@cdxgen/cdxgen 13.1.0 → 13.3.0

package/data/remediations.json

@@ -709,6 +709,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "dosai.semantics.persist-failed": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "none",
+    "title": "The combined dosai report could not be written to the semantics slices file; the SBOM evidence is unaffected",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Check that the --semantics-slices-file path is writable and has room for a report the size of the dosai slices."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.semantics.persist-failed"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -905,6 +929,29 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
   },
+  "rust.cargo-metadata-unavailable": {
+    "ecosystem": "rust",
+    "kind": "command.failed",
+    "impact": "components",
+    "title": "cargo metadata could not be executed, so dependency kinds and platform gates were recovered from the manifests alone",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{cargo}} metadata --format-version 1 --locked"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-RS-001"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
+  },
   "php.composer.missing": {
     "ecosystem": "php",
     "kind": "evidence.degraded",

package/data/rules/ai-bom.yaml

@@ -266,3 +266,81 @@
       "parameterCount": $prop($, 'cdx:ai:parameterCount'),
       "source": $prop($, 'cdx:ai:source')
     }
+
+- id: AIS-003
+  name: "Model artifact uses unsafe pickle deserialization"
+  description: "PyTorch pickle model artifacts (.bin/.pt/.pth/.ckpt) execute arbitrary code when loaded, so an untrusted or unverified artifact can run attacker-controlled code in the loading process."
+  severity: high
+  category: ai-security
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1059, T1195.002]
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Accuracy, robustness and cybersecurity"
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Software supply chain visibility"
+      - "Protection against untrusted code execution"
+    nist-ai-rmf:
+      - "Map"
+      - "Manage"
+    nist-ssdf:
+      - "Verify provenance of model artifacts before loading"
+  condition: |
+    components[
+      type = 'machine-learning-model'
+      and $prop($, 'cdx:ai:unsafeDeserialization') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "Model artifact '{{ name }}' loads via unsafe pickle deserialization"
+  mitigation: "Prefer safetensors over pickle checkpoints, or verify artifact provenance and load pickle models only from trusted sources in a sandbox."
+  evidence: |
+    {
+      "artifactFormat": $prop($, 'cdx:ai:artifactFormat'),
+      "source": $prop($, 'cdx:ai:source'),
+      "quantizationMethod": $prop($, 'cdx:ai:quantizationMethod')
+    }
+
+- id: AIS-004
+  name: "ONNX model artifact lacks exporter provenance"
+  description: "ONNX files record the exporting framework and opset versions in their protobuf header. An artifact without this metadata cannot be traced to the toolchain that produced it, which weakens provenance review and can hide compatibility or security-relevant export settings."
+  severity: low
+  category: ai-governance
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    nist-ai-rmf:
+      - "Map"
+      - "Govern"
+  condition: |
+    components[
+      type = 'machine-learning-model'
+      and $prop($, 'cdx:ai:artifactFormat') = 'onnx'
+      and not $hasProp($, 'cdx:onnx:producer')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "ONNX model artifact '{{ name }}' carries no exporter provenance"
+  mitigation: "Re-export the model with a producer that records framework and opset metadata, or record the exporter and opset versions as component properties so the artifact remains traceable."
+  evidence: |
+    {
+      "artifactFormat": $prop($, 'cdx:ai:artifactFormat'),
+      "source": $prop($, 'cdx:ai:source'),
+      "modelId": $prop($, 'cdx:ai:modelId')
+    }

package/data/rules/cargo-rust.yaml

@@ -0,0 +1,132 @@
+# Cargo and Rust Rules
+# Categories: cargo-security, cargo-compliance
+# Evaluates the cdx:cargo:* properties cdxgen emits for Rust projects, with the
+# native-library rules keyed on the `links` evidence that only `--deep` can
+# produce.
+
+- id: CARGO-SEC-001
+  name: "Statically linked native library has no resolvable version"
+  description: "A -sys crate compiles a C library into the artifact, but nothing in the build states which version, so no advisory can be matched against it"
+  severity: medium
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:linkage') = 'static'
+      and ($not($exists(version)) or version = '')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' is compiled into the artifact by '{{ $prop($, 'cdx:cargo:providedBy') }}' with no resolvable version"
+  mitigation: "Pin the library version explicitly, or build against a crate release whose version encodes the upstream version as build metadata. Until the version is known, the bundled library has to be reviewed by hand: a vulnerability scanner matching on purl cannot see it"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "linkageEvidence": $prop($, 'cdx:cargo:linkageEvidence'),
+      "versionCandidates": $prop($, 'cdx:cargo:upstreamVersionCandidates')
+    }
+
+- id: CARGO-SEC-002
+  name: "Native C library is vendored into the Rust artifact"
+  description: "The resolver enabled a vendoring feature, so the library's own advisories and license obligations travel with the binary rather than with the host"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:linkage') = 'static'
+      and $exists(version)
+      and version != ''
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' version '{{ version }}' is compiled into the artifact by '{{ $prop($, 'cdx:cargo:providedBy') }}'"
+  mitigation: "Track this library's advisories directly; the cargo dependency graph will not report them. Confirm that updating the -sys crate is enough to pick up a library fix, and that the vendored build is rebuilt when the library is patched"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "linkageEvidence": $prop($, 'cdx:cargo:linkageEvidence'),
+      "upstreamVersionSource": $prop($, 'cdx:cargo:upstreamVersionSource')
+    }
+
+- id: CARGO-SEC-003
+  name: "Rust artifact links a native library the environment must provide"
+  description: "A -sys crate links a C library dynamically, so the deployed artifact depends on a library version this BOM cannot state"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[$prop($, 'cdx:cargo:linkage') = 'dynamic']
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' is linked dynamically by '{{ $prop($, 'cdx:cargo:providedBy') }}' and has to be present and patched on the deployment host"
+  mitigation: "Record the library version the deployment environment provides, through a container or host inventory. Where the artifact must be self-contained, enable the crate's vendoring feature so the version becomes part of this BOM"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy')
+    }
+
+- id: CARGO-COMP-001
+  name: "Vendored library version is ambiguous between shipped variants"
+  description: "The crate ships several variants of the library and the enabled features do not say which one is compiled, so the version was left unstated"
+  severity: medium
+  category: cargo-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:upstreamVersionCandidates') != null
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' could be any of '{{ $prop($, 'cdx:cargo:upstreamVersionCandidates') }}' depending on which variant '{{ $prop($, 'cdx:cargo:providedBy') }}' compiles"
+  mitigation: "Read the crate's build script to see which variant the enabled features select, then record the version. The variants can carry different licenses, so a license review cannot be completed from this BOM alone"
+  evidence: |
+    {
+      "versionCandidates": $prop($, 'cdx:cargo:upstreamVersionCandidates'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "resolvedFeatures": $prop($, 'cdx:cargo:resolvedFeatures')
+    }
+
+- id: CARGO-SEC-004
+  name: "Crate resolved from a registry other than crates.io"
+  description: "A crate came from an alternative or private registry, which can publish any name and version, including ones that also exist on crates.io"
+  severity: medium
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    $append(components, formulation.components)[
+      $prop($, 'cdx:cargo:alternateRegistry') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Crate '{{ name }}' was resolved from '{{ $prop($, 'cdx:cargo:sourceUrl') }}' rather than crates.io"
+  mitigation: "Confirm the registry is one your organisation operates and that the crate name is not also claimed on crates.io, which would let a resolver change pull a different crate. Verify the registry authenticates publishers and serves checksums"
+  evidence: |
+    {
+      "sourceKind": $prop($, 'cdx:cargo:sourceKind'),
+      "sourceUrl": $prop($, 'cdx:cargo:sourceUrl')
+    }
+
+- id: CARGO-SEC-005
+  name: "Procedural macro crate executes during compilation"
+  description: "A proc-macro crate runs arbitrary code in the compiler on the build host, before any of the project's own code runs"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    $append(components, formulation.components)[
+      $prop($, 'cdx:cargo:procMacro') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Crate '{{ name }}' is a procedural macro and runs in the compiler on every build"
+  mitigation: "Treat this crate's compromise as equivalent to build-host compromise. Review its publisher and release history, pin it, and confirm the build host has no credentials a compile-time macro should not reach"
+  evidence: |
+    {
+      "dependencyKind": $prop($, 'cdx:cargo:dependencyKind'),
+      "publisher": $prop($, 'cdx:cargo:publisher'),
+      "resolvedFeatures": $prop($, 'cdx:cargo:resolvedFeatures')
+    }

package/data/rules/mcp-servers.yaml

@@ -386,3 +386,125 @@
       "configuredServiceCount": $prop($, 'cdx:mcp:configuredServiceCount'),
       "configuredServiceNames": $prop($, 'cdx:mcp:configuredServiceNames')
     }
+
+- id: MCP-009
+  name: "MCP configuration relies on deprecated protocol features"
+  description: "The MCP 2026-07-28 specification deprecates the legacy HTTP+SSE transport, dynamic client registration, sampling, logging, and roots. Configurations that still depend on these features need a migration plan before the deprecation window closes."
+  severity: medium
+  category: mcp-server
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Technical documentation for software components"
+    nist-ai-rmf:
+      - "Govern"
+      - "Map"
+    nist-ssdf:
+      - "Plan migration away from deprecated protocol features"
+  condition: |
+    $auditServices($)[
+      $nullSafeProp($, 'cdx:mcp:deprecatedFeatures') != ''
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP service '{{ name }}' uses deprecated protocol features"
+  mitigation: "Migrate off legacy SSE transport, dynamic client registration, sampling, logging, and roots to the MCP 2026-07-28 replacements within the deprecation window."
+  evidence: |
+    {
+      "protocolVersion": $prop($, 'cdx:mcp:protocolVersion'),
+      "deprecatedFeatures": $prop($, 'cdx:mcp:deprecatedFeatures'),
+      "transport": $prop($, 'cdx:mcp:transport')
+    }
+
+- id: MCP-010
+  name: "MCP bundle declares secret configuration fields"
+  description: "MCPB/DXT bundles that declare secret-typed user_config fields have those values injected into the bundled server's environment on launch. Declaring such a field is the correct way to build a bundle, so this is an inventory disclosure to aid credential-handling review rather than a defect."
+  severity: low
+  category: mcp-server
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Software supply chain visibility"
+    nist-ai-rmf:
+      - "Govern"
+    nist-ssdf:
+      - "Review secret handling in installable AI extensions"
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'mcp-bundle'
+      and $prop($, 'cdx:mcpb:injectsSecretEnv') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP bundle '{{ name }}' declares secret configuration fields injected as environment variables"
+  mitigation: "Review the declared secret fields and prefer runtime secret stores or references over values captured through the extension manifest."
+  evidence: |
+    {
+      "serverType": $prop($, 'cdx:mcpb:serverType'),
+      "secretFieldCount": $prop($, 'cdx:mcpb:secretFieldCount'),
+      "platformBinaryCount": $prop($, 'cdx:mcpb:platformBinaryCount')
+    }
+
+- id: MCP-011
+  name: "MCP bundle ships precompiled platform binaries"
+  description: "MCPB/DXT bundles that ship precompiled per-platform binaries execute vendor-provided native code on the host with no build-from-source step. These binaries deserve provenance and signing review before a bundle is installed."
+  severity: medium
+  category: mcp-server
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1195.002]
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+      - "Accuracy, robustness and cybersecurity"
+    eu-cra:
+      - "Software supply chain visibility"
+      - "Protection against untrusted code execution"
+    nist-ai-rmf:
+      - "Map"
+      - "Manage"
+    nist-ssdf:
+      - "Verify provenance of precompiled binaries before execution"
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'mcp-bundle'
+      and $number($nullSafeProp($, 'cdx:mcpb:platformBinaryCount')) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP bundle '{{ name }}' ships precompiled platform binaries"
+  mitigation: "Verify the provenance and signatures of the bundled platform binaries, or prefer a bundle that builds from source, before installing."
+  evidence: |
+    {
+      "serverType": $prop($, 'cdx:mcpb:serverType'),
+      "platformBinaryCount": $prop($, 'cdx:mcpb:platformBinaryCount')
+    }

package/lib/audit/targets.js

@@ -465,8 +465,13 @@ export async function enrichInputBomsWithRegistryMetadata(inputBoms) {
   process.env.CDXGEN_FETCH_PKG_METADATA = "true";
   try {
     const enrichedCandidates = [
+      // The audit scores publisher drift, ownership and release cadence, none
+      // of which the local Cargo registry records: it knows when a version was
+      // published but not by whom. This path pays the registry's rate limit
+      // deliberately rather than audit against metadata that cannot answer the
+      // questions the rules ask.
       ...(cargoCandidates.length
-        ? await getCratesMetadata(cargoCandidates)
+        ? await getCratesMetadata(cargoCandidates, { preferLocalCache: false })
         : []),
       ...(npmCandidates.length ? await getNpmMetadata(npmCandidates) : []),
       ...(pypiCandidates.length

package/lib/cli/bomAssembly.js

@@ -25,7 +25,10 @@ import {
   CDXGEN_VERSION,
   frameworksList,
 } from "../core/state.js";
-import { isPkgTypeOnlyImport } from "../ecosystems/npmutils.js";
+import {
+  isPkgTypeOnlyImport,
+  setNpmCleanedVersionProperty,
+} from "../ecosystems/npmutils.js";
 import { parsePackageJsonName } from "../ecosystems/parsers-js.js";
 import {
   AI_INSTRUCTION_FILE_KINDS,
@@ -50,8 +53,7 @@ import {
 import { enrichComponentWithMcpMetadata } from "../inventory/mcp.js";
 import {
   applyPurl,
-  encodeForPurl,
-  isValidPurl,
+  canonicalPurlFromLooseString,
   npmPurl,
   tryBuildPurl,
 } from "../inventory/purl.js";
@@ -182,6 +184,31 @@ export const determineParentComponent = (options) => {
   return parentComponent;
 };
 
+/**
+ * Tells whether a `--project-name`/`--project-version` override names the very
+ * project the generator detected, rather than a larger project containing it.
+ *
+ * The override is typed `application` because it can name anything. When its
+ * name, group, and version match the detected parent, the two describe the same
+ * project, and the detected parent is the better description of it: it carries
+ * the ecosystem purl and the manifest metadata. Treating it as a subproject
+ * would list the project as a dependency of itself under a second purl.
+ *
+ * @param {object|undefined} overrideParent Parent built from the options
+ * @param {object|undefined} detectedParent Parent the generator derived
+ * @returns {boolean} true when both describe the same project
+ */
+const overrideNamesDetectedParent = (overrideParent, detectedParent) => {
+  if (!overrideParent || !detectedParent?.purl) {
+    return false;
+  }
+  return (
+    overrideParent.name === detectedParent.name &&
+    (overrideParent.group || "") === (detectedParent.group || "") &&
+    `${overrideParent.version}` === `${detectedParent.version}`
+  );
+};
+
 /**
  * Re-anchor a dependency graph onto a caller-supplied parent component.
  *
@@ -338,7 +365,8 @@ export const componentToSimpleFullName = (comp) => {
 /**
  * Strips transient keys (`evidence`, `_integrity`, `license`, `qualifiers`,
  * `repository`, `homepage`) from a parent component while preserving licenses
- * and external references (bug #1519).
+ * and external references (bug #1519). External references whose URL is not a
+ * valid IRI reference are dropped.
  *
  * @param {object} comp Parent component to clean in place
  * @returns {object} The cleaned parent component
@@ -356,10 +384,15 @@ export const cleanParentComponent = (comp) => {
   }
   delete comp.license;
   delete comp.qualifiers;
-  if (comp.repository || comp.homepage) {
+  // Components get their references validated in listComponents. The parent
+  // skips that conversion, so validate here too: an unusable URL taken from a
+  // manifest must not make the whole document invalid.
+  if (comp.repository || comp.homepage || comp.externalReferences?.length) {
     const externalReferences = addExternalReferences(comp);
     if (externalReferences?.length) {
       comp.externalReferences = externalReferences;
+    } else {
+      delete comp.externalReferences;
     }
   }
   delete comp.repository;
@@ -454,12 +487,18 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
       // name-based bom-ref, and blindly copying that here manufactured invalid
       // purls such as `"purl": "swift-smoke"`. CycloneDX requires `purl` to be
       // a valid Package URL when present, so absent is the only correct answer.
+      // A bom-ref holds the decoded purl (`pkg:npm/app@1.0.0+build`), so it is
+      // split on its separators and rebuilt rather than escaped wholesale,
+      // which would also escape the `@` before the version.
       if (!parentComponent["purl"] && parentComponent["bom-ref"]) {
-        const candidate = encodeForPurl(parentComponent["bom-ref"]);
-        if (isValidPurl(candidate)) {
+        const candidate = canonicalPurlFromLooseString(
+          parentComponent["bom-ref"],
+        );
+        if (candidate) {
           parentComponent["purl"] = candidate;
         }
       }
+      setNpmCleanedVersionProperty(parentComponent);
     }
     if (parentComponent?.components) {
       parentComponent.components = listComponents(
@@ -841,6 +880,7 @@ export function addExternalReferences(opkg) {
     }
   }
   return externalReferences
+    .filter((reference) => typeof reference?.url === "string")
     .map((reference) => ({ ...reference, url: reference.url.trim() }))
     .filter((reference) => isValidIriReference(reference.url));
 }
@@ -1014,13 +1054,16 @@ export function addComponent(
     let purl = pkg.purl;
     if (!purl && ptype) {
       try {
+        // Raw values: cdx-purl escapes each component itself, so escaping
+        // them here first turned `@scope` into `%2540scope` and
+        // `libstdc++6` into `libstdc%252B%252B6`.
         purl = new Purl({
           type: ptype,
-          namespace: encodeForPurl(group) || null,
-          name: encodeForPurl(name),
+          namespace: group || null,
+          name,
           version: version || null,
           qualifiers: pkg.qualifiers || null,
-          subpath: encodeForPurl(pkg.subpath) || null,
+          subpath: pkg.subpath || null,
         });
       } catch {
         // purl construction may fail for types requiring a namespace (maven,
@@ -1071,9 +1114,10 @@ export function addComponent(
         } else {
           compScope = "required";
         }
-      } else if (impPkgs.length && compScope !== "excluded") {
-        compScope = "optional";
       }
+      // A package missing from the imports keeps its scope. Usage analysis
+      // only promotes: the ecosystem passes have already scoped the package
+      // list, and a missing import is not evidence that a package is optional.
     }
     let component = {
       author,
@@ -1089,6 +1133,11 @@ export function addComponent(
       purl: purlString,
       externalReferences: addExternalReferences(pkg),
     };
+    // A CPE from the collector (caxa records one for the bundled Node.js
+    // runtime) is how NVD-based scanners match the component.
+    if (typeof pkg.cpe === "string" && pkg.cpe.length) {
+      component.cpe = pkg.cpe;
+    }
     if (options.specVersion >= 1.5) {
       component.pedigree = pkg.pedigree || undefined;
     }
@@ -1097,7 +1146,26 @@ export function addComponent(
       component.modelCard = pkg.modelCard || undefined;
       component.data = pkg.data || undefined;
     }
+    if (options.specVersion >= 1.7) {
+      // An external component is provided by the deployment environment rather
+      // than bundled with the product. The schema defaults it to false, so it
+      // is only worth emitting when true.
+      component.isExternal = pkg.isExternal ? true : undefined;
+      // A range describes an external dependency named without a resolved
+      // version, such as the Ruby a gem requires. The schema allows it only
+      // on an external component, and never next to a version.
+      component.versionRange =
+        pkg.isExternal && !pkg.version
+          ? pkg.versionRange || undefined
+          : undefined;
+    }
     component["type"] = determinePackageType(pkg);
+    // `version` is optional in every spec version cdxgen emits. An empty string
+    // is not a version, and a consumer reading one has to guess whether it means
+    // "unknown" or "the empty release"; leaving the field out says it plainly.
+    if (!component.version) {
+      delete component.version;
+    }
     if (pkg["bom-ref"]) {
       component["bom-ref"] = pkg["bom-ref"];
     } else if (purlString) {
@@ -1119,9 +1187,16 @@ export function addComponent(
     if (options.specVersion >= 1.6 && component.author) {
       const authorsList = [];
       for (const aauthor of component.author.split(",")) {
-        authorsList.push({ name: aauthor });
+        // Registries hand out comma separated lists without a consistent
+        // spacing, so `A, B` and `A,B` must produce the same names
+        const name = aauthor.trim();
+        if (name.length) {
+          authorsList.push({ name });
+        }
+      }
+      if (authorsList.length) {
+        component.authors = authorsList;
       }
-      component.authors = authorsList;
       delete component.author;
     }
     // Downgrade authors section for < 1.5 :(
@@ -1157,6 +1232,7 @@ export function addComponent(
     if (pkg.properties?.length) {
       component.properties = pkg.properties;
     }
+    setNpmCleanedVersionProperty(component);
     if (isTypeOnlyPkg) {
       component.properties = component.properties || [];
       if (
@@ -1273,6 +1349,25 @@ export function determinePackageType(pkg) {
       ) {
         return "library";
       }
+      // A gem is a framework only when the curated list names that very gem:
+      // the prefix matches below took rails-html-sanitizer and sinatra-contrib
+      // for their frameworks, and the bare words meant for other ecosystems
+      // turned childprocess ("chi") and jquery-rails ("jquery") into
+      // frameworks. Any other gem is a library, unless it ships executables,
+      // which makes it an application (discussions 4405 and 4408). A
+      // description or keyword that merely mentions a framework is no evidence
+      // of one: every gem whose summary says "tracing framework" would
+      // otherwise become a framework component.
+      if (purl.type === "gem") {
+        if (frameworksList.all.includes(`pkg:gem/${purl.name}`)) {
+          return "framework";
+        }
+        const hasExecutables = pkg.properties?.some(
+          (prop) =>
+            prop.name === "cdx:gem:executables" && prop.value?.trim().length,
+        );
+        return hasExecutables ? "application" : "library";
+      }
       for (const cf of frameworksList.all) {
         if (
           pkg.purl.startsWith(cf) ||
@@ -1454,7 +1549,14 @@ export const buildBomNSData = (options, pkgInfo, ptype, context) => {
   }
   const nsMapping = context.nsMapping || {};
   const services = context.services || [];
-  const overrideParent = determineParentComponent(options);
+  let overrideParent = determineParentComponent(options);
+  // A caller-supplied parentComponent is always honoured as given
+  if (
+    overrideParent !== options.parentComponent &&
+    overrideNamesDetectedParent(overrideParent, context.parentComponent)
+  ) {
+    overrideParent = undefined;
+  }
   const parentComponent = overrideParent || context.parentComponent;
   const metadata = addMetadata(parentComponent, options, context);
   const components = listComponents(options, allImports, pkgInfo, ptype);