@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/core/activity.js

@@ -3,7 +3,7 @@ import process from "node:process";
 
 import { createHttpClient, getDefaultHttpTimeoutMs } from "./httpClient.js";
 import { traceLog } from "./logger.js";
-import { CDXGEN_VERSION } from "./state.js";
+import { getUserAgent } from "./userAgent.js";
 
 /** True when CDXGEN_DEBUG_MODE or SCAN_DEBUG_MODE requests debug/verbose output. */
 export const DEBUG_MODE =
@@ -85,6 +85,30 @@ const LOCKFILE_ACTIVITY_HINTS = new Map([
       label: "Bundler lockfile",
     },
   ],
+  [
+    "cpanfile.snapshot",
+    {
+      classification: "lockfile",
+      ecosystem: "cpan",
+      label: "Carton snapshot",
+    },
+  ],
+  [
+    "manifest.toml",
+    {
+      classification: "lockfile",
+      ecosystem: "gleam",
+      label: "Gleam or Julia lockfile",
+    },
+  ],
+  [
+    "nimble.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "nim",
+      label: "Nimble lockfile",
+    },
+  ],
   [
     "package-lock.json",
     { classification: "lockfile", ecosystem: "npm", label: "npm lockfile" },
@@ -125,6 +149,62 @@ const LOCKFILE_ACTIVITY_HINTS = new Map([
       label: "PEP 751 lockfile",
     },
   ],
+  [
+    "renv.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "cran",
+      label: "renv lockfile",
+    },
+  ],
+  [
+    "rebar.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hex",
+      label: "rebar3 lockfile",
+    },
+  ],
+  [
+    "shard.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "crystal",
+      label: "Crystal shards lockfile",
+    },
+  ],
+  [
+    "spack.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "spack",
+      label: "Spack lockfile",
+    },
+  ],
+  [
+    "stack.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hackage",
+      label: "Stack lockfile",
+    },
+  ],
+  [
+    "stack.yaml.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hackage",
+      label: "Stack lockfile",
+    },
+  ],
+  [
+    ".terraform.lock.hcl",
+    {
+      classification: "lockfile",
+      ecosystem: "terraform",
+      label: "Terraform provider lockfile",
+    },
+  ],
   [
     "uv.lock",
     { classification: "lockfile", ecosystem: "python", label: "uv lockfile" },
@@ -167,6 +247,18 @@ const MANIFEST_ACTIVITY_HINTS = new Map([
     "pom.xml",
     { classification: "manifest", ecosystem: "maven", label: "Maven manifest" },
   ],
+  [
+    "cpanfile",
+    { classification: "manifest", ecosystem: "cpan", label: "CPAN manifest" },
+  ],
+  [
+    "project.toml",
+    {
+      classification: "manifest",
+      ecosystem: "julia",
+      label: "Julia project manifest",
+    },
+  ],
   [
     "pyproject.toml",
     {
@@ -942,10 +1034,35 @@ function inferNetworkIntent(requestUrl) {
   return "metadata-fetch";
 }
 
+/**
+ * Set the request's user-agent to the value resolved for its destination host,
+ * so that a `CDXGEN_USER_AGENT_<REGISTRY>` override reaches the registry it
+ * names. A user-agent a caller set explicitly is left alone; only the client's
+ * own default, which carries no host context, is replaced.
+ *
+ * @param {Object} options Request options being prepared by the HTTP client.
+ * @returns {void}
+ */
+function applyUserAgent(options) {
+  const headers = options.headers || (options.headers = {});
+  const existingKey = Object.keys(headers).find(
+    (name) => name.toLowerCase() === "user-agent",
+  );
+  if (existingKey && headers[existingKey] !== getUserAgent()) {
+    return;
+  }
+  if (existingKey) {
+    delete headers[existingKey];
+  }
+  headers["user-agent"] = getUserAgent(options.url?.hostname);
+}
+
 /** The shared got-compatible HTTP client for all outbound requests, enforcing dry-run, host-allow-list, and secure-mode policies via beforeRequest/afterResponse/beforeError hooks. */
 export const cdxgenAgent = createHttpClient({
   headers: {
-    "user-agent": `@CycloneDX/cdxgen ${CDXGEN_VERSION}`,
+    // Per-host overrides are applied in beforeRequest; this is the fallback for
+    // any code path that reads the client's configured headers directly.
+    "user-agent": getUserAgent(),
   },
   // Bound every request so an unresponsive host cannot hang a scan. Overridable
   // via CDXGEN_HTTP_TIMEOUT_MS; individual calls may pass a smaller `timeout`.
@@ -959,6 +1076,7 @@ export const cdxgenAgent = createHttpClient({
       (options) => {
         const networkIntent =
           options.context?.activityIntent || inferNetworkIntent(options.url);
+        applyUserAgent(options);
         const allowedHostsEnv = readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS");
         const hostAllowed = isAllowedHttpHost(
           options.url.hostname,