npm - @cdxgen/cdxgen - Versions diffs - 13.1.0 → 13.3.0 - Mend

@cdxgen/cdxgen 13.1.0 → 13.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (283) hide show

package/README.md +32 -15
package/bin/cdxgen.js +243 -122
package/bin/evinse.js +7 -0
package/bin/sign.js +88 -14
package/bin/tracebom.js +64 -4
package/bin/validate.js +29 -7
package/bin/verify.js +79 -39
package/data/crypto-oid.json +88 -12
package/data/remediations.json +47 -0
package/data/rules/ai-bom.yaml +78 -0
package/data/rules/cargo-rust.yaml +132 -0
package/data/rules/mcp-servers.yaml +122 -0
package/lib/audit/targets.js +6 -1
package/lib/cli/bomAssembly.js +117 -15
package/lib/cli/cliOptions.js +93 -1
package/lib/cli/index.js +235 -5
package/lib/cli/jsBom.js +108 -26
package/lib/cli/jvmBom.js +68 -12
package/lib/cli/managedBom.js +264 -41
package/lib/cli/nativeBom.js +923 -15
package/lib/core/activity.js +120 -2
package/lib/core/env.js +44 -7
package/lib/core/fs.js +174 -6
package/lib/core/metadataProperties.js +97 -0
package/lib/core/projectConfig.js +31 -4
package/lib/core/userAgent.js +151 -0
package/lib/ecosystems/bunutils.js +269 -101
package/lib/ecosystems/cargoCache.js +364 -0
package/lib/ecosystems/caxa.js +447 -7
package/lib/ecosystems/cmakeResolver.js +66 -0
package/lib/ecosystems/cppEvidence.js +104 -33
package/lib/ecosystems/ecosystems.js +260 -99
package/lib/ecosystems/golem.js +11 -1
package/lib/ecosystems/gradleutils.js +185 -9
package/lib/ecosystems/jsEvidence.js +19 -20
package/lib/ecosystems/kosi.js +1263 -0
package/lib/ecosystems/npmutils.js +110 -9
package/lib/ecosystems/parsers-crystal.js +179 -0
package/lib/ecosystems/parsers-dotnet.js +120 -49
package/lib/ecosystems/parsers-elm.js +816 -0
package/lib/ecosystems/parsers-gleam.js +1 -1
package/lib/ecosystems/parsers-go.js +47 -9
package/lib/ecosystems/parsers-js.js +171 -50
package/lib/ecosystems/parsers-julia.js +268 -0
package/lib/ecosystems/parsers-lua.js +218 -0
package/lib/ecosystems/parsers-misc.js +919 -161
package/lib/ecosystems/parsers-nim.js +221 -0
package/lib/ecosystems/parsers-opam.js +180 -0
package/lib/ecosystems/parsers-perl.js +277 -0
package/lib/ecosystems/parsers-python.js +27 -15
package/lib/ecosystems/parsers-r.js +148 -0
package/lib/ecosystems/parsers-rebar.js +411 -0
package/lib/ecosystems/parsers-rust.js +954 -33
package/lib/ecosystems/parsers-spack.js +204 -0
package/lib/ecosystems/parsers-stack.js +264 -0
package/lib/ecosystems/parsers-terraform.js +194 -0
package/lib/ecosystems/rubyutils.js +1426 -166
package/lib/ecosystems/rusi.js +158 -7
package/lib/evinser/evinser.js +547 -129
package/lib/evinser/swiftsem.js +1914 -302
package/lib/helpers/agenticToolutils.js +925 -0
package/lib/helpers/bomSigner.js +652 -221
package/lib/inventory/agentFormulationParser.js +57 -4
package/lib/inventory/aiCollector.js +504 -10
package/lib/inventory/aiInventory.js +12 -0
package/lib/inventory/analyzer.js +488 -30
package/lib/inventory/astWorker.js +6 -0
package/lib/inventory/atomUtils.js +568 -31
package/lib/inventory/auditCategories.js +8 -0
package/lib/inventory/cbomutils.js +30 -0
package/lib/inventory/cdxrs.js +110 -14
package/lib/inventory/communityAiConfigParser.js +215 -2
package/lib/inventory/depsUtils.js +183 -11
package/lib/inventory/display.js +4 -5
package/lib/inventory/dosai.js +627 -13
package/lib/inventory/dynamic.js +39 -1
package/lib/inventory/envcontext.js +9 -6
package/lib/inventory/evidenceUtils.js +26 -5
package/lib/inventory/fetchBatch.js +190 -19
package/lib/inventory/fetchRate.js +74 -11
package/lib/inventory/forgeEnricher.js +3 -2
package/lib/inventory/jvmToolEnv.js +6 -5
package/lib/inventory/mcpConfigParser.js +166 -2
package/lib/inventory/mcpDiscovery.js +11 -0
package/lib/inventory/mcpServerManifest.js +389 -0
package/lib/inventory/mcpbBundle.js +419 -0
package/lib/inventory/plugins.js +3 -0
package/lib/inventory/protobom.js +62 -89
package/lib/inventory/protobomLoader.js +4 -0
package/lib/inventory/purl.js +152 -3
package/lib/inventory/rustFormulationParser.js +1 -1
package/lib/inventory/sbomDocument.js +2 -70
package/lib/inventory/source.js +47 -23
package/lib/inventory/stylePackageRefs.js +41 -0
package/lib/inventory/svelteUtils.js +524 -0
package/lib/inventory/traceRunner.js +210 -21
package/lib/managers/binary.js +115 -24
package/lib/managers/docker.js +440 -20
package/lib/managers/oci.js +39 -1
package/lib/parsers/cmakeLists.js +452 -0
package/lib/parsers/huggingfaceUtils.js +15 -7
package/lib/parsers/largeJson.js +454 -0
package/lib/parsers/npmrc.js +19 -1
package/lib/parsers/onnx.js +294 -0
package/lib/parsers/safetensors.js +114 -0
package/lib/stages/postgen/introspection/markers.js +29 -6
package/lib/stages/postgen/postgen.js +237 -16
package/lib/third-party/arborist/snapshots/calc-dep-flags.test.cjs +462 -0
package/lib/validator/bomValidator.js +6 -16
package/lib/validator/index.js +48 -10
package/lib/validator/reporters/console.js +3 -0
package/lib/validator/reporters/json.js +1 -0
package/lib/validator/reporters/sarif.js +7 -0
package/package.json +27 -27
package/types/lib/audit/targets.d.ts.map +1 -1
package/types/lib/cli/bomAssembly.d.ts +2 -1
package/types/lib/cli/bomAssembly.d.ts.map +1 -1
package/types/lib/cli/cliOptions.d.ts +33 -1
package/types/lib/cli/cliOptions.d.ts.map +1 -1
package/types/lib/cli/index.d.ts +2 -2
package/types/lib/cli/index.d.ts.map +1 -1
package/types/lib/cli/jsBom.d.ts +23 -0
package/types/lib/cli/jsBom.d.ts.map +1 -1
package/types/lib/cli/jvmBom.d.ts.map +1 -1
package/types/lib/cli/managedBom.d.ts +33 -0
package/types/lib/cli/managedBom.d.ts.map +1 -1
package/types/lib/cli/nativeBom.d.ts +88 -8
package/types/lib/cli/nativeBom.d.ts.map +1 -1
package/types/lib/core/activity.d.ts.map +1 -1
package/types/lib/core/env.d.ts +21 -0
package/types/lib/core/env.d.ts.map +1 -1
package/types/lib/core/fs.d.ts +55 -0
package/types/lib/core/fs.d.ts.map +1 -1
package/types/lib/core/metadataProperties.d.ts +39 -0
package/types/lib/core/metadataProperties.d.ts.map +1 -0
package/types/lib/core/projectConfig.d.ts +6 -2
package/types/lib/core/projectConfig.d.ts.map +1 -1
package/types/lib/core/userAgent.d.ts +56 -0
package/types/lib/core/userAgent.d.ts.map +1 -0
package/types/lib/ecosystems/bunutils.d.ts +12 -5
package/types/lib/ecosystems/bunutils.d.ts.map +1 -1
package/types/lib/ecosystems/cargoCache.d.ts +75 -0
package/types/lib/ecosystems/cargoCache.d.ts.map +1 -0
package/types/lib/ecosystems/caxa.d.ts +14 -0
package/types/lib/ecosystems/caxa.d.ts.map +1 -1
package/types/lib/ecosystems/cmakeResolver.d.ts +23 -0
package/types/lib/ecosystems/cmakeResolver.d.ts.map +1 -1
package/types/lib/ecosystems/cppEvidence.d.ts +2 -2
package/types/lib/ecosystems/cppEvidence.d.ts.map +1 -1
package/types/lib/ecosystems/ecosystems.d.ts +15 -1
package/types/lib/ecosystems/ecosystems.d.ts.map +1 -1
package/types/lib/ecosystems/golem.d.ts.map +1 -1
package/types/lib/ecosystems/gradleutils.d.ts +40 -4
package/types/lib/ecosystems/gradleutils.d.ts.map +1 -1
package/types/lib/ecosystems/jsEvidence.d.ts +5 -2
package/types/lib/ecosystems/jsEvidence.d.ts.map +1 -1
package/types/lib/ecosystems/kosi.d.ts +86 -0
package/types/lib/ecosystems/kosi.d.ts.map +1 -0
package/types/lib/ecosystems/npmutils.d.ts +42 -0
package/types/lib/ecosystems/npmutils.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-crystal.d.ts +27 -0
package/types/lib/ecosystems/parsers-crystal.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-dotnet.d.ts +19 -0
package/types/lib/ecosystems/parsers-dotnet.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-elm.d.ts +79 -0
package/types/lib/ecosystems/parsers-elm.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-go.d.ts +10 -0
package/types/lib/ecosystems/parsers-go.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-js.d.ts +10 -4
package/types/lib/ecosystems/parsers-js.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-julia.d.ts +57 -0
package/types/lib/ecosystems/parsers-julia.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-lua.d.ts +50 -0
package/types/lib/ecosystems/parsers-lua.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-misc.d.ts +90 -3
package/types/lib/ecosystems/parsers-misc.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-nim.d.ts +43 -0
package/types/lib/ecosystems/parsers-nim.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-opam.d.ts +31 -0
package/types/lib/ecosystems/parsers-opam.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-perl.d.ts +36 -0
package/types/lib/ecosystems/parsers-perl.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-python.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-r.d.ts +35 -0
package/types/lib/ecosystems/parsers-r.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-rebar.d.ts +42 -0
package/types/lib/ecosystems/parsers-rebar.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-rust.d.ts +199 -0
package/types/lib/ecosystems/parsers-rust.d.ts.map +1 -1
package/types/lib/ecosystems/parsers-spack.d.ts +33 -0
package/types/lib/ecosystems/parsers-spack.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-stack.d.ts +35 -0
package/types/lib/ecosystems/parsers-stack.d.ts.map +1 -0
package/types/lib/ecosystems/parsers-terraform.d.ts +34 -0
package/types/lib/ecosystems/parsers-terraform.d.ts.map +1 -0
package/types/lib/ecosystems/pythonutils.d.ts +1 -1
package/types/lib/ecosystems/rubyutils.d.ts +143 -2
package/types/lib/ecosystems/rubyutils.d.ts.map +1 -1
package/types/lib/ecosystems/rusi.d.ts +13 -0
package/types/lib/ecosystems/rusi.d.ts.map +1 -1
package/types/lib/evinser/evinser.d.ts +81 -2
package/types/lib/evinser/evinser.d.ts.map +1 -1
package/types/lib/evinser/swiftsem.d.ts +280 -15
package/types/lib/evinser/swiftsem.d.ts.map +1 -1
package/types/lib/helpers/agenticToolutils.d.ts +87 -0
package/types/lib/helpers/agenticToolutils.d.ts.map +1 -0
package/types/lib/helpers/bomSigner.d.ts +106 -13
package/types/lib/helpers/bomSigner.d.ts.map +1 -1
package/types/lib/inventory/agentFormulationParser.d.ts.map +1 -1
package/types/lib/inventory/aiCollector.d.ts.map +1 -1
package/types/lib/inventory/aiInventory.d.ts.map +1 -1
package/types/lib/inventory/analyzer.d.ts.map +1 -1
package/types/lib/inventory/atomUtils.d.ts +145 -3
package/types/lib/inventory/atomUtils.d.ts.map +1 -1
package/types/lib/inventory/auditCategories.d.ts +4 -0
package/types/lib/inventory/auditCategories.d.ts.map +1 -1
package/types/lib/inventory/cbomutils.d.ts.map +1 -1
package/types/lib/inventory/cdxrs.d.ts +8 -3
package/types/lib/inventory/cdxrs.d.ts.map +1 -1
package/types/lib/inventory/communityAiConfigParser.d.ts.map +1 -1
package/types/lib/inventory/depsUtils.d.ts +15 -0
package/types/lib/inventory/depsUtils.d.ts.map +1 -1
package/types/lib/inventory/display.d.ts.map +1 -1
package/types/lib/inventory/dosai.d.ts +87 -1
package/types/lib/inventory/dosai.d.ts.map +1 -1
package/types/lib/inventory/dynamic.d.ts.map +1 -1
package/types/lib/inventory/envcontext.d.ts.map +1 -1
package/types/lib/inventory/evidenceUtils.d.ts.map +1 -1
package/types/lib/inventory/fetchBatch.d.ts +34 -0
package/types/lib/inventory/fetchBatch.d.ts.map +1 -1
package/types/lib/inventory/fetchRate.d.ts +9 -6
package/types/lib/inventory/fetchRate.d.ts.map +1 -1
package/types/lib/inventory/forgeEnricher.d.ts.map +1 -1
package/types/lib/inventory/jvmToolEnv.d.ts +5 -4
package/types/lib/inventory/jvmToolEnv.d.ts.map +1 -1
package/types/lib/inventory/mcpConfigParser.d.ts.map +1 -1
package/types/lib/inventory/mcpDiscovery.d.ts.map +1 -1
package/types/lib/inventory/mcpServerManifest.d.ts +19 -0
package/types/lib/inventory/mcpServerManifest.d.ts.map +1 -0
package/types/lib/inventory/mcpbBundle.d.ts +19 -0
package/types/lib/inventory/mcpbBundle.d.ts.map +1 -0
package/types/lib/inventory/plugins.d.ts.map +1 -1
package/types/lib/inventory/protobom.d.ts +18 -13
package/types/lib/inventory/protobom.d.ts.map +1 -1
package/types/lib/inventory/protobomLoader.d.ts.map +1 -1
package/types/lib/inventory/purl.d.ts +71 -2
package/types/lib/inventory/purl.d.ts.map +1 -1
package/types/lib/inventory/sbomDocument.d.ts.map +1 -1
package/types/lib/inventory/source.d.ts.map +1 -1
package/types/lib/inventory/stylePackageRefs.d.ts +17 -0
package/types/lib/inventory/stylePackageRefs.d.ts.map +1 -0
package/types/lib/inventory/svelteUtils.d.ts +124 -0
package/types/lib/inventory/svelteUtils.d.ts.map +1 -0
package/types/lib/inventory/traceRunner.d.ts +47 -1
package/types/lib/inventory/traceRunner.d.ts.map +1 -1
package/types/lib/managers/binary.d.ts +30 -1
package/types/lib/managers/binary.d.ts.map +1 -1
package/types/lib/managers/docker.d.ts +29 -0
package/types/lib/managers/docker.d.ts.map +1 -1
package/types/lib/managers/oci.d.ts +14 -0
package/types/lib/managers/oci.d.ts.map +1 -1
package/types/lib/parsers/cmakeLists.d.ts +76 -0
package/types/lib/parsers/cmakeLists.d.ts.map +1 -0
package/types/lib/parsers/huggingfaceUtils.d.ts +8 -1
package/types/lib/parsers/huggingfaceUtils.d.ts.map +1 -1
package/types/lib/parsers/largeJson.d.ts +52 -0
package/types/lib/parsers/largeJson.d.ts.map +1 -0
package/types/lib/parsers/npmrc.d.ts +5 -0
package/types/lib/parsers/npmrc.d.ts.map +1 -1
package/types/lib/parsers/onnx.d.ts +28 -0
package/types/lib/parsers/onnx.d.ts.map +1 -0
package/types/lib/parsers/safetensors.d.ts +22 -0
package/types/lib/parsers/safetensors.d.ts.map +1 -0
package/types/lib/stages/postgen/introspection/markers.d.ts +3 -2
package/types/lib/stages/postgen/introspection/markers.d.ts.map +1 -1
package/types/lib/stages/postgen/postgen.d.ts +33 -0
package/types/lib/stages/postgen/postgen.d.ts.map +1 -1
package/types/lib/validator/bomValidator.d.ts.map +1 -1
package/types/lib/validator/index.d.ts +10 -1
package/types/lib/validator/index.d.ts.map +1 -1
package/types/lib/validator/reporters/console.d.ts.map +1 -1
package/types/lib/validator/reporters/json.d.ts.map +1 -1
package/types/lib/validator/reporters/sarif.d.ts.map +1 -1

package/lib/inventory/astWorker.js CHANGED Viewed

@@ -9,6 +9,12 @@
 import { parentPort } from "node:worker_threads";
 import { parseFileASTTreeCollected } from "./analyzer.js";
+import { getSvelteTemplateParser } from "./svelteUtils.js";
+// The parse runs synchronously on the worker thread, so the optional Svelte
+// template parser is resolved eagerly here (a silent no-op when the optional
+// package is absent; the built-in script mask covers all scope evidence).
+getSvelteTemplateParser();
 parentPort.on("message", (task) => {
   try {