@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/cli/bomAssembly.js

@@ -1097,7 +1097,19 @@ export function addComponent(
       component.modelCard = pkg.modelCard || undefined;
       component.data = pkg.data || undefined;
     }
+    if (options.specVersion >= 1.7) {
+      // An external component is provided by the deployment environment rather
+      // than bundled with the product. The schema defaults it to false, so it
+      // is only worth emitting when true.
+      component.isExternal = pkg.isExternal ? true : undefined;
+    }
     component["type"] = determinePackageType(pkg);
+    // `version` is optional in every spec version cdxgen emits. An empty string
+    // is not a version, and a consumer reading one has to guess whether it means
+    // "unknown" or "the empty release"; leaving the field out says it plainly.
+    if (!component.version) {
+      delete component.version;
+    }
     if (pkg["bom-ref"]) {
       component["bom-ref"] = pkg["bom-ref"];
     } else if (purlString) {

package/lib/cli/index.js

@@ -32,6 +32,11 @@ import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { dirNameStr } from "../core/paths.js";
 import { ui } from "../core/ui.js";
+import { isElmProjectFile } from "../ecosystems/parsers-elm.js";
+import {
+  isJuliaManifestFile,
+  isJuliaProjectFile,
+} from "../ecosystems/parsers-julia.js";
 import {
   parseBitbucketPipelinesFile,
   parseContainerFile,
@@ -90,6 +95,7 @@ import {
   determineParentComponent,
 } from "./bomAssembly.js";
 import {
+  createAgenticBom,
   createAsarBom,
   createCaxaBom,
   createChromeExtensionBom,
@@ -126,24 +132,36 @@ import {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 import {
   createCargoCacheBom,
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
+  findStackLockFiles,
   getCargoCacheDir,
 } from "./nativeBom.js";
 
@@ -154,22 +172,33 @@ export {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPixiBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 export {
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
 } from "./nativeBom.js";
@@ -2060,7 +2089,8 @@ export async function createXBom(path, options) {
     `${options.multiProject ? "**/" : ""}cabal.project.freeze`,
     options,
   );
-  if (hackageFiles.length) {
+  const stackLockDetectFiles = findStackLockFiles(path, options);
+  if (hackageFiles.length || stackLockDetectFiles.length) {
     return createHaskellBom(path, options);
   }
 
@@ -2285,6 +2315,131 @@ export async function createXBom(path, options) {
   if (gleamTomlFiles.length) {
     return await createGleamBom(path, options);
   }
+
+  // Julia
+  const juliaProjectFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const juliaManifestFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Manifest.toml`,
+    options,
+  );
+  // `Project.toml` is not a name Julia owns — Cloud Native Buildpacks use it
+  // too — so dispatch only when a file actually declares a Julia environment.
+  if (
+    juliaManifestFiles.some(isJuliaManifestFile) ||
+    juliaProjectFiles.some(isJuliaProjectFile)
+  ) {
+    return await createJuliaBom(path, options);
+  }
+
+  // Erlang with rebar3
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  if (rebarLockFiles.length) {
+    return await createErlangBom(path, options);
+  }
+
+  // OCaml with opam
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  if (opamLockedFiles.length) {
+    return await createOCamlBom(path, options);
+  }
+
+  // Elm with elm.json (0.19) or elm-package.json (0.18)
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  const legacyElmFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  if (elmJsonFiles.length || legacyElmFiles.length) {
+    return await createElmBom(path, options);
+  }
+
+  // Crystal with shards
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  if (shardYmlFiles.length) {
+    return await createCrystalBom(path, options);
+  }
+
+  // Nim with nimble
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  if (nimbleFiles.length) {
+    return await createNimBom(path, options);
+  }
+
+  // Lua with LuaRocks
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  if (rockspecFiles.length) {
+    return await createLuaBom(path, options);
+  }
+
+  // Spack environments
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  if (spackLockFiles.length) {
+    return await createSpackBom(path, options);
+  }
+
+  // R with renv
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  if (renvLockFiles.length) {
+    return createRBom(path, options);
+  }
+
+  // Perl with Carton
+  const cpanSnapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  if (cpanSnapshotFiles.length) {
+    return createPerlBom(path, options);
+  }
+
+  // Terraform and OpenTofu providers
+  const tfLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  if (tfLockFiles.length) {
+    return createTerraformBom(path, options);
+  }
 }
 
 /**
@@ -2636,6 +2791,39 @@ async function createBomForPath(path, options) {
   if (PROJECT_TYPE_ALIASES["gleam"].includes(projectType[0])) {
     return await createGleamBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["julia"].includes(projectType[0])) {
+    return await createJuliaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["erlang"].includes(projectType[0])) {
+    return await createErlangBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["ocaml"].includes(projectType[0])) {
+    return await createOCamlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["elm"].includes(projectType[0])) {
+    return await createElmBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["crystal"].includes(projectType[0])) {
+    return await createCrystalBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["nim"].includes(projectType[0])) {
+    return await createNimBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["lua"].includes(projectType[0])) {
+    return await createLuaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["spack"].includes(projectType[0])) {
+    return await createSpackBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["r"].includes(projectType[0])) {
+    return createRBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["perl"].includes(projectType[0])) {
+    return createPerlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
+    return createTerraformBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);
   }
@@ -2645,6 +2833,9 @@ async function createBomForPath(path, options) {
   if (PROJECT_TYPE_ALIASES["vscode-extension"].includes(projectType[0])) {
     return await createVscodeExtensionBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["agentic"].includes(projectType[0])) {
+    return await createAgenticBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["chrome-extension"].includes(projectType[0])) {
     return await createChromeExtensionBom(path, options);
   }

package/lib/cli/jsBom.js

@@ -53,6 +53,10 @@ import {
   fetchHuggingFaceAssetInventory,
   normalizeHuggingFaceReference,
 } from "../ecosystems/remote/huggingface.js";
+import {
+  AGENTIC_TOOL_PURL_TYPE,
+  collectAgenticTools,
+} from "../helpers/agenticToolutils.js";
 import {
   cleanupTempDir,
   collectInstalledExtensions,
@@ -100,6 +104,13 @@ const isWin = _platform() === "win32";
  * local Modelfile/`.gguf` file input. Returns the explicit selection from
  * `getExactAiInventoryType` when one is present.
  *
+ * Direct HuggingFace interpretation of the source path is opt-in: only
+ * unambiguous references (`pkg:huggingface/...` purls and huggingface.co
+ * URLs) are recognized on their own. Bare `owner/repo`-shaped values are
+ * ordinary relative paths (eg: `repotests/sveltejs-realworld`) unless an AI
+ * inventory type such as `-t ai` is explicitly selected, in which case
+ * `getExactAiInventoryType` already returned it above.
+ *
  * @param {string} path Project or file path
  * @param {object} options CLI options
  * @returns {string|undefined} The detected AI inventory type (`"ai"`) or undefined
@@ -109,7 +120,7 @@ export function getDirectAiInventoryType(path, options) {
   if (exactAiInventoryType) {
     return exactAiInventoryType;
   }
-  if (normalizeHuggingFaceReference(path)) {
+  if (normalizeHuggingFaceReference(path, { explicitOnly: true })) {
     return "ai";
   }
   try {
@@ -157,8 +168,10 @@ export async function createNodejsBom(path, options) {
         excludedAiInventoryTypes,
       );
   let aiInventory = { components: [], dependencies: [], services: [] };
+  // A value that exists on the local filesystem is always a project path -
+  // never a remote model id - so existing inputs skip remote resolution.
   const directHuggingFaceSource =
-    exactAiInventoryType === "ai"
+    exactAiInventoryType === "ai" && !safeExistsSync(path)
       ? normalizeHuggingFaceReference(path)
       : undefined;
   if (directHuggingFaceSource?.repoId) {
@@ -1748,6 +1761,50 @@ export async function createVscodeExtensionBom(path, options) {
   });
 }
 
+/**
+ * Create a BOM that catalogs agentic CLI tools installed for the current user
+ * (for example Kiro CLI, zcode, opencode, and Claude Code), along with the
+ * agents, plugins, and providers they define.
+ *
+ * The scan is read-only and value-redacting: it records tool versions where a
+ * declarative source exists, plus structural counts, but never reads
+ * credentials, transcripts, session logs, or telemetry.
+ *
+ * @param {string} path Positional input. A host scan does not read a project
+ *   tree, so an explicit path other than the current directory is rejected
+ *   rather than silently ignored.
+ * @param {Object} options Parse options from the CLI
+ * @returns {Promise<Object>} Promise resolving to BOM data
+ */
+export async function createAgenticBom(path, options) {
+  // Guard against a surprising host-wide scan masquerading as a project scan.
+  // cdxgen always supplies a positional path (defaulting to "."), so only an
+  // explicit path that resolves somewhere other than the current directory is
+  // treated as a mistake.
+  const resolvedPath = path ? resolve(path) : process.cwd();
+  if (resolvedPath !== process.cwd()) {
+    throw new Error(
+      "The 'agentic' project type performs a host-wide scan of installed " +
+        "agentic CLI tool directories and does not accept a path argument. " +
+        `Re-run without the path (received '${path}').`,
+    );
+  }
+  // Must not go to stdout: every entry point keeps stdout reserved for the BOM
+  // payload so `cdxgen -t agentic -o -` stays pipeable.
+  thoughtLog(
+    "Scanning the current user's home directory for installed agentic CLI tools.",
+  );
+  const inventory = collectAgenticTools(options);
+  const pkgList = trimComponents(inventory.components || []);
+  return buildBomNSData(options, pkgList, AGENTIC_TOOL_PURL_TYPE, {
+    src: "~",
+    filename: "agentic-cli-tools",
+    nsMapping: {},
+    dependencies: inventory.dependencies || [],
+    services: inventory.services || [],
+  });
+}
+
 /**
  * Function to create BOM for Electron ASAR archives.
  *

package/lib/cli/jvmBom.js

@@ -49,6 +49,7 @@ import {
   parseGradleInfoLogsForUrls,
   parseGradleProperties,
   parseGradleResolvedDistributions,
+  parseGradleVersionCatalog,
   recordGradleInvocationFailure,
   splitOutputByGradleProjects,
 } from "../ecosystems/gradleutils.js";
@@ -1372,6 +1373,27 @@ export async function createJavaBom(path, options) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
       }
+
+      // A version catalog declares coordinates without resolving them, so it
+      // is used only when Gradle produced no dependency information at all.
+      // The emitted components carry cdx:gradle:catalog=true to mark them as
+      // declared rather than resolved.
+      if (!pkgList.length) {
+        const catalogFiles = getAllFiles(
+          path,
+          `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
+          options,
+        );
+        for (const catalogFile of catalogFiles) {
+          if (DEBUG_MODE) {
+            console.log(`Parsing ${catalogFile}`);
+          }
+          const dlist = parseGradleVersionCatalog(catalogFile);
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          }
+        }
+      }
     }
 
     // Bazel

package/lib/cli/managedBom.js

@@ -50,6 +50,7 @@ import {
   parseGitHubWorkflowData,
   parseHelmYamlData,
 } from "../ecosystems/parsers-misc.js";
+import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
   generatePixiLockFile,
   parseMojoProject,
@@ -61,6 +62,8 @@ import {
   parseReqFile,
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
+import { parseRenvLock } from "../ecosystems/parsers-r.js";
+import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -2150,3 +2153,152 @@ export async function createCryptoCertsBom(path, options) {
     },
   };
 }
+
+/**
+ * Function to create bom string for R projects using renv.
+ *
+ * The `renv.lock` file carries the resolved package set for the project
+ * library, including the R version it was produced under.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createRBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  let rVersion;
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  for (const renvLockFile of renvLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${renvLockFile}`);
+    }
+    const result = parseRenvLock(renvLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+    if (!rVersion) {
+      rVersion = result.rVersion;
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // renv locks the library, not the project: they carry no project name, so
+  // the directory is the name the project is already known by. The R version
+  // the library was resolved under is a property of that project.
+  const projectName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: projectName,
+    "bom-ref": `application:${projectName}:latest`,
+    description: `R project: ${projectName}`,
+    properties: [
+      { name: "internal:SrcFile", value: renvLockFiles.join(", ") },
+      ...(rVersion ? [{ name: "cdx:renv:rVersion", value: rVersion }] : []),
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "cran", {
+    src: path,
+    filename: renvLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}
+
+/**
+ * Function to create bom string for Perl projects using Carton.
+ *
+ * The `cpanfile.snapshot` carries the resolved install set; the declared
+ * `cpanfile` is consulted to distinguish direct dependencies.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createPerlBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  const snapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  for (const snapshotFile of snapshotFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${snapshotFile}`);
+    }
+    const baseDir = dirname(snapshotFile);
+    const cpanfile = join(baseDir, "cpanfile");
+    const result = parseCpanSnapshot(
+      snapshotFile,
+      safeExistsSync(cpanfile) ? cpanfile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "cpan", {
+      src: path,
+      filename: snapshotFiles.join(", "),
+      dependencies,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Terraform and OpenTofu projects.
+ *
+ * The `.terraform.lock.hcl` file pins the providers the configuration
+ * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createTerraformBom(path, options) {
+  let pkgList = [];
+  const lockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  for (const lockFile of lockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseTerraformLockFile(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "terraform", {
+      src: path,
+      filename: lockFiles.join(", "),
+    });
+  }
+  return {};
+}