@cdxgen/cdxgen 13.0.1 → 13.2.0

package/README.md

@@ -32,15 +32,16 @@ Supported output document formats:
 
 ## Choose your path
 
-| Persona               | What cdxgen helps you do                                                                                             | First command                                                              | Read next                                                                                                 |
-| --------------------- | -------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
-| **Developers**        | Generate a CycloneDX BOM from a local repo, git URL, purl, or container image                                        | `cdxgen -o bom.json .`                                                     | [CLI Usage][docs-cli], [Supported Project Types][docs-project-types]                                      |
-| **AI platform teams** | Generate AI/ML BOMs, catalog prompt/model/MCP surfaces, and run AI-BOM governance                                    | `aibom .`                                                                  | [AI-BOM Guide](docs/AI_BOM.md), [AI-BOM lesson](docs/LESSON15.md)                                         |
-| **Hardware teams**    | Generate an HBOM or merged HBOM+OBOM host view for the current host                                                  | `hbom -o hbom.json`                                                        | [HBOM guide](docs/HBOM.md), [HBOM lesson](docs/LESSON13.md)                                               |
-| **AppSec**            | Enrich BOMs with evidence, run BOM audit rules, and feed downstream security workflows                               | `cdxgen -o bom.json --profile appsec --evidence --bom-audit .`             | [BOM Audit](docs/BOM_AUDIT.md), [Threat Model](docs/THREAT_MODEL.md)                                      |
-| **SOC analysts**      | Build OBOM inventories for live hosts and triage runtime posture issues                                              | `obom -o obom.json --deep --bom-audit --bom-audit-categories obom-runtime` | [OBOM lessons](docs/OBOM_LESSONS.md), [Server Usage][docs-server]                                         |
-| **Compliance teams**  | Validate BOM quality, check SCVS/CRA posture, and export SPDX deliverables                                           | `cdx-validate -i bom.json --benchmark scvs-l2,cra`                         | [cdx-validate](docs/CDX_VALIDATE.md), [cdx-convert](docs/CDX_CONVERT.md), [Permissions][docs-permissions] |
-| **Security Teams**    | Dynamically trace executions to capture cryptographic activities, CBOM properties, software components, and services | `tracebom --cbom-output cbom.json -- npm test`                             | [Threat Model](docs/THREAT_MODEL.md)                                                                      |
+| Persona               | What cdxgen helps you do                                                                                             | First command                                                              | Read next                                                                                                       |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| **Developers**        | Generate a CycloneDX BOM from a local repo, git URL, purl, or container image                                        | `cdxgen -o bom.json .`                                                     | [CLI Usage][docs-cli], [Supported Project Types][docs-project-types]                                            |
+| **AI platform teams** | Generate AI/ML BOMs, catalog prompt/model/MCP surfaces, and run AI-BOM governance                                    | `aibom .`                                                                  | [AI-BOM Guide](docs/AI_BOM.md), [AI-BOM lesson](docs/LESSON15.md)                                               |
+| **Hardware teams**    | Generate an HBOM or merged HBOM+OBOM host view for the current host                                                  | `hbom -o hbom.json`                                                        | [HBOM guide](docs/HBOM.md), [HBOM lesson](docs/LESSON13.md)                                                     |
+| **AppSec**            | Enrich BOMs with evidence, run BOM audit rules, and feed downstream security workflows                               | `cdxgen -o bom.json --profile appsec --evidence --bom-audit .`             | [BOM Audit](docs/BOM_AUDIT.md), [Threat Model](docs/THREAT_MODEL.md)                                            |
+| **Build engineers**   | Grade how completely the SBOM captured the project, and get ranked fixes when the build environment degraded it      | `cdxgen --profile introspect --introspect-fail-below 70 -o bom.json .`     | [Build Introspection](docs/INTROSPECTION.md), [Fidelity loop skill](.agents/skills/sbom-fidelity-loop/SKILL.md) |
+| **SOC analysts**      | Build OBOM inventories for live hosts and triage runtime posture issues                                              | `obom -o obom.json --deep --bom-audit --bom-audit-categories obom-runtime` | [OBOM lessons](docs/OBOM_LESSONS.md), [Server Usage][docs-server]                                               |
+| **Compliance teams**  | Validate BOM quality, check SCVS/CRA posture, and export SPDX deliverables                                           | `cdx-validate -i bom.json --benchmark scvs-l2,cra`                         | [cdx-validate](docs/CDX_VALIDATE.md), [cdx-convert](docs/CDX_CONVERT.md), [Permissions][docs-permissions]       |
+| **Security Teams**    | Dynamically trace executions to capture cryptographic activities, CBOM properties, software components, and services | `tracebom --cbom-output cbom.json -- npm test`                             | [Threat Model](docs/THREAT_MODEL.md)                                                                            |
 
 ### Role-based quick starts
 
@@ -120,6 +121,7 @@ Sections include:
 - [MCP Inventory](docs/MCP.md)
 - [REPL Guide](docs/REPL.md)
 - [Custom Properties](docs/CUSTOM_PROPERTIES.md)
+- [Claude Code Plugin](claude-plugin/README.md)
 - [Deprecations](docs/DEPRECATIONS.md)
 - [Security Policy](SECURITY.md)
 - [Threat Model](docs/THREAT_MODEL.md)
@@ -214,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.0.1"
+VERSION="v13.2.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -228,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.0.1"
+VERSION="v13.2.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -242,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.0.1"
+$Version = "v13.2.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -267,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.0.1 \
+      gh release download v13.2.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -495,14 +497,13 @@ Use repeated `--component-type` values to include only selected CycloneDX compon
 cdxgen -t docker alpine:3.20 --spec-version 1.6 --component-type library --component-type data
 ```
 
-To generate SBOM for C or Python, ensure Java >= 21 is installed.
+To generate SBOM for C or Python, cdxgen uses the bundled atom companion. On linux-amd64, linux-arm64 (glibc), linux-amd64-musl, darwin-arm64, and windows-amd64, atom ships as a native binary and needs no JDK. Only the jar-based triples (darwin-amd64, windows-arm64, and linux-arm64-musl) run atom on the JVM.
 
 ```shell
-# Install java >= 21
 cdxgen -t c -o bom.json
 ```
 
-NOTE: cdxgen is known to freeze with Java 8 or 11, so ensure >= 21 is installed and JAVA_HOME environment variable is configured correctly. If in doubt, use the cdxgen container image.
+NOTE: On the jar-based triples, atom requires Java >= 23 and is known to freeze with Java 8 or 11, so ensure a suitable version is installed and the JAVA_HOME environment variable is configured correctly. If in doubt, use the cdxgen container image.
 
 ## Universal SBOM
 
@@ -620,6 +621,17 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 pnpm dlx @cdxgen/cdxgen-plugins-bin
 ```
 
+## Claude Code plugin
+
+The cdxgen toolkit is also packaged as a [Claude Code](https://claude.com/claude-code) plugin, so agents drive the correct command and flags — including the dry-run-first and no-auto-install safety constraints — instead of guessing.
+
+```shell
+claude plugin marketplace add cdxgen/cdxgen
+claude plugin install cdxgen@cdxgen-plugins
+```
+
+It ships skills covering SBOM generation, container and rootfs scans, OBOM/HBOM, CBOM, AI-BOM and MCP inventory, BOM auditing, signing, validation, conversion, evidence enrichment, runtime tracing, and Dependency-Track publishing. See [claude-plugin/README.md](claude-plugin/README.md).
+
 ## Rust accelerator (cdxrs)
 
 cdxgen ships with an optional Rust accelerator binary, `cdxrs`, which speeds up hot paths such as registry metadata lookups where available. Use the `--rust` and `--no-rust` arguments to toggle it, or set the environment variable `CDXGEN_RS_DISABLE=all` to force the JavaScript path. See the [cdxrs protocol](./docs/CDXRS_PROTOCOL.md) document for implementation details.
@@ -775,6 +787,8 @@ pnpm dlx @cdxgen/cdxgen cdx-sign -i bom.json -k private.key
 
 For node.js projects, lock files are parsed initially, so the SBOM would include all dependencies, including dev ones. An AST parser powered by babel-parser is then used to detect packages that are imported and used by non-test code. Such imported packages would automatically set their scope property to `required` in the resulting SBOM. You can turn off this analysis by passing the argument `--no-babel`. Scope property would then be set based on the `dev` attribute in the lock file.
 
+Single-file component frameworks are handled natively by this analysis: `.vue` and `.svelte` templates are segmented position-preservingly so script imports recover with correct file and line evidence. For Svelte and SvelteKit, framework usage signals are additionally collected — SvelteKit virtual modules such as `$app/stores` are attributed to `@sveltejs/kit`, `$lib/*` imports resolve through `kit.alias`, `svelte.config.js` adapters and preprocessors, CSS preprocessor packages implied by `<style lang="...">` blocks together with their `@use`/`@import` package references, npm script executables such as `svelte-kit sync` and `svelte-check`, and rune usage (`$state`, `$derived`, ...) which marks `svelte` required even in components that never import it. This works in every installation; when the optional `@appthreat/atom-parsetools` package is present, template expressions also contribute usage occurrences.
+
 This attribute can be later used for various purposes. For example, [dep-scan][depscan-github] uses this attribute to prioritize vulnerabilities. Unfortunately, tools such as dependency track, do not include this feature and might over-report the CVEs.
 
 With the argument `--required-only`, you can limit the SBOM only to include packages with the scope "required", commonly called production or non-dev dependencies. Combine with `--no-babel` to limit this list to only non-dev dependencies based on the `dev` attribute being false in the lock files.

package/bin/audit.js

@@ -132,6 +132,11 @@ const args = yargs(hideBin(process.argv))
       "Path to a license compliance policy YAML file. Evaluates every component license in the BOM(s) and reports prohibited and warning-level violations as a separate table. Error-level (prohibited) violations cause a non-zero exit.",
     type: "string",
   })
+  .option("introspect", {
+    description:
+      "Include a build-fidelity introspection verdict for each audited BOM. The BOM was not generated by this run, so the verdict rests on BOM structure alone.",
+    type: "boolean",
+  })
   .check((argv) => {
     if (!argv.bom && !argv.bomDir) {
       throw new Error("Specify --bom or --bom-dir.");
@@ -204,6 +209,7 @@ function writeOrPrint(output, outputPath) {
       categories: splitCsv(args.categories),
       directBomAudit: args.directBomAudit,
       failSeverity: args.failSeverity,
+      introspect: args.introspect === true,
       licensePolicy: args.licensePolicy,
       maxTargets: args.maxTargets,
       minSeverity: args.minSeverity,

package/bin/cdxgen.js

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
+import { tmpdir } from "node:os";
 import {
   basename,
   dirname,
@@ -18,6 +19,7 @@ import { parse as _load } from "yaml";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
+import { getExactAiInventoryType } from "../lib/cli/bomAssembly.js";
 import {
   applyAdvancedOptions as applyAdvancedOptionsImpl,
   buildOptionsFromArgs,
@@ -25,6 +27,12 @@ import {
   validateSpecVersion,
 } from "../lib/cli/cliOptions.js";
 import { createBom, submitBom } from "../lib/cli/index.js";
+import { closeLedger } from "../lib/core/buildLedger.js";
+import {
+  getDeferredFailures,
+  INTROSPECTION_FAILURE_EXIT_CODE,
+  isDeferredFailOnError,
+} from "../lib/core/deferredExit.js";
 import { TRACE_MODE, thoughtEnd, thoughtLog } from "../lib/core/logger.js";
 import {
   PROJECT_CONFIG_FILENAMES,
@@ -57,6 +65,7 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
   safeMkdirSync,
+  safeRmSync,
   safeSpawnSync,
   safeWriteSync,
   setActivityContext,
@@ -115,7 +124,10 @@ import {
 } from "../lib/inventory/source.js";
 import { executeOsQuery } from "../lib/managers/binary.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
-import { postProcess } from "../lib/stages/postgen/postgen.js";
+import {
+  applyEvidenceBasedFilter,
+  postProcess,
+} from "../lib/stages/postgen/postgen.js";
 import { convertCycloneDxToSpdx } from "../lib/stages/postgen/spdxConverter.js";
 import { auditEnvironment } from "../lib/stages/pregen/envAudit.js";
 import { prepareEnv } from "../lib/stages/pregen/pregen.js";
@@ -486,8 +498,33 @@ const args = _yargs
       "deep-learning",
       "ml-deep",
       "ml-tiny",
+      "introspect",
     ],
   })
+  .option("introspect", {
+    type: "boolean",
+    description:
+      "Reflect on how the build environment limited BOM completeness and write an introspection report. Enabled by --profile introspect or CDXGEN_INTROSPECT=true. Pass --no-introspect to keep it off.",
+  })
+  .option("introspect-report", {
+    description:
+      "Path for the markdown introspection report. Defaults to <output>.introspection.md; '-' writes the report to stderr.",
+  })
+  .option("introspect-json", {
+    description:
+      "Path for the JSON introspection report consumed by remediation loops. Defaults to <output>.introspection.json.",
+  })
+  .option("introspect-fail-below", {
+    type: "number",
+    description:
+      "CI gate: exit with status 4 after the BOM is written when the overall introspection score is below this 0-100 threshold. Absent means the gate never fails.",
+  })
+  .option("introspect-annotate", {
+    type: "boolean",
+    default: true,
+    description:
+      "Carry the introspection verdict inside the BOM as metadata properties and annotations. Enabled with --introspect; pass --no-introspect-annotate to keep the BOM untouched.",
+  })
   .option("lifecycle", {
     description: "Product lifecycle for the generated BOM.",
     hidden: true,
@@ -602,6 +639,7 @@ const args = _yargs
       "suggest-build-tools",
       "ruby-docker-install",
       "resolve-gradle-distribution",
+      "jvm-tool-setup",
     ],
   })
   .option("min-confidence", {
@@ -1010,6 +1048,29 @@ const { options, warnings: phase3Warnings } = buildOptionsFromArgs(args, {
   isDryRun,
   isSecureMode,
 });
+// Exit status reserved for the introspection CI gate: the BOM was generated
+// and written, but its introspection score missed the configured threshold.
+// Distinct from 1 so CI can tell a generation failure from a not-good-enough
+// SBOM.
+const INTROSPECTION_GATE_EXIT_CODE = 4;
+// The ledger recorder resolves its environment lazily, so the parsed flag is
+// bridged into the environment it reads: a run started with --introspect
+// records the same events as one started with CDXGEN_INTROSPECT=true. Without
+// an explicitly configured sidecar, an automatic temp sidecar captures
+// worker-thread events the main thread never sees; it is removed once the
+// reports are written. Dry-run creates no files, so it keeps an in-memory
+// ledger only.
+let autoLedgerSidecar;
+if (options.introspect) {
+  process.env.CDXGEN_INTROSPECT = "true";
+  if (!isDryRun && !readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER")) {
+    autoLedgerSidecar = join(
+      tmpdir(),
+      `cdxgen-introspect-ledger-${process.pid}.jsonl`,
+    );
+    process.env.CDXGEN_INTROSPECT_LEDGER = autoLedgerSidecar;
+  }
+}
 const cliActivityProjectType = Array.isArray(options.projectType)
   ? options.projectType.join(",")
   : options.projectType;
@@ -1544,7 +1605,14 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   }
   let sourcePath = filePath;
   let purlResolution;
-  const directHuggingFaceSource = normalizeHuggingFaceReference(sourcePath);
+  // Direct HuggingFace interpretation of the source path is opt-in: bare
+  // `owner/repo`-shaped values are ordinary relative paths (eg: repotests/
+  // sveltejs-realworld) unless an AI inventory type such as `-t ai` is
+  // explicitly selected. Unambiguous purls and huggingface.co URLs always
+  // resolve.
+  const directHuggingFaceSource = normalizeHuggingFaceReference(sourcePath, {
+    explicitOnly: getExactAiInventoryType(options) !== "ai",
+  });
   if (isDryRun && directHuggingFaceSource) {
     recordActivity({
       kind: "read",
@@ -1683,8 +1751,14 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       prepareEnv(srcDir, options);
       prepPhase.succeed("");
     } catch (err) {
-      prepPhase.fail(err);
-      throw err;
+      if (isDeferredFailOnError(err)) {
+        // A deep-mode provisioning failure under --fail-on-error: the scan
+        // continues so the run still produces the verdict that explains it.
+        prepPhase.fail("environment preparation failed");
+      } else {
+        prepPhase.fail(err);
+        throw err;
+      }
     }
   }
   thoughtLog("Getting ready to generate the BOM ⚡️.");
@@ -1756,7 +1830,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   {
     const postPhase = defaultUi.phase("Post-processing BOM");
     try {
-      bomNSData = postProcess(
+      bomNSData = await postProcess(
         bomNSData,
         { ...options, executeOsQuery },
         srcDir,
@@ -2008,11 +2082,13 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
           dbObjMap,
           evinseOptions,
         );
-        const evinseJson = evinserModule.createEvinseFile(
+        const evinseJson = await evinserModule.createEvinseFile(
           sliceArtefacts,
           evinseOptions,
         );
-        bomNSData.bomJson = evinseJson;
+        // The scope filter is deferred until here so the analyzers get to
+        // prove that an optional dependency is actually used.
+        bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
         if (options.print && evinseJson) {
           printOccurrences(evinseJson);
           printCallStack(evinseJson);
@@ -2147,6 +2223,64 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       console.log("Try running the command with -t <type> or -r argument");
     }
   }
+  // The reflection consumed the ledger while producing its reports, so an
+  // automatic sidecar can be released and removed. An explicitly configured
+  // sidecar belongs to the user and is left alone.
+  if (autoLedgerSidecar) {
+    closeLedger();
+    try {
+      safeRmSync(autoLedgerSidecar, { force: true });
+    } catch {
+      // Best-effort cleanup of our own temp file: a runtime whose permission
+      // model denies the removal must not fail a run whose BOM and reports
+      // are already written.
+    }
+  }
+  // A --fail-on-error extractor failure on an introspected run was deferred
+  // until the BOM and both reports existed; here it finally claims its
+  // non-zero exit. It outranks the fidelity gate because a failed toolchain is
+  // the more fundamental claim, and the report still carries the gate
+  // decision.
+  const deferredFailures = getDeferredFailures();
+  if (deferredFailures.length) {
+    const reported = new Set();
+    for (const failure of deferredFailures) {
+      const message = `fail-on-error: ${failure.detail} (tool: ${failure.tool}${failure.exitCode !== undefined ? `, exit ${failure.exitCode}` : ""}).`;
+      if (!reported.has(message)) {
+        reported.add(message);
+        console.error(message);
+      }
+    }
+    // Exit 5 is the promise that the outputs exist. A run that failed before
+    // producing any BOM never made that promise and keeps the historical
+    // exit 1, which is what "cdxgen failed to generate a BOM" has always
+    // meant.
+    const wroteBom = Boolean(bomNSData?.bomJson);
+    console.error(
+      wroteBom
+        ? `fail-on-error: ${reported.size} extractor failure(s) were deferred so the BOM and the introspection report could be written; exiting ${INTROSPECTION_FAILURE_EXIT_CODE}.`
+        : "fail-on-error: no BOM was produced, so there is no verdict to report; exiting 1.",
+    );
+    if (cleanup) {
+      cleanupSourceDir(srcDir);
+    }
+    process.exit(wroteBom ? INTROSPECTION_FAILURE_EXIT_CODE : 1);
+  }
+  // The introspection CI gate fires only after the BOM and the reports are
+  // written: a below-threshold score reports a not-good-enough SBOM, never a
+  // lost one.
+  if (
+    bomNSData?.introspectionGate &&
+    bomNSData.introspectionGate.passed === false
+  ) {
+    console.error(
+      `Build introspection: score ${bomNSData.introspectionGate.score} is below the --introspect-fail-below threshold ${bomNSData.introspectionGate.threshold}.`,
+    );
+    if (cleanup) {
+      cleanupSourceDir(srcDir);
+    }
+    process.exit(INTROSPECTION_GATE_EXIT_CODE);
+  }
   thoughtEnd();
   // Automatically submit the bom data
   // biome-ignore lint/suspicious/noDoubleEquals: yargs passes true for empty values

package/bin/evinse.js

@@ -45,6 +45,8 @@ const args = yargs(hideBin(process.argv))
     choices: [
       "java",
       "jar",
+      "kotlin",
+      "kt",
       "js",
       "ts",
       "javascript",
@@ -338,7 +340,7 @@ ensureCycloneDxInput(args.input);
     // Analyze the project using atom. Convert package namespaces to purl using the db
     const sliceArtefacts = await analyzeProject(dbObjMap, args);
     // Create the SBOM with Evidence
-    const bomJson = createEvinseFile(sliceArtefacts, args);
+    const bomJson = await createEvinseFile(sliceArtefacts, args);
     // Validate our final SBOM
     if (!(await validateBom(bomJson))) {
       process.exit(1);

package/data/component-tags.json

@@ -119,7 +119,14 @@
       "projections",
       "performance",
       "plugins",
-      "non-block"
+      "non-block",
+      "http",
+      "grpc",
+      "graphql",
+      "wsgi",
+      "asgi",
+      "llm",
+      "mcp"
     ]
   },
   "properties": {

package/data/crypto-oid.json

@@ -40,11 +40,11 @@
     "description": "Korean SEED algorithm, CBC mode"
   },
   "seedOFB": {
-    "oid": "1.2.410.200004.1.5",
+    "oid": "1.2.410.200004.1.6",
     "description": "Korean SEED algorithm, OFB mode"
   },
   "seedCFB": {
-    "oid": "1.2.410.200004.1.6",
+    "oid": "1.2.410.200004.1.5",
     "description": "Korean SEED algorithm, CFB mode"
   },
   "seedMAC": {
@@ -233,11 +233,11 @@
   },
   "cryptoProECDH256": {
     "oid": "1.2.643.7.1.1.6.1",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 256 bit key"
+    "description": "TC26 GOST R 34.10-2012 256-bit key agreement"
   },
   "cryptoProECDH512": {
     "oid": "1.2.643.7.1.1.6.2",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 512 bit key"
+    "description": "TC26 GOST R 34.10-2012 512-bit key agreement"
   },
   "dsa": {
     "oid": "1.2.840.10040.4.1",
@@ -932,8 +932,8 @@
     "description": "Teletrust algorithm"
   },
   "rsaSignature": {
-    "oid": "1.3.36.3.3.1",
-    "description": "Teletrust signature algorithm"
+    "oid": "1.3.14.3.2.11",
+    "description": "RSA signature (OIW secsig)"
   },
   "rsaSignatureWithsha1": {
     "oid": "1.3.36.3.3.1.1",
@@ -1412,8 +1412,8 @@
     "description": "Novell encryption algorithm"
   },
   "sha-1": {
-    "oid": "2.16.840.1.113719.1.2.8.82",
-    "description": "Novell digest algorithm"
+    "oid": "1.3.14.3.2.26",
+    "description": "SHA-1 secure hash standard (OIW)"
   },
   "rc2BSafe1Cbc": {
     "oid": "2.16.840.1.113719.1.2.8.92",
@@ -1959,10 +1959,6 @@
     "oid": "1.2.156.10197.1.301.3",
     "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   },
-  "sm2sign_with_": {
-    "oid": "1.2.156.10197.1.501",
-    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
-  },
   "PBKDF2": {
     "oid": "1.2.840.113549.1.5.12",
     "description": "PBKDF2 key derivation algorithm"
@@ -1994,5 +1990,85 @@
   "pbeWithSHA1AndRC2-CBC": {
     "oid": "1.2.840.113549.1.5.11",
     "description": "Password Based Encryption Algorithm. Uses RC2 in Cipher Block Chaining Mode (RC2-CBC)."
+  },
+  "ml-dsa-44": {
+    "oid": "2.16.840.1.101.3.4.3.17",
+    "description": "ML-DSA-44 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-65": {
+    "oid": "2.16.840.1.101.3.4.3.18",
+    "description": "ML-DSA-65 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-87": {
+    "oid": "2.16.840.1.101.3.4.3.19",
+    "description": "ML-DSA-87 post-quantum signature (FIPS 204)"
+  },
+  "ml-kem-512": {
+    "oid": "2.16.840.1.101.3.4.4.1",
+    "description": "ML-KEM-512 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-768": {
+    "oid": "2.16.840.1.101.3.4.4.2",
+    "description": "ML-KEM-768 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-1024": {
+    "oid": "2.16.840.1.101.3.4.4.3",
+    "description": "ML-KEM-1024 post-quantum key encapsulation (FIPS 203)"
+  },
+  "x25519": {
+    "oid": "1.3.101.110",
+    "description": "X25519 Diffie-Hellman key agreement (RFC 7748)"
+  },
+  "slh-dsa-sha2-128s": {
+    "oid": "2.16.840.1.101.3.4.3.20",
+    "description": "SLH-DSA-SHA2-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-128f": {
+    "oid": "2.16.840.1.101.3.4.3.21",
+    "description": "SLH-DSA-SHA2-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192s": {
+    "oid": "2.16.840.1.101.3.4.3.22",
+    "description": "SLH-DSA-SHA2-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192f": {
+    "oid": "2.16.840.1.101.3.4.3.23",
+    "description": "SLH-DSA-SHA2-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256s": {
+    "oid": "2.16.840.1.101.3.4.3.24",
+    "description": "SLH-DSA-SHA2-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256f": {
+    "oid": "2.16.840.1.101.3.4.3.25",
+    "description": "SLH-DSA-SHA2-256f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128s": {
+    "oid": "2.16.840.1.101.3.4.3.26",
+    "description": "SLH-DSA-SHAKE-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128f": {
+    "oid": "2.16.840.1.101.3.4.3.27",
+    "description": "SLH-DSA-SHAKE-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192s": {
+    "oid": "2.16.840.1.101.3.4.3.28",
+    "description": "SLH-DSA-SHAKE-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192f": {
+    "oid": "2.16.840.1.101.3.4.3.29",
+    "description": "SLH-DSA-SHAKE-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256s": {
+    "oid": "2.16.840.1.101.3.4.3.30",
+    "description": "SLH-DSA-SHAKE-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256f": {
+    "oid": "2.16.840.1.101.3.4.3.31",
+    "description": "SLH-DSA-SHAKE-256f hash-based signature (FIPS 205)"
+  },
+  "sm2sign_with_sm3": {
+    "oid": "1.2.156.10197.1.501",
+    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   }
 }

package/data/frameworks-list.json

@@ -76,6 +76,56 @@
     "pkg:pypi/langchain",
     "pkg:pypi/llama",
     "pkg:pypi/sqlalchemy",
+    "pkg:pypi/starlette",
+    "pkg:pypi/quart",
+    "pkg:pypi/litestar",
+    "pkg:pypi/blacksheep",
+    "pkg:pypi/robyn",
+    "pkg:pypi/connexion",
+    "pkg:pypi/werkzeug",
+    "pkg:pypi/asgiref",
+    "pkg:pypi/djangorestframework",
+    "pkg:pypi/scrapy",
+    "pkg:pypi/streamlit",
+    "pkg:pypi/gradio",
+    "pkg:pypi/dash",
+    "pkg:pypi/nicegui",
+    "pkg:pypi/reflex",
+    "pkg:pypi/pydantic",
+    "pkg:pypi/sqlmodel",
+    "pkg:pypi/tortoise-orm",
+    "pkg:pypi/peewee",
+    "pkg:pypi/mongoengine",
+    "pkg:pypi/beanie",
+    "pkg:pypi/marshmallow",
+    "pkg:pypi/strawberry-graphql",
+    "pkg:pypi/graphene",
+    "pkg:pypi/ariadne",
+    "pkg:pypi/grpcio",
+    "pkg:pypi/thrift",
+    "pkg:pypi/mcp",
+    "pkg:pypi/fastmcp",
+    "pkg:pypi/openai",
+    "pkg:pypi/anthropic",
+    "pkg:pypi/litellm",
+    "pkg:pypi/langgraph",
+    "pkg:pypi/haystack-ai",
+    "pkg:pypi/autogen",
+    "pkg:pypi/pyautogen",
+    "pkg:pypi/crewai",
+    "pkg:pypi/semantic-kernel",
+    "pkg:pypi/transformers",
+    "pkg:pypi/sentence-transformers",
+    "pkg:pypi/huggingface-hub",
+    "pkg:pypi/celery",
+    "pkg:pypi/kombu",
+    "pkg:pypi/dramatiq",
+    "pkg:pypi/huey",
+    "pkg:pypi/jinja2",
+    "pkg:pypi/mako",
+    "pkg:pypi/chameleon",
+    "pkg:pypi/genshi",
+    "pkg:pypi/twisted",
     "vibora",
     "koa",
     "-sdk",
@@ -214,6 +264,41 @@
     "pkg:gem/volt",
     "pkg:gem/trailblazer",
     "pkg:gem/ramaze",
-    "pkg:gem/scorched"
+    "pkg:gem/scorched",
+    "Grpc.AspNetCore",
+    "Microsoft.AspNetCore.SignalR",
+    "Microsoft.Azure.Functions.Worker",
+    "Microsoft.NET.Sdk.Functions",
+    "Amazon.Lambda.Core",
+    "MassTransit",
+    "NServiceBus",
+    "MediatR",
+    "Rebus",
+    "HotChocolate.AspNetCore",
+    "GraphQL",
+    "Microsoft.AspNetCore.OData",
+    "ModelContextProtocol",
+    "ModelContextProtocol.AspNetCore",
+    "Microsoft.SemanticKernel",
+    "Microsoft.Extensions.AI",
+    "OpenAI",
+    "Azure.AI.OpenAI",
+    "Anthropic.SDK",
+    "AWSSDK.BedrockRuntime",
+    "Hangfire.AspNetCore",
+    "Quartz",
+    "FastEndpoints",
+    "Carter",
+    "ServiceStack",
+    "Nancy",
+    "Microsoft.ML",
+    "Microsoft.ML.OnnxRuntime",
+    "TorchSharp",
+    "LLamaSharp",
+    "Qdrant.Client",
+    "Milvus.Client",
+    "Pinecone.NET",
+    "Dapr.AspNetCore",
+    "Confluent.Kafka"
   ]
 }