@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/inventory/dynamic.js

@@ -34,6 +34,7 @@ export async function buildDynamicComponents(
   const result = await executeAndTrace(commandStr, workingDir, traceOptions);
   const libPaths = result.libPaths || [];
   const httpAccessEntries = result.httpAccessEntries || [];
+  const egressEntries = result.egressEntries || [];
   const cryptoComponents = result.cryptoComponents || [];
   const components = [];
 
@@ -141,5 +142,42 @@ export async function buildDynamicComponents(
     };
   });
 
-  return { components, services };
+  // Egress seen by the safer-exec proxy: hostnames the command connected to
+  // (allowed) or tried to reach (denied). This works on every platform,
+  // including macOS where eBPF URL tracing is unavailable.
+  const servicesByName = new Map(services.map((svc) => [svc.name, svc]));
+  for (const egress of egressEntries) {
+    const name = `dynamic-${egress.host}-${egress.port}`;
+    const defaultPort = egress.protocol === "http" ? 80 : 443;
+    const endpoint = `${egress.protocol}://${egress.host}${egress.port !== defaultPort ? `:${egress.port}` : ""}`;
+    let svc = servicesByName.get(name);
+    if (!svc) {
+      svc = {
+        name,
+        bomRef: `urn:service:dynamic:${name}`,
+        endpoints: [],
+        properties: [],
+      };
+      servicesByName.set(name, svc);
+      services.push(svc);
+    }
+    if (!svc.endpoints.some((e) => e.startsWith(endpoint))) {
+      svc.endpoints.push(endpoint);
+      svc.endpoints.sort();
+    }
+    if (
+      !svc.properties.some(
+        (p) =>
+          p.name === "cdx:dynamic:egressDecision" &&
+          p.value === egress.decision,
+      )
+    ) {
+      svc.properties.push({
+        name: "cdx:dynamic:egressDecision",
+        value: egress.decision,
+      });
+    }
+  }
+
+  return { components, services, dryRunSummary: result.dryRunSummary };
 }

package/lib/inventory/envcontext.js

@@ -101,15 +101,18 @@ function hardenedGitEnv() {
  * @type {Object<string, string>}
  */
 export const SDKMAN_JAVA_TOOL_ALIASES = {
-  java8: readEnvironmentVariable("JAVA8_TOOL") || "8.0.452-amzn", // Temurin no longer offers java8 :(
-  java11: readEnvironmentVariable("JAVA11_TOOL") || "11.0.31-tem",
-  java17: readEnvironmentVariable("JAVA17_TOOL") || "17.0.19-tem",
-  java21: readEnvironmentVariable("JAVA21_TOOL") || "21.0.11-tem",
+  // Identifiers must be downloadable from the sdkman broker: the `sdk list`
+  // output advertises Temurin respin ids such as 21.0.12+1.1-tem, but the
+  // broker cannot serve ids containing '+', so the plain ids are pinned.
+  java8: readEnvironmentVariable("JAVA8_TOOL") || "8.0.504-zulu", // Temurin no longer offers java8 :(
+  java11: readEnvironmentVariable("JAVA11_TOOL") || "11.0.32-tem",
+  java17: readEnvironmentVariable("JAVA17_TOOL") || "17.0.20-tem",
+  java21: readEnvironmentVariable("JAVA21_TOOL") || "21.0.12-tem",
   java22: readEnvironmentVariable("JAVA22_TOOL") || "22.0.2-tem",
   java23: readEnvironmentVariable("JAVA23_TOOL") || "23.0.2-tem",
   java24: readEnvironmentVariable("JAVA24_TOOL") || "24.0.2-tem",
-  java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.3-tem",
-  java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.1-tem",
+  java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.4-tem",
+  java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.2-tem",
 };
 
 /**

package/lib/inventory/evidenceUtils.js

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import { platform } from "node:os";
 import { extname } from "node:path";
 
@@ -6,6 +5,10 @@ import { build } from "@cdxgen/cdx-purl";
 
 import { safeExistsSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
+import {
+  addDosaiReachabilityProperties,
+  readDosaiMethodsReport,
+} from "./dosai.js";
 import {
   addDosaiSetValue,
   buildDosaiPurlAliasMap,
@@ -256,6 +259,7 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
   const purlLocationMap = {};
   const purlModulesMap = {};
   const purlMethodsMap = {};
+  const purlReachabilityMap = {};
   const purlAliasMap = buildDosaiPurlAliasMap(pkgList);
   for (const apkg of pkgList) {
     if (apkg.properties && Array.isArray(apkg.properties)) {
@@ -273,10 +277,16 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
         });
     }
   }
-  let slicesData;
-  try {
-    slicesData = JSON.parse(readFileSync(slicesFile, "utf-8"));
-  } catch (_err) {
+  // Only MethodCalls into a package .dll produce evidence below, so a report
+  // too large to parse whole keeps just those.
+  const slicesData = readDosaiMethodsReport(slicesFile, {
+    keepMethodCall: (methodCall) =>
+      Boolean(
+        methodCall?.Module?.endsWith(".dll") &&
+          pkgFilePurlMap[methodCall.Module],
+      ),
+  });
+  if (!slicesData) {
     return pkgList;
   }
   if (slicesData && Object.keys(slicesData)) {
@@ -340,6 +350,9 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
         if (!modPurl) {
           continue;
         }
+        // Confidence/evidence facts for this purl, applied to the component below so an
+        // unbuilt tree stays distinguishable from an only-imported package.
+        purlReachabilityMap[modPurl] ??= reachability;
         let hasExplicitSourceLocations = false;
         for (const sourceLocation of reachability.SourceLocations || []) {
           const location = dosaiSourceLocation(sourceLocation);
@@ -456,6 +469,14 @@ export function addEvidenceForDotnet(pkgList, slicesFile) {
       "I didn't find any occurrence evidence or detailed imported modules, even though there is good dependency slice data from dosai. This is surprising.",
     );
   }
+  // Reachability confidence facts (kind, confidence, evidence, reasons) as properties.
+  // Applied outside the location guard: a Low-confidence unbuilt tree must stay
+  // distinguishable from an only-imported package even when no locations were found.
+  for (const apkg of pkgList) {
+    if (purlReachabilityMap[apkg.purl]) {
+      addDosaiReachabilityProperties(apkg, purlReachabilityMap[apkg.purl]);
+    }
+  }
   return pkgList;
 }
 

package/lib/inventory/fetchBatch.js

@@ -248,33 +248,178 @@ export async function prefetchJson(requests, options = {}) {
  * - a non-JSON `responseType`, since the envelope has nowhere to put HTML;
  * - request-specific `headers`, since cdxrs derives its own Authorization from
  *   `GITHUB_TOKEN` and would silently drop any other credential, turning an
- *   authenticated lookup into an anonymous one.
+ *   authenticated lookup into an anonymous one;
+ * - anything addressed to a host whose rate policy only one transport knows.
+ *   crates.io's crawler policy allows one request per second with no
+ *   parallelism, and package.elm-lang.org has a JS-only allowance because
+ *   rate.rs carries no row for it. Both transports keep separate gates, so a
+ *   batch split across the two would issue twice the agreed rate; the JS pool
+ *   owns these hosts so there is one gate to reason about.
  *
  * The pool applies the same global and per-host concurrency and rate policy, so
  * the batching win is unaffected; only the on-disk cache is skipped.
  *
- * @param {{responseType?: string, headers?: Object}} request
+ * @param {{url?: string, responseType?: string, headers?: Object}} request
  * @returns {boolean}
  */
 function cdxrsCanServe(request) {
   if (request.responseType && request.responseType !== "json") {
     return false;
   }
+  if (isSingleGateHost(extractHost(request.url))) {
+    return false;
+  }
   return !request.headers || !Object.keys(request.headers).length;
 }
 
+/**
+ * Whether a hostname belongs to crates.io, including its index and CDN hosts.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export function isCratesHost(host) {
+  if (!host) {
+    return false;
+  }
+  const lower = host.toLowerCase();
+  return lower === "crates.io" || lower.endsWith(".crates.io");
+}
+
+/**
+ * Whether a host's rate policy lives in the JS table alone and therefore needs
+ * every request to pass through the one gate the JS pool holds.
+ *
+ * @param {string|null} host Hostname, or null when the URL did not parse.
+ * @returns {boolean}
+ */
+export function isSingleGateHost(host) {
+  if (!host) {
+    return false;
+  }
+  return isCratesHost(host) || host.toLowerCase() === "package.elm-lang.org";
+}
+
+/**
+ * Most URLs sent to one `cdxrs fetch` run. The envelope comes back as a single
+ * JSON string and V8 caps strings at ~512 MB, while a full npm packument is a
+ * few hundred KB on average and tens of MB for the largest packages. One run
+ * per workspace therefore outgrew the limit on large pnpm workspaces (issue
+ * 4393); runs of this size stay far below it for any realistic mix.
+ */
+const RUST_FETCH_CHUNK_SIZE = 250;
+
 /**
  * Run the batch through the `cdxrs fetch` subprocess and translate its
  * envelope into the shared result shape.
  *
+ * The URLs go out in chunks of {@link RUST_FETCH_CHUNK_SIZE}, one run at a time
+ * so each host still sees a single rate gate. A chunk whose envelope is still
+ * too large to deliver is split in half and retried, which is cheap because
+ * the first attempt filled the cdxrs disk cache. A chunk that fails for any
+ * other reason falls back to the JS pool on its own, so one bad run never
+ * costs the rest of the batch its Rust fetch.
+ *
  * @param {Array<{url: string, accept?: string, authRealm?: string}>} unique
  *   Already deduplicated by URL.
  * @param {Object} options Options with `timeoutMs`.
  * @returns {Promise<Map<string, BatchEntry>>}
  */
 async function rustBatchFetch(unique, options) {
+  const pending = [];
+  for (let i = 0; i < unique.length; i += RUST_FETCH_CHUNK_SIZE) {
+    pending.push(unique.slice(i, i + RUST_FETCH_CHUNK_SIZE));
+  }
+  const results = new Map();
+  const chunkStats = [];
+  while (pending.length) {
+    const chunk = pending.shift();
+    const outcome = await rustFetchChunk(chunk, options);
+    if (outcome.reason === "stdout-too-large" && chunk.length > 1) {
+      const middle = Math.ceil(chunk.length / 2);
+      pending.unshift(chunk.slice(0, middle), chunk.slice(middle));
+      continue;
+    }
+    if (!outcome.results) {
+      // Not "binary absent" (that never reaches here), so fall through to the
+      // JS pool rather than returning nothing: a transient cdxrs crash must
+      // not take this chunk's concurrency with it.
+      for (const [url, entry] of await jsBatchFetch(chunk)) {
+        results.set(url, entry);
+      }
+      chunkStats.push(_lastStats);
+      continue;
+    }
+    for (const [url, entry] of outcome.results) {
+      results.set(url, entry);
+    }
+    chunkStats.push(outcome.stats);
+  }
+  _lastStats = combineBatchStats(chunkStats);
+  if (DEBUG_MODE && _lastStats) {
+    const s = _lastStats;
+    console.log(
+      `cdxrs fetch: ${s.requests} url(s), ${s.unique} unique, ${s.ok} ok, ${s.failures} failed, ${s.cacheHits} cached, peak concurrency ${s.peakConcurrency}, ${s.elapsedMs} ms`,
+    );
+  }
+  return results;
+}
+
+/**
+ * Add up the stats of the runs that served one batch. Numeric fields sum
+ * because the runs are sequential, except peak concurrency, which is the
+ * widest run. Per-host entries under `hosts` are combined the same way.
+ *
+ * @param {Array<Object|null|undefined>} parts Stats from each run.
+ * @returns {Object|null} Combined stats, or null when no run reported any.
+ */
+function combineBatchStats(parts) {
+  const reported = parts.filter(Boolean);
+  if (!reported.length) {
+    return null;
+  }
+  if (reported.length === 1) {
+    return reported[0];
+  }
+  const combined = addStats({}, reported);
+  const hosts = {};
+  for (const part of reported) {
+    for (const [host, entry] of Object.entries(part.hosts || {})) {
+      hosts[host] = addStats(hosts[host] || {}, [entry]);
+    }
+  }
+  if (Object.keys(hosts).length) {
+    combined.hosts = hosts;
+  }
+  return combined;
+}
+
+function addStats(target, parts) {
+  for (const part of parts) {
+    for (const [key, value] of Object.entries(part)) {
+      if (typeof value !== "number") {
+        continue;
+      }
+      target[key] =
+        key === "peakConcurrency"
+          ? Math.max(target[key] || 0, value)
+          : (target[key] || 0) + value;
+    }
+  }
+  return target;
+}
+
+/**
+ * Run one chunk through `cdxrs fetch`.
+ *
+ * @param {Array<{url: string, accept?: string, authRealm?: string}>} chunk
+ * @param {Object} options Options with `timeoutMs`.
+ * @returns {Promise<{results?: Map<string, BatchEntry>, stats?: Object, reason?: string}>}
+ *   `results` when the run succeeded; otherwise the reason it did not.
+ */
+async function rustFetchChunk(chunk, options) {
   const payload = { requests: [] };
-  for (const request of unique) {
+  for (const request of chunk) {
     payload.requests.push({
       id: request.url,
       url: request.url,
@@ -291,20 +436,19 @@ async function rustBatchFetch(unique, options) {
   if (!ok) {
     if (DEBUG_MODE && reason !== "disabled" && reason !== "binary-not-found") {
       console.log(
-        `cdxrs fetch unavailable (${reason}); falling back to the JS batch pool.`,
+        reason === "stdout-too-large" && chunk.length > 1
+          ? `cdxrs fetch output for ${chunk.length} url(s) is too large; retrying in two halves.`
+          : `cdxrs fetch unavailable (${reason}); falling back to the JS batch pool.`,
       );
     }
-    // The Rust path failed in a way that is not "binary absent". Fall through
-    // to the JS pool rather than returning an empty map, so a transient cdxrs
-    // crash does not take the whole batch's concurrency with it.
-    return await jsBatchFetch(unique);
+    return { reason };
   }
 
   let envelope;
   try {
     envelope = JSON.parse(stdout);
   } catch (_err) {
-    return await jsBatchFetch(unique);
+    return { reason: "malformed-envelope" };
   }
   if (envelope?.schemaVersion !== BATCH_SCHEMA_VERSION) {
     // A binary from a different generation of this protocol is not something
@@ -314,10 +458,9 @@ async function rustBatchFetch(unique, options) {
         `cdxrs fetch envelope version ${envelope?.schemaVersion} != ${BATCH_SCHEMA_VERSION}; falling back to the JS batch pool.`,
       );
     }
-    return await jsBatchFetch(unique);
+    return { reason: "version-mismatch" };
   }
 
-  _lastStats = envelope.stats || null;
   const results = new Map();
   for (const result of envelope.results || []) {
     if (!result?.id) {
@@ -335,14 +478,7 @@ async function rustBatchFetch(unique, options) {
     const definite = status >= 400 && status < 500 && status !== 429;
     results.set(result.id, { ok: false, status, definite });
   }
-
-  if (DEBUG_MODE && envelope.stats) {
-    const s = envelope.stats;
-    console.log(
-      `cdxrs fetch: ${s.requests} url(s), ${s.unique} unique, ${s.ok} ok, ${s.failures} failed, ${s.cacheHits} cached, peak concurrency ${s.peakConcurrency}, ${s.elapsedMs} ms`,
-    );
-  }
-  return results;
+  return { results, stats: envelope.stats || null };
 }
 
 /**
@@ -700,6 +836,41 @@ async function fetchOne(request, gauge) {
   }
 }
 
+/**
+ * Run a caller's own request under the same per-host gate the batch pool uses.
+ *
+ * Not every registry lookup goes through the pool: a caller that misses the
+ * prefetch, or runs with prefetching disabled, issues `cdxgenAgent.get`
+ * directly. Those requests reach the same host and count against the same
+ * published budget, so they have to queue behind the same limiter rather than
+ * a second one — crates.io's one-request-per-second policy is not honoured by
+ * two independent gates that each allow one per second.
+ *
+ * The per-host semaphore and limiter are module state, so this shares one gate
+ * per host for the life of the process.
+ *
+ * @template T
+ * @param {string} url The URL about to be requested.
+ * @param {() => Promise<T>} issue Issues the request and resolves its result.
+ * @returns {Promise<T>} Whatever `issue` resolves to.
+ */
+export async function withHostRateLimit(url, issue) {
+  const host = extractHost(url);
+  if (!host) {
+    return await issue();
+  }
+  const controls = getHostControls(host);
+  const releaseGlobal = await _globalSemaphore.acquire();
+  const releaseHost = await controls.sem.acquire();
+  try {
+    await controls.limiter.wait();
+    return await issue();
+  } finally {
+    releaseHost();
+    releaseGlobal();
+  }
+}
+
 /**
  * Dedupe key for an in-flight request: the URL, plus everything that changes
  * which response the caller gets back. That is the headers which change what

package/lib/inventory/fetchRate.js

@@ -2,18 +2,21 @@
  * Per-host rate policy for batched registry fetches.
  *
  * This is the single source of truth for the JS transport's concurrency and
- * minimum-interval decisions. The numbers are shared with the Rust transport
+ * minimum-interval decisions. Every number is shared with the Rust transport
  * (`cdxgen-plugins-bin/thirdparty/cdxrs/src/fetch/rate.rs`); a change to one
  * side must be reflected in the other, and `fetchRate.poku.js` pins them so a
- * drift is visible.
+ * drift is visible. crates.io and package.elm-lang.org are routed so that their
+ * requests never reach the Rust transport, which makes this table the one that
+ * governs them in practice — their rows are mirrored there regardless, because
+ * two tables that disagree are a bug waiting for the routing to change.
  *
  * Why a per-host table rather than a single global interval: a single-registry
  * project — which is to say, almost every npm project — has exactly one host,
  * so a conservative per-host cap *is* the global cap. Applying crates.io's
- * 250 ms to every host caps an npm run at 4 requests per second, which is
- * slower than the serial JS path once connection reuse is taken into account.
- * Hosts that publish a limit get an interval; hosts that do not are bounded by
- * the per-host concurrency cap alone, and by whatever `Retry-After` they send.
+ * one-per-second policy to every host would cap an npm run at one request a
+ * second, orders of magnitude slower than that registry asks for. Hosts that
+ * publish a limit get an interval; hosts that do not are bounded by the
+ * per-host concurrency cap alone, and by whatever `Retry-After` they send.
  */
 
 import { readEnvironmentVariable } from "../core/activity.js";
@@ -48,13 +51,18 @@ import { readEnvironmentVariable } from "../core/activity.js";
  * Suffix match is used so `index.crates.io` inherits `crates.io`.
  */
 const HOST_POLICIES = [
-  // crates.io's published budget is per IP and does not improve with a token.
+  // crates.io's crawler policy asks for at most one request per second, made
+  // serially. It is a condition of use rather than a throughput hint, so the
+  // interval is a full second and the concurrency is 1: with more than one
+  // request in flight the gate would still average a second apiece but would
+  // deliver them in bursts, which is the thing the policy rules out. The
+  // budget is per IP and does not improve with a token.
   {
     host: "crates.io",
-    anonInterval: 250,
-    anonConcurrency: 4,
-    authInterval: 250,
-    authConcurrency: 4,
+    anonInterval: 1000,
+    anonConcurrency: 1,
+    authInterval: 1000,
+    authConcurrency: 1,
   },
   // GitHub: 60 req/h anonymous, 5000 req/h authenticated. The limit is an
   // hourly budget rather than a rate, so a batch of a few hundred lookups is
@@ -88,6 +96,61 @@ const HOST_POLICIES = [
     authInterval: 250,
     authConcurrency: 4,
   },
+  // package.elm-lang.org publishes no limit: its robots.txt carries no
+  // `Crawl-delay` and the registry has no terms of use or documented API. What
+  // it does have is a single community-run origin rather than a CDN, so it is
+  // held to the same gentle allowance as the other unpublished host in this
+  // table instead of the CDN default. Like crates.io, its requests are kept off
+  // the Rust transport to leave one gate in charge; rate.rs still carries the
+  // same row so the two tables state one policy.
+  // Maven Central publishes no numeric limit. What it publishes instead is a
+  // policy: consumption limits are enforced against aggregate traffic, the
+  // thresholds are unpublished and moving downward, and the named offenders are
+  // "CI/CD platforms, security scanners, and other services that generate
+  // outsized traffic" — which is cdxgen's exact job description. A block is an
+  // escalating ban of up to 30 days, not a per-request 429, so the cost of
+  // being slightly too fast is losing Maven resolution for a month rather than
+  // retrying a second later. That asymmetry, not a published number, is what
+  // sets these rows.
+  //
+  // repo1 is the artifact store: Cloudflare-fronted (`cf-cache-status` on every
+  // response), and a POM fetch that hits the edge cache never reaches Sonatype.
+  // It gets a real allowance — 100 ms and 8 in flight, so ~10 req/s sustained —
+  // which is half the CDN default and orders of magnitude below anything that
+  // would show up in the top few percent of Central's traffic.
+  {
+    host: "repo1.maven.org",
+    anonInterval: 100,
+    anonConcurrency: 8,
+    authInterval: 100,
+    authConcurrency: 8,
+  },
+  // The search API is the opposite: a Solr query against the origin, one
+  // request per unknown jar hash, cacheable by nobody. cdxgen already treats it
+  // as fragile — a single timeout or 429 disables jar search for the rest of
+  // the run — so the gate is a serial 500 ms (~2 req/s). A jar sweep stays
+  // usable while staying far below anything worth throttling.
+  {
+    host: "search.maven.org",
+    anonInterval: 500,
+    anonConcurrency: 1,
+    authInterval: 500,
+    authConcurrency: 1,
+  },
+  {
+    host: "central.sonatype.com",
+    anonInterval: 500,
+    anonConcurrency: 1,
+    authInterval: 500,
+    authConcurrency: 1,
+  },
+  {
+    host: "package.elm-lang.org",
+    anonInterval: 250,
+    anonConcurrency: 4,
+    authInterval: 250,
+    authConcurrency: 4,
+  },
 ];
 
 /**

package/lib/inventory/forgeEnricher.js

@@ -1,4 +1,5 @@
 import { cdxgenAgent, readEnvironmentVariable } from "../core/activity.js";
+import { getUserAgent } from "../core/userAgent.js";
 import { getOriginUrl } from "./envcontext.js";
 import { prefetchJson } from "./fetchBatch.js";
 
@@ -123,7 +124,7 @@ export async function enrichFromForge(dir, aiCommits, options = {}) {
     const githubHeaders = {
       Accept: "application/vnd.github+json",
       Authorization: `Bearer ${githubToken}`,
-      "User-Agent": "cdxgen-oversight",
+      "User-Agent": getUserAgent("api.github.com"),
     };
     const pullsUrlFor = (commit) =>
       `https://api.github.com/repos/${owner}/${repo}/commits/${commit.hash}/pulls`;
@@ -214,7 +215,7 @@ export async function enrichFromForge(dir, aiCommits, options = {}) {
     const commitsToQuery = aiCommits.slice(0, 5);
     const gitlabHeaders = {
       "PRIVATE-TOKEN": gitlabToken,
-      "User-Agent": "cdxgen-oversight",
+      "User-Agent": getUserAgent("gitlab.com"),
     };
     const mrUrlFor = (commit) =>
       `https://gitlab.com/api/v4/projects/${projectEncoded}/repository/commits/${commit.hash}/merge_requests`;

package/lib/inventory/jvmToolEnv.js

@@ -45,10 +45,11 @@ const JVM_BUILD_TOOL_CANDIDATES = ["maven", "gradle", "sbt", "scala"];
 
 /**
  * Anchored validator for sdkman version identifiers such as `3.9.9`,
- * `4.0.0-rc-5`, `8.14`, or `21.0.7-tem`. Versions are interpolated into a
- * shell command by the sdkman installer, so every identifier must be a single
- * safe token: it must start with a digit and may only contain digits, ascii
- * letters, dots, and hyphens.
+ * `4.0.0-rc-5`, `8.14`, `21.0.7-tem`, or `26.0.2+1.1-tem`. Versions are
+ * interpolated into a shell command by the sdkman installer, so every
+ * identifier must be a single safe token: it must start with a digit and may
+ * only contain digits, ascii letters, dots, hyphens, and plus signs (`+` has
+ * no shell meaning and sdkman uses it in Temurin respin identifiers).
  *
  * Every separator must be followed by at least one alphanumeric character, and
  * a single repeated group covers both the dotted numeric part and the vendor
@@ -63,7 +64,7 @@ export function isValidSdkmanVersion(version) {
     typeof version === "string" &&
     version.length > 0 &&
     version.length <= MAX_VERSION_TOKEN_LENGTH &&
-    /^\d+(?:[-.][0-9A-Za-z]+)*$/.test(version)
+    /^\d+(?:[-.+][0-9A-Za-z]+)*$/.test(version)
   );
 }