@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/cli/jvmBom.js

@@ -167,14 +167,14 @@ export async function createJarBom(path, options) {
   const parentComponent = createDefaultParentComponent(path, "maven", options);
   if (options.useGradleCache) {
     nsMapping = await collectGradleDependencies(
-      getGradleCommand(path, null),
+      getGradleCommand(path, null, options),
       path,
       false,
       true,
     );
   } else if (options.useMavenCache) {
     nsMapping = await collectMvnDependencies(
-      getMavenCommand(path, null),
+      getMavenCommand(path, null, options),
       null,
       false,
       true,
@@ -245,6 +245,8 @@ export function discoverSbtProjectsFromCmd(basePath, sbtCmd, env) {
       {
         cwd: basePath,
         shell: true,
+        // The quotes around the sbt command are for the shell to strip.
+        cdxgenRawShellArgs: true,
         env,
         encoding: "utf-8",
       },
@@ -453,7 +455,7 @@ export async function createJavaBom(path, options) {
         }
       }
       const firstPom = pomFiles.length ? pomFiles[0] : undefined;
-      let mavenCmd = getMavenCommand(path, path);
+      let mavenCmd = getMavenCommand(path, path, options);
       for (const f of pomFiles) {
         const basePath = dirname(f);
         if (
@@ -473,7 +475,7 @@ export async function createJavaBom(path, options) {
           );
         }
         if (mavenCmd?.endsWith("mvn")) {
-          mavenCmd = getMavenCommand(basePath, path);
+          mavenCmd = getMavenCommand(basePath, path, options);
         }
         // Should we attempt to resolve class names
         if (options.resolveClass || options.deep) {
@@ -1041,11 +1043,23 @@ export async function createJavaBom(path, options) {
       if (resolveGradleDistribution && gradleInitArgs.length) {
         gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
-      parallelPropTaskOut = executeParallelGradleProperties(
-        gradleRootPath,
-        [null].concat(includedBuilds),
-        gradleInitArgs,
-      );
+      // `gradle properties` evaluates the project's build scripts, so it is
+      // part of the dependency-tooling surface gated by --no-install-deps
+      // (and the pre-build lifecycle).
+      const gradleToolingAllowed =
+        options.installDeps !== false || options.introspect === true;
+      if (gradleToolingAllowed) {
+        parallelPropTaskOut = executeParallelGradleProperties(
+          gradleRootPath,
+          [null].concat(includedBuilds),
+          gradleInitArgs,
+          options,
+        );
+      } else {
+        console.log(
+          "Skipping 'gradle properties' since dependency installation is disabled. Only statically parsed Gradle metadata will be used.",
+        );
+      }
       if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
         const outputLines = parallelPropTaskOut.split("\n");
         for (const [_i, line] of outputLines.entries()) {
@@ -1073,7 +1087,14 @@ export async function createJavaBom(path, options) {
           }
           parallelPropTaskOut = parallelPropTaskOut.concat(
             "\n",
-            executeParallelGradleProperties(gradleRootPath, includedBuilds),
+            gradleToolingAllowed
+              ? executeParallelGradleProperties(
+                  gradleRootPath,
+                  includedBuilds,
+                  [],
+                  options,
+                )
+              : "",
           );
         }
       }
@@ -1114,6 +1135,8 @@ export async function createJavaBom(path, options) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
           allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+          [],
+          options,
         );
         const splitPropTaskOut = splitOutputByGradleProjects(
           parallelPropTaskOut,
@@ -1161,7 +1184,7 @@ export async function createJavaBom(path, options) {
       )
     ) {
       allProjects.push(parentComponent);
-      const gradleCmd = getGradleCommand(gradleRootPath, null);
+      const gradleCmd = getGradleCommand(gradleRootPath, null, options);
       const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         : "dependencies";
@@ -1639,6 +1662,13 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         }
+      } else if (options.installDeps === false && !options.introspect) {
+        // Executing sbt evaluates the project's build definition (arbitrary
+        // Scala), so it belongs to the dependency-tooling surface disabled
+        // by --no-install-deps and the pre-build lifecycle.
+        console.log(
+          "Skipping sbt dependencyTree since dependency installation is disabled. Only statically parsed sbt metadata will be used.",
+        );
       } else {
         const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
         let sbtVersion = determineSbtVersion(path);
@@ -1754,6 +1784,9 @@ export async function createJavaBom(path, options) {
           const result = safeSpawnSync(SBT_CMD, sbtArgs, {
             cwd: basePath,
             shell: true,
+            // The sbt commands below embed their own shell quoting, which the
+            // shell must strip for sbt to see separate commands.
+            cdxgenRawShellArgs: true,
             env,
           });
           if (result.status !== 0 || result.error) {
@@ -1893,6 +1926,7 @@ export async function createJavaBom(path, options) {
 
     if (
       millFiles?.length &&
+      (options.installDeps !== false || options.introspect === true) &&
       isPackageManagerAllowed(
         "mill",
         ["bazel", "sbt", "gradle", "maven"],
@@ -1905,7 +1939,7 @@ export async function createJavaBom(path, options) {
         "maven",
         options,
       );
-      const millCmd = getMillCommand(millRootPath);
+      const millCmd = getMillCommand(millRootPath, options);
       const millCommonArgs = [
         "--color",
         "false",

package/lib/cli/managedBom.js

@@ -73,7 +73,10 @@ import {
   getPyModules,
 } from "../ecosystems/pythonutils.js";
 import {
+  addRubyGemsDistributionUrls,
+  addRubyRuntimeComponent,
   collectGemModuleNames,
+  describeProjectGem,
   enrichGemsFromLocalCache,
   parseBundleConfig,
   parseGemfileLockData,
@@ -104,7 +107,7 @@ import {
   createDosaiMethodsSlice,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
-  readDosaiJsonFile,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
@@ -573,8 +576,17 @@ export async function createPythonBom(path, options) {
   }
   if (requirementsMode || pipenvMode) {
     if (pipenvMode) {
-      // TODO: Support for nested directories
-      safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      // `pipenv install` builds and installs the project's own dependencies
+      // (including `-e .` self-references that execute setup.py), so unlike
+      // the lockfile parsing below it must honor --no-install-deps and the
+      // pre-build lifecycle.
+      if (options.installDeps !== false) {
+        safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      } else {
+        console.log(
+          "Skipping 'pipenv install' since dependency installation is disabled.",
+        );
+      }
       const piplockFile = join(path, "Pipfile.lock");
       if (safeExistsSync(piplockFile)) {
         let dlist;
@@ -1352,6 +1364,7 @@ export async function createRubyBom(path, options) {
   let pkgList = [];
   let dependencies = [];
   let rootList = [];
+  const projectGemRefs = [];
   const parentComponent = createDefaultParentComponent(path, "gem", options);
   const gemFileMode = gemFiles.length;
   const gemLockMode = gemLockFiles.length;
@@ -1405,10 +1418,18 @@ export async function createRubyBom(path, options) {
       if (retMap.rootList?.length) {
         rootList = rootList.concat(retMap.rootList);
       }
+      // `PATH remote: .` is relative to the lockfile, so only the lockfiles
+      // of the scanned directory can serve the gem the root gemspec builds
+      if (
+        retMap.projectGemRefs?.length &&
+        dirname(resolve(f)) === resolve(path)
+      ) {
+        projectGemRefs.push(...retMap.projectGemRefs);
+      }
     }
   }
   // Parsing .gemspec files would help us get more metadata such as description, authors, licenses etc
-  let rootGemspecComponent;
+  let projectGem;
   if (gemspecFiles.length) {
     if (!gemLockFiles.length && !hasAnyProjectType(["oci"], options, false)) {
       console.log(
@@ -1420,38 +1441,51 @@ export async function createRubyBom(path, options) {
         detail: "only gemspec files were available to parse",
       });
     }
+    // Bundler evaluated the root gemspec to lock it under `PATH remote: .`,
+    // so the locked release stands in for a version computed at runtime. It
+    // is resolved before the merge, so that the gemspec and lockfile
+    // sightings of the gem reconcile into one component.
+    const lockedVersions = Object.create(null);
+    for (const p of pkgList) {
+      if (p.version && projectGemRefs.includes(p["bom-ref"])) {
+        lockedVersions[p.name] = p.version;
+      }
+    }
     for (const f of gemspecFiles) {
       const gemspecData = readFileSync(f, { encoding: "utf-8" });
-      const gpkgList = await parseGemspecData(gemspecData, f);
-      if (gpkgList.length) {
-        pkgList = pkgList.concat(gpkgList);
-        pkgList = trimComponents(pkgList);
-        if (
-          !rootGemspecComponent &&
-          dirname(resolve(f)) === resolve(path) &&
-          gpkgList[0]?.name
-        ) {
-          rootGemspecComponent = gpkgList[0];
-        }
+      const isRootGemspec = dirname(resolve(f)) === resolve(path);
+      const gpkgList = await parseGemspecData(
+        gemspecData,
+        f,
+        isRootGemspec ? { lockedVersions } : {},
+      );
+      if (!gpkgList.length) {
+        continue;
       }
-    }
-    if (
-      rootGemspecComponent &&
-      !("project-name" in options) &&
-      options.projectName === undefined
-    ) {
-      parentComponent.name = rootGemspecComponent.name;
-      parentComponent.version = rootGemspecComponent.version || "latest";
-      const parentPurl = build({
-        type: "gem",
-        namespace: parentComponent.group || null,
-        name: parentComponent.name,
-        version: parentComponent.version || null,
-      });
-      parentComponent["bom-ref"] = decodeURIComponent(parentPurl);
-      parentComponent["purl"] = parentPurl;
+      // The gemspec in the scanned directory is the gem the project builds
+      if (!projectGem && isRootGemspec && gpkgList[0]?.name) {
+        projectGem = gpkgList[0];
+      }
+      pkgList = trimComponents(pkgList.concat(gpkgList));
     }
   }
+  // Describe that gem in metadata.component, unless `--project-name` names a
+  // different project or an image is being scanned
+  if (
+    projectGem &&
+    !hasAnyProjectType(["oci"], options, false) &&
+    (!("project-name" in options) || options.projectName === projectGem.name)
+  ) {
+    ({ pkgList, dependencies, rootList } = describeProjectGem(
+      parentComponent,
+      projectGem,
+      pkgList,
+      dependencies,
+      rootList,
+      projectGemRefs,
+      options,
+    ));
+  }
   if (rootList.length) {
     dependencies = mergeDependencies(
       dependencies,
@@ -1547,6 +1581,21 @@ export async function createRubyBom(path, options) {
   // lookup, gives us the sha256 of the exact native build, and unlike the
   // registry lookups it also works in dry-run mode.
   pkgList = await enrichGemsFromLocalCache(pkgList, { gemHome });
+  // The download URL of a gem from the public registry needs no network call
+  pkgList = addRubyGemsDistributionUrls(pkgList);
+  // Gems declare the Ruby they run on; surface it as the runtime they depend
+  // on. The component says the runtime is external, which only CycloneDX 1.7
+  // can express, and a container image ships its own Ruby.
+  if (
+    options.specVersion >= 1.7 &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    ({ pkgList, dependencies } = addRubyRuntimeComponent(
+      pkgList,
+      parentComponent,
+      dependencies,
+    ));
+  }
   return buildBomNSData(options, pkgList, "gem", {
     src: path,
     dependencies,
@@ -2006,9 +2055,13 @@ export async function createCsharpBom(path, options) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
     if (options.deep) {
+      // resolve (not join) so a fully-qualified --deps-slices-file is used
+      // as-is: join would append it to the scan path, which is never a valid
+      // path on Windows and silently loses the .NET evidence elsewhere
+      // (issue 4394). A relative value still resolves against the scan path.
       const slicesFile = resolve(
         options.depsSlicesFile
-          ? join(path, options.depsSlicesFile)
+          ? resolve(path, options.depsSlicesFile)
           : join(getTmpDir(), "dosai.json"),
       );
       // Create the slices file if it doesn't exist
@@ -2021,14 +2074,24 @@ export async function createCsharpBom(path, options) {
           resolve(slicesFile),
           options,
         );
-        if (!sliceResult && DEBUG_MODE) {
-          console.log(
-            "Slicing with dosai was unsuccessful. Check the errors reported in the logs above.",
+        if (!sliceResult) {
+          // Visible without --debug: otherwise the components silently lose
+          // the dependency-slice evidence while the scan still exits 0.
+          // --evidence (which implies --deep) runs dosai again during evinse
+          // and can still add occurrences, so this names only what is lost.
+          console.warn(
+            "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with --debug for the dosai errors.",
           );
         }
+      } else if (DEBUG_MODE) {
+        console.log(
+          `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
+        );
       }
       pkgList = addEvidenceForDotnet(pkgList, slicesFile);
-      const methodsSlice = readDosaiJsonFile(slicesFile);
+      const methodsSlice = readDosaiMethodsReport(slicesFile, {
+        sections: ["Metadata", "Services", "ApiEndpoints"],
+      });
       // Provider-backed Services[] first so bom-refs, trust zones, and data
       // classifications survive; ApiEndpoints derivation fills in the rest.
       const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
@@ -2036,12 +2099,20 @@ export async function createCsharpBom(path, options) {
       services = normalizeDosaiServiceMap(servicesMap);
     }
   }
-  // Parent dependency tree
+  // Parent dependency tree. A single project file already contributed an
+  // entry for the same parent, so the lock file roots are merged into it
+  // rather than added as a second entry for the same ref.
   if (parentDependsOn.size && parentComponent?.["bom-ref"]) {
-    dependencies.splice(0, 0, {
-      ref: parentComponent["bom-ref"],
-      dependsOn: Array.from(parentDependsOn).sort(),
-    });
+    dependencies = mergeDependencies(
+      [
+        {
+          ref: parentComponent["bom-ref"],
+          dependsOn: Array.from(parentDependsOn).sort(),
+        },
+      ],
+      dependencies,
+      parentComponent,
+    );
   }
   if (shouldFetchLicense()) {
     const retMap = await getNugetMetadata(pkgList, dependencies);

package/lib/cli/nativeBom.js

@@ -31,7 +31,9 @@ import { dirNameStr, isMac } from "../core/paths.js";
 import {
   buildDependentPurl,
   collapseCmakeVersions,
+  preferFetchedCmakeDependencies,
   resolveCmakeContext,
+  withoutScrapedFetchDependency,
 } from "../ecosystems/cmakeResolver.js";
 import { getCppModules } from "../ecosystems/cppEvidence.js";
 import {
@@ -48,6 +50,7 @@ import {
 } from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
+  isGoModWhyNotNeeded,
   parseGoListDep,
   parseGoModData,
   parseGoModGraph,
@@ -69,6 +72,7 @@ import {
 } from "../ecosystems/parsers-lua.js";
 import {
   buildObjectForCocoaPod,
+  classifySwiftDependencyScopes,
   executeAlpmList,
   executeApkList,
   executeDpkgList,
@@ -196,7 +200,6 @@ export function getCargoCacheDir() {
 export async function createGoBom(path, options) {
   let pkgList = [];
   let dependencies = [];
-  const allImports = {};
   let parentComponent = createDefaultParentComponent(path, "golang", options);
   // Is this a binary file
   let maybeBinary;
@@ -236,6 +239,8 @@ export async function createGoBom(path, options) {
       }
     }
     const doneList = {};
+    const requiredModules = new Set();
+    const unneededModules = new Set();
     let circuitBreak = false;
     if (DEBUG_MODE) {
       console.log(
@@ -249,12 +254,12 @@ export async function createGoBom(path, options) {
       }
       const pkgFullName = `${apkg.name}`;
       if (apkg.scope === "required") {
-        allImports[pkgFullName] = true;
+        requiredModules.add(pkgFullName);
         continue;
       }
       if (
         apkg.scope === "optional" ||
-        allImports[pkgFullName] ||
+        requiredModules.has(pkgFullName) ||
         doneList[pkgFullName]
       ) {
         continue;
@@ -283,19 +288,40 @@ export async function createGoBom(path, options) {
         const mstdout = mresult.stdout;
         if (mstdout) {
           const cmdOutput = Buffer.from(mstdout).toString();
-          const whyPkg = parseGoModWhy(cmdOutput);
-          // whyPkg would include this package string
-          // github.com/golang/protobuf/proto github.com/golang/protobuf
-          // golang.org/x/tools/cmd/goimports golang.org/x/tools
-          if (whyPkg?.includes(pkgFullName)) {
-            allImports[pkgFullName] = true;
+          if (isGoModWhyNotNeeded(cmdOutput)) {
+            unneededModules.add(pkgFullName);
+          } else {
+            // The last line of the import chain is a package of the module:
+            // github.com/golang/protobuf/proto for github.com/golang/protobuf
+            const whyPkg = parseGoModWhy(cmdOutput);
+            if (
+              whyPkg === pkgFullName ||
+              whyPkg?.startsWith(`${pkgFullName}/`)
+            ) {
+              requiredModules.add(pkgFullName);
+            }
           }
           doneList[pkgFullName] = true;
         }
       }
     }
+    // A module go reports as unneeded is optional, but only when every module
+    // was checked: once go mod why fails, the answers are incomplete, and a
+    // tool failure is not evidence that a module is unused.
+    for (const apkg of pkgList) {
+      if (apkg.scope) {
+        continue;
+      }
+      if (requiredModules.has(apkg.name)) {
+        apkg.scope = "required";
+      } else if (!circuitBreak && unneededModules.has(apkg.name)) {
+        apkg.scope = "optional";
+      }
+    }
     if (DEBUG_MODE) {
-      console.log(`Required packages: ${Object.keys(allImports).length}`);
+      console.log(
+        `Required packages: ${requiredModules.size}, not needed: ${circuitBreak ? "unknown" : unneededModules.size}`,
+      );
     }
     return buildBomNSData(options, pkgList, "golang", {
       src: path,
@@ -560,7 +586,6 @@ export async function createGoBom(path, options) {
       }
       if (pkgList.length && !shouldManuallyParse) {
         return buildBomNSData(options, pkgList, "golang", {
-          allImports,
           dependencies,
           parentComponent,
           src: path,
@@ -1415,22 +1440,31 @@ export function createCppBom(path, options) {
   }
   if (cmakeLikeFiles.length) {
     const beforeCmake = pkgList.length;
+    // The files at the scan root name the project, so they are read before
+    // the files of any sub-project (the sort is stable otherwise). The scan
+    // root may be given as a relative path while the files come back absolute.
+    const scanRoot = resolve(path);
+    const atScanRoot = (f) => resolve(dirname(f)) === scanRoot;
+    cmakeLikeFiles.sort(
+      (a, b) => (atScanRoot(a) ? 0 : 1) - (atScanRoot(b) ? 0 : 1),
+    );
     for (const f of cmakeLikeFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      const basePath = dirname(f);
       const retMap = parseCmakeLikeFile(f, "generic");
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (
-        basePath === path &&
+        atScanRoot(f) &&
         retMap.parentComponent &&
         Object.keys(retMap.parentComponent).length
       ) {
         if (!parentComponent) {
           parentComponent = retMap.parentComponent;
+          // a sub-project reusing the root project's name is the root itself
+          addedParentComponentsMap[retMap.parentComponent.name] = true;
         } else {
           parentComponent.components = parentComponent.components || [];
           if (!addedParentComponentsMap[retMap.parentComponent.name]) {
@@ -1445,6 +1479,7 @@ export function createCppBom(path, options) {
       ) {
         retMap.parentComponent.type = "library";
         pkgList.push(retMap.parentComponent);
+        addedParentComponentsMap[retMap.parentComponent.name] = true;
       }
       // Retain the dependency tree from cmake
       if (retMap.dependenciesList) {
@@ -1464,7 +1499,11 @@ export function createCppBom(path, options) {
     // resolved versions and are left as they are.
     pkgList = pkgList
       .slice(0, beforeCmake)
-      .concat(collapseCmakeVersions(pkgList.slice(beforeCmake)));
+      .concat(
+        collapseCmakeVersions(
+          preferFetchedCmakeDependencies(pkgList.slice(beforeCmake)),
+        ),
+      );
   }
   // CMake describes how a project is built from source. An image or an OS
   // installation carries build output, not a build tree, so resolving CMake
@@ -1554,6 +1593,7 @@ export function createCppBom(path, options) {
         { name: "cdx:cmake:resolvedVia", value: "gitclone-script" },
       ],
     };
+    pkgList = withoutScrapedFetchDependency(pkgList, dep.name);
     if (dep.sourceDir) {
       depComponent.properties.push({
         name: "cdx:cmake:sourceDir",
@@ -2024,6 +2064,50 @@ export async function createSwiftBom(path, options) {
   let parentComponent = {};
   const completedPath = [];
   let packageArgsMessageShown = false;
+  // Packages that only the root package's tests use are scoped optional so
+  // that `--required-only` can narrow the BOM. A package some project (or
+  // some production path) needs stays required.
+  const swiftScopes = {
+    optionalRefs: new Set(),
+    requiredRefs: new Set(),
+    optionalNames: new Set(),
+    requiredNames: new Set(),
+  };
+  const classifiedPaths = new Set();
+  const classifyScopes = (basePath, swiftCommand, treeData) => {
+    if (classifiedPaths.has(basePath)) {
+      return;
+    }
+    classifiedPaths.add(basePath);
+    const dumpArgs =
+      swiftCommand === "xcrun"
+        ? ["swift", "package", "dump-package"]
+        : ["package", "dump-package"];
+    const dumpResult = safeSpawnSync(swiftCommand, dumpArgs, {
+      cwd: basePath,
+    });
+    if (!dumpResult?.stdout) {
+      return;
+    }
+    let dumpJson;
+    let treeJson;
+    try {
+      dumpJson = JSON.parse(Buffer.from(dumpResult.stdout).toString());
+    } catch (_e) {
+      return;
+    }
+    try {
+      treeJson = treeData ? JSON.parse(treeData) : undefined;
+    } catch (_e) {
+      treeJson = undefined;
+    }
+    const scopes = classifySwiftDependencyScopes(dumpJson, treeJson);
+    for (const key of Object.keys(swiftScopes)) {
+      for (const value of scopes[key]) {
+        swiftScopes[key].add(value);
+      }
+    }
+  };
   if (pkgResolvedFiles.length) {
     for (const f of pkgResolvedFiles) {
       if (!parentComponent || !Object.keys(parentComponent).length) {
@@ -2147,6 +2231,33 @@ export async function createSwiftBom(path, options) {
           detail: "the swift package command failed",
         });
       }
+      // Scope classification also works without the dependency graph
+      classifyScopes(basePath, swiftCommand, treeData);
+    }
+  }
+  // Scope packages that only tests use as optional. A package some project or
+  // production path needs keeps its default (required) scope; evidence-based
+  // filtering after generation can still promote an optional package when
+  // the sources are found to use it.
+  for (const apkg of pkgList) {
+    if (apkg?.scope || !apkg?.name) {
+      continue;
+    }
+    const refs = [apkg["bom-ref"], apkg.purl].filter(Boolean);
+    const names = [String(apkg.name).toLowerCase()];
+    for (const aproperty of apkg.properties || []) {
+      if (aproperty?.name === "cdx:swift:packageName" && aproperty.value) {
+        names.push(String(aproperty.value).toLowerCase());
+      }
+    }
+    const isOptional =
+      refs.some((r) => swiftScopes.optionalRefs.has(r)) ||
+      names.some((n) => swiftScopes.optionalNames.has(n));
+    const isRequired =
+      refs.some((r) => swiftScopes.requiredRefs.has(r)) ||
+      names.some((n) => swiftScopes.requiredNames.has(n));
+    if (isOptional && !isRequired) {
+      apkg.scope = "optional";
     }
   }
   if (shouldFetchLicense()) {

package/lib/core/env.js

@@ -491,7 +491,7 @@ export const PROJECT_TYPE_ALIASES = {
     "visionos",
   ],
   binary: ["binary", "blint"],
-  oci: ["docker", "oci", "container", "podman", "rootfs", "oci-dir"],
+  oci: ["docker", "image", "oci", "container", "podman", "rootfs", "oci-dir"],
   cocoa: ["cocoa", "cocoapods", "objective-c", "swift", "ios"],
   scala: ["scala", "scala3", "sbt", "mill"],
   nix: ["nix", "nixos", "flake"],
@@ -643,11 +643,10 @@ export function hasAnyProjectType(projectTypes, options, defaultStatus = true) {
   const allProjectTypes = [...projectTypes];
   // Convert the project types into base types
   const baseProjectTypes = [];
-  // Support for arbitrary versioned ruby type
-  if (
-    options.projectType?.length &&
-    projectTypes.filter((p) => p.startsWith("ruby")).length
-  ) {
+  // Support for arbitrary versioned ruby type: a requested ruby3.4.1 is a
+  // ruby project. The test is on the requested types; testing the queried
+  // ones made every scan a ruby scan whenever "ruby" was asked about.
+  if (options.projectType?.some((p) => p.startsWith("ruby"))) {
     baseProjectTypes.push("ruby");
   }
   // Versioned JVM build tool types such as maven3.9.9 or gradle8.14 are java