {
       );
     }
     if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+      recordDegradation("cocoa.pods.missing", {
+        ecosystem: "cocoa",
+        tool: "pod",
+        impact: "transitive-deps",
+        command: `pod ${parameters.join(" ")}`,
+        exitCode: typeof result.status === "number" ? result.status : undefined,
+        detail:
+          "The pod command did not succeed, so the cocoapods dependency graph was not resolved.",
+      });
       console.log(
         "Consider using the cdxgen container image (`ghcr.io/cdxgen/cdxgen`), which includes cocoapods and additional build tools.",
       );
@@ -2667,7 +2677,11 @@ export function executePodCommand(parameters, path, options) {
       if (result.stderr) {
         console.log(result.stderr);
       }
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "cocoa",
+        tool: "pod",
+        detail: "the pod command failed",
+      });
     }
   }
   return result;

package/lib/ecosystems/parsers-python.js

@@ -8,6 +8,7 @@ import toml from "@iarna/toml";
 import { parse as _load } from "yaml";
 
 import { DEBUG_MODE } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { PYTHON_STD_MODULES } from "../core/state.js";
 import { tryBuildPurl } from "../inventory/purl.js";
@@ -27,6 +28,41 @@ import {
   normalizePyLockRegistry,
 } from "./pylockutils.js";
 
+/**
+ * TOML lock files a specific Python manager owns, mapped to the manager and
+ * the remediation id that ranks its repair. The failing file itself is the
+ * detection: the lock command that regenerates it belongs to the manager
+ * that wrote it.
+ *
+ * @type {Record<string, {manager: string, remediationId: string}>}
+ */
+const PY_LOCKFILE_DEGRADATIONS = {
+  "uv.lock": {
+    manager: "uv",
+    remediationId: "python.lockfile-unparseable.uv",
+  },
+  "poetry.lock": {
+    manager: "poetry",
+    remediationId: "python.lockfile-unparseable.poetry",
+  },
+  "pdm.lock": {
+    manager: "pdm",
+    remediationId: "python.lockfile-unparseable.pdm",
+  },
+};
+
+/**
+ * The repair for a TOML lock file that names no single manager, such as
+ * PEP 751's `pylock.toml`. Its lock command carries the manager variable, so
+ * the shaping fills in whichever manager the project turns out to use.
+ *
+ * @type {{manager: string, remediationId: string}}
+ */
+const GENERIC_PY_LOCKFILE_DEGRADATION = {
+  manager: "python",
+  remediationId: "python.lockfile-unparseable",
+};
+
 /**
  * Method to parse python requires_dist attribute found in pypi setup.py
  *
@@ -444,7 +480,12 @@ export function parsePyProjectTomlFile(tomlFile) {
     for (const agroup of Object.keys(tomlData["dependency-groups"])) {
       tomlData["dependency-groups"][agroup].forEach((p) => {
         if (typeof p === "string" || p instanceof String) {
-          const pname = p.split(/(==|<=|~=|>=)/)[0].split(" ")[0];
+          const pname = normalizePythonDependencyKey(
+            p.split(/(==|<=|~=|>=)/)[0].split(" ")[0],
+          );
+          if (!pname) {
+            return;
+          }
           if (!groupDepsKeys[pname]) {
             groupDepsKeys[pname] = [];
           }
@@ -466,8 +507,13 @@ export function parsePyProjectTomlFile(tomlFile) {
   }
   if (tomlData?.tool?.poetry?.dependencies) {
     for (const adep of Object.keys(tomlData?.tool?.poetry?.dependencies)) {
+      // poetry keys keep the author's casing (Click = "^8.1"), while every
+      // consumer of directDepsKeys looks entries up with the normalised
+      // (lowercase, hyphenated) package name, so normalise at the source.
+      const poetryDepKey = normalizePythonDependencyKey(adep);
       if (
-        ![
+        !poetryDepKey ||
+        [
           "python",
           "py",
           "pytest",
@@ -475,43 +521,50 @@ export function parsePyProjectTomlFile(tomlFile) {
           "ruff",
           "setuptools",
           "bandit",
-        ].includes(adep)
+        ].includes(poetryDepKey)
       ) {
-        directDepsKeys[adep] = true;
-        const poetryDependency = tomlData.tool.poetry.dependencies[adep];
-        if (poetryDependency?.git) {
-          recordPythonDependencySource(
-            dependencySourceMap,
-            adep,
-            "git",
-            poetryDependency.git,
-          );
-        } else if (poetryDependency?.url) {
-          recordPythonDependencySource(
-            dependencySourceMap,
-            adep,
-            "url",
-            poetryDependency.url,
-          );
-        } else if (poetryDependency?.path) {
-          recordPythonDependencySource(
-            dependencySourceMap,
-            adep,
-            "path",
-            poetryDependency.path,
-          );
-        }
+        continue;
+      }
+      directDepsKeys[poetryDepKey] = true;
+      const poetryDependency = tomlData.tool.poetry.dependencies[adep];
+      if (poetryDependency?.git) {
+        recordPythonDependencySource(
+          dependencySourceMap,
+          adep,
+          "git",
+          poetryDependency.git,
+        );
+      } else if (poetryDependency?.url) {
+        recordPythonDependencySource(
+          dependencySourceMap,
+          adep,
+          "url",
+          poetryDependency.url,
+        );
+      } else if (poetryDependency?.path) {
+        recordPythonDependencySource(
+          dependencySourceMap,
+          adep,
+          "path",
+          poetryDependency.path,
+        );
       }
     } // for
+    // Group keys are matched against the normalised package names from the
+    // lock file, so they are normalised here too.
     if (tomlData?.tool?.poetry?.group) {
       for (const agroup of Object.keys(tomlData.tool.poetry.group)) {
         for (const adep of Object.keys(
           tomlData.tool.poetry.group[agroup]?.dependencies,
         )) {
-          if (!groupDepsKeys[adep]) {
-            groupDepsKeys[adep] = [];
+          const poetryGroupDepKey = normalizePythonDependencyKey(adep);
+          if (!poetryGroupDepKey) {
+            continue;
           }
-          groupDepsKeys[adep].push(agroup);
+          if (!groupDepsKeys[poetryGroupDepKey]) {
+            groupDepsKeys[poetryGroupDepKey] = [];
+          }
+          groupDepsKeys[poetryGroupDepKey].push(agroup);
           const poetryDependency =
             tomlData.tool.poetry.group[agroup]?.dependencies?.[adep];
           if (poetryDependency?.git) {
@@ -780,7 +833,27 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
     dependencySourceMap = pyProjMap.dependencySourceMap || {};
     parentComponent = pyProjMap.parentComponent;
     workspacePaths = pyProjMap.workspacePaths;
-    if (workspacePaths?.length) {
+    // `parsePyProjectTomlFile` reports a parse failure and returns an empty map, so a
+    // pyproject.toml this parser cannot read leaves `parentComponent` undefined while
+    // the lock file still declares workspaces. Building the workspace tree then throws
+    // on the first dereference and takes the whole SBOM with it. Degrade to a flattened
+    // tree instead - the caller supplies its own parent component, so the components
+    // themselves are still reported.
+    if (workspacePaths?.length && !parentComponent) {
+      console.log(
+        `Unable to read a parent component from ${pyProjectFile}, so the workspace structure declared in ${basename(lockFile)} cannot be reconstructed.`,
+      );
+      console.log(
+        "The dependency tree in the generated SBOM will be flattened and therefore incorrect.",
+      );
+      recordDegradation("python.pyproject-unparseable", {
+        ecosystem: "python",
+        impact: "transitive-deps",
+        path: pyProjectFile,
+        detail: `${basename(pyProjectFile)} could not be parsed, so the workspace structure declared in ${basename(lockFile)} was not reconstructed.`,
+      });
+    }
+    if (workspacePaths?.length && parentComponent) {
       if (!hasWorkspaces) {
         hasWorkspaces = true;
       }
@@ -840,7 +913,12 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
               ] = awpyproj;
             }
           }
-          const wparentComponentRef = wcompMap.parentComponent["bom-ref"];
+          // The block above already treats an unreadable workspace pyproject.toml as
+          // tolerable, so this must not dereference the component it skipped. A
+          // workspace member whose manifest cannot be parsed contributes no parent
+          // ref, and recording `undefined` as the parent of its dependencies would
+          // corrupt the tree for the members that did parse.
+          const wparentComponentRef = wcompMap?.parentComponent?.["bom-ref"];
           if (wcompMap?.dependencySourceMap) {
             Object.assign(
               workspaceDependencySourceMap,
@@ -848,7 +926,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
             );
           }
           // Track the parents of workspace direct dependencies
-          if (wcompMap?.directDepsKeys) {
+          if (wcompMap?.directDepsKeys && wparentComponentRef) {
             for (const wdd of Object.keys(wcompMap?.directDepsKeys)) {
               if (!pkgParentMap[wdd]) {
                 pkgParentMap[wdd] = [];
@@ -865,6 +943,20 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
     lockTomlObj = toml.parse(lockData);
   } catch (err) {
     if (lockFile) {
+      // The failing file names the manager whose lock command regenerates
+      // it. A standards-named lock file (PEP 751 `pylock.toml`) belongs to
+      // no single manager, so it falls back to the generic repair, whose
+      // lock command the shaping resolves from whichever manager the
+      // project turns out to use.
+      const degradation =
+        PY_LOCKFILE_DEGRADATIONS[basename(lockFile)] ||
+        GENERIC_PY_LOCKFILE_DEGRADATION;
+      recordDegradation(degradation.remediationId, {
+        ecosystem: "python",
+        impact: "transitive-deps",
+        path: lockFile,
+        detail: `The ${degradation.manager} lock file could not be parsed, so no locked versions were captured from it.`,
+      });
       console.log(`Error while parsing the lock file ${lockFile}.`, err);
     } else {
       console.log("Error while parsing the lock data as toml", err);
@@ -1218,6 +1310,38 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       }
     }
   }
+  // Seed the parent component's first-level edges from the manifest. Lock
+  // files describe the resolved closure but do not say which of the locked
+  // packages the root project directly depends on; parsePyProjectTomlFile
+  // derived that set into directDepsKeys from [project.dependencies] /
+  // [tool.poetry.dependencies]. Only packages that are locked resolve to a
+  // bom-ref here, so the seeded edge never dangles and dev-group or
+  // unresolved dependencies stay out of the first level. Seeding
+  // depsMap (instead of pushing into dependenciesList) lets the
+  // materialisation below apply its usual ref resolution and sorting.
+  if (parentComponent?.["bom-ref"] && Object.keys(directDepsKeys).length) {
+    const rootRef = parentComponent["bom-ref"];
+    const rootDeps = new Set();
+    for (const depKey of Object.keys(directDepsKeys)) {
+      const depRef =
+        existingPkgMap[depKey] ||
+        existingPkgMap[depKey.replaceAll("-", "_")] ||
+        existingPkgMap[`py${depKey}`];
+      if (depRef && depRef !== rootRef) {
+        rootDeps.add(depRef);
+      }
+    }
+    if (rootDeps.size) {
+      const existingRootDeps = depsMap[rootRef];
+      if (existingRootDeps) {
+        for (const adep of rootDeps) {
+          existingRootDeps.add(adep);
+        }
+      } else {
+        depsMap[rootRef] = rootDeps;
+      }
+    }
+  }
   for (const key of Object.keys(depsMap)) {
     const dependsOnList = new Set();
     const parentPkg = pkgBomRefMap[key];
@@ -1921,8 +2045,20 @@ export function parsePixiTomlFile(pixiToml) {
   pkg.name = projectData.name;
   pkg.version = projectData.version;
   // pkg.authors = tomlData['project']['authors'];
-  pkg.homepage = projectData.homepage;
-  pkg.repository = projectData.repository;
+  // The parent component only gets `cleanParentComponent`, which converts the
+  // transient `{ url }` shape — raw strings would be dropped silently, so
+  // emit external references directly instead.
+  if (projectData.homepage) {
+    pkg.externalReferences = pkg.externalReferences || [];
+    pkg.externalReferences.push({
+      type: "website",
+      url: projectData.homepage,
+    });
+  }
+  if (projectData.repository) {
+    pkg.externalReferences = pkg.externalReferences || [];
+    pkg.externalReferences.push({ type: "vcs", url: projectData.repository });
+  }
   return pkg;
 }
 

package/lib/ecosystems/parsers-rust.js

@@ -62,7 +62,15 @@ function parseCargoDependencyFromPackageNode(packageNode) {
   const isExtendFromWorkspace = (attribute) => {
     return attribute?.workspace;
   };
-  if (!pkgName || !pkgVersion) {
+  // A missing name, or a name/version that only exists as an unresolved
+  // `*.workspace = true` reference, cannot identify a package. An absent
+  // version is fine though: cargo itself records unversioned local packages
+  // such as unpublished workspace members as version 0.0.0 (issue #4327).
+  if (
+    !pkgName ||
+    isExtendFromWorkspace(pkgName) ||
+    isExtendFromWorkspace(pkgVersion)
+  ) {
     throw new Error("name or version is not defined");
   }
 
@@ -76,8 +84,10 @@ function parseCargoDependencyFromPackageNode(packageNode) {
     pkg.group = group;
     pkg.name = basename(pkgName.toString());
   }
-  if (!isExtendFromWorkspace(pkgVersion) && pkgVersion) {
+  if (pkgVersion) {
     pkg.version = pkgVersion;
+  } else {
+    pkg.version = "0.0.0";
   }
   if (!isExtendFromWorkspace(pkgAuthors) && pkgAuthors) {
     if (Array.isArray(pkgAuthors)) {