@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/ecosystems/ecosystems.js

@@ -70,7 +70,6 @@ import {
 } from "../inventory/fetchBatch.js";
 import {
   applyPurl,
-  encodeForPurl,
   genericPurl,
   nugetPurl,
   pypiPurl,
@@ -2500,8 +2499,8 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
             }
           }
           const apkg = {
-            group: group ? encodeForPurl(group) : "",
-            name: name ? encodeForPurl(name) : "",
+            group: group || "",
+            name: name || "",
             version,
             purl,
             evidence: {
@@ -2631,16 +2630,28 @@ const METADATA_VERSION_PROP = "cdx:nuget:metadata_version";
 
 async function getNugetUrl() {
   const req = "https://api.nuget.org/v3/index.json";
-  const res = await cdxgenAgent.get(req, {
-    responseType: "json",
-  });
-  const urls = res.body.resources;
+  const fallbackUrl = "https://api.nuget.org/v3/registration3/";
+  let res;
+  try {
+    res = await cdxgenAgent.get(req, {
+      responseType: "json",
+    });
+  } catch (err) {
+    // Package lookups already degrade to unenriched components on error. An
+    // unreachable service index used to reject here instead and abort the
+    // whole BOM, so fall back to the well-known registration base.
+    thoughtLog(
+      `Unable to read the NuGet service index (${err.code || err.message}). Using ${fallbackUrl}.`,
+    );
+    return fallbackUrl;
+  }
+  const urls = res?.body?.resources || [];
   for (const resource of urls) {
     if (resource["@type"] === "RegistrationsBaseUrl/3.6.0") {
       return resource["@id"];
     }
   }
-  return "https://api.nuget.org/v3/registration3/";
+  return fallbackUrl;
 }
 
 /**

package/lib/ecosystems/gradleutils.js

@@ -41,19 +41,33 @@ function isJvmToolPinned() {
 /**
  * Method to return the gradle command to use.
  *
+ * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
+ * the scanned project, so they are only used when dependency tooling is
+ * allowed (`options.installDeps !== false`); otherwise the system Gradle is
+ * used.
+ *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export function getGradleCommand(srcPath, rootPath) {
+export function getGradleCommand(srcPath, rootPath, options = {}) {
   let gradleCmd = "gradle";
   const pinnedToolSelected = isJvmToolPinned();
+  // Introspection mode exists to observe the project's own toolchain, so it
+  // keeps using wrappers even when dependency installation is disabled.
+  const allowProjectWrappers =
+    options.installDeps !== false || options.introspect === true;
 
   let findGradleFile = "gradlew";
   if (platform() === "win32") {
     findGradleFile = "gradlew.bat";
   }
 
-  if (!pinnedToolSelected && safeExistsSync(join(srcPath, findGradleFile))) {
+  if (
+    allowProjectWrappers &&
+    !pinnedToolSelected &&
+    safeExistsSync(join(srcPath, findGradleFile))
+  ) {
     // Use local gradle wrapper if available
     // Enable execute permission
     try {
@@ -72,6 +86,7 @@ export function getGradleCommand(srcPath, rootPath) {
       reason: `Selected project-local Gradle wrapper ${gradleCmd}.`,
     });
   } else if (
+    allowProjectWrappers &&
     !pinnedToolSelected &&
     rootPath &&
     safeExistsSync(join(rootPath, findGradleFile))
@@ -380,8 +395,9 @@ export function executeParallelGradleProperties(
   dir,
   allProjectsStr,
   extraArgs = [],
+  options = {},
 ) {
-  const gradleCmd = getGradleCommand(dir, null);
+  const gradleCmd = getGradleCommand(dir, null, options);
   const gradleArgs = buildGradleCommandArguments(
     extraArgs.concat(
       readEnvironmentVariable("GRADLE_ARGS")
@@ -1205,11 +1221,16 @@ export async function collectGradleDependencies(
 /**
  * Method to return the mill command to use.
  *
+ * The project-local `mill` script is an attacker-controlled file in the
+ * scanned project, so it is only used when dependency tooling is allowed
+ * (`options.installDeps !== false`).
+ *
  * @param {string} srcPath Path to look for mill wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export function getMillCommand(srcPath) {
+export function getMillCommand(srcPath, options = {}) {
   let millCmd = `mill${platform() === "win32" ? ".bat" : ""}`;
-  if (safeExistsSync(join(srcPath, millCmd))) {
+  if (options.installDeps !== false && safeExistsSync(join(srcPath, millCmd))) {
     // Use local mill wrapper if available
     // Enable execute permission
     try {
@@ -1226,15 +1247,24 @@ export function getMillCommand(srcPath) {
 /**
  * Method to return the maven command to use.
  *
+ * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
+ * scanned project, so they are only used when dependency tooling is allowed
+ * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper
+ * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
-export function getMavenCommand(srcPath, rootPath) {
+export function getMavenCommand(srcPath, rootPath, options = {}) {
   let mavenCmd = "mvn";
   // Check if the wrapper script is both available and functional
   let isWrapperReady = false;
   let isWrapperFound = false;
   const pinnedToolSelected = isJvmToolPinned();
+  // Introspection mode exists to observe the project's own toolchain, so it
+  // keeps using wrappers even when dependency installation is disabled.
+  const allowProjectWrappers =
+    options.installDeps !== false || options.introspect === true;
   let findMavenFile = "mvnw";
   let mavenWrapperCmd = null;
   if (platform() === "win32") {
@@ -1247,7 +1277,11 @@ export function getMavenCommand(srcPath, rootPath) {
     }
   }
 
-  if (!pinnedToolSelected && safeExistsSync(join(srcPath, findMavenFile))) {
+  if (
+    allowProjectWrappers &&
+    !pinnedToolSelected &&
+    safeExistsSync(join(srcPath, findMavenFile))
+  ) {
     // Use local maven wrapper if available
     // Enable execute permission
     try {
@@ -1267,6 +1301,7 @@ export function getMavenCommand(srcPath, rootPath) {
       reason: `Found Maven wrapper candidate ${mavenWrapperCmd}.`,
     });
   } else if (
+    allowProjectWrappers &&
     !pinnedToolSelected &&
     rootPath &&
     safeExistsSync(join(rootPath, findMavenFile))

package/lib/ecosystems/jsEvidence.js

@@ -8,9 +8,9 @@
 
 import { join, resolve } from "node:path";
 
-import { DEBUG_MODE } from "../core/activity.js";
 import { safeExistsSync } from "../core/fs.js";
 import { createOccurrenceEvidence } from "../inventory/evidenceUtils.js";
+import { isPkgTypeOnlyImport, setNpmTypeOnlyProperty } from "./npmutils.js";
 import { parsePkgJson } from "./parsers-js.js";
 
 const NPM_BIN_IMPORT_PREFIX = "cdx:npm:bin/";
@@ -109,8 +109,11 @@ function applyNpmBinCommandEvidence(pkg, allImports) {
  *
  * For each component, resolves its module aliases (including the deno jsr
  * specifier), records imported/exported modules as properties, attaches
- * occurrence evidence, and adjusts the component scope to "required" when the
- * package is used or "optional" when it is not.
+ * occurrence evidence, and promotes the component scope to "required" when the
+ * package is used. A package with no observed usage keeps the scope its
+ * manifest parser assigned: static import analysis cannot see packages loaded
+ * from configuration, bundler entrypoints, stylesheets, or plugins, so a
+ * missing import is not evidence that a package is optional.
  *
  * @param {Array<object>} pkgList Package components to enrich.
  * @param {object} allImports Map of import specifier to usage evidence objects.
@@ -128,10 +131,6 @@ export async function addEvidenceForImports(
   const impPkgs = Object.keys(allImports);
   const exportedPkgs = Object.keys(allExports);
   for (const pkg of pkgList) {
-    if (impPkgs?.length) {
-      // Assume that all packages are optional until we see an evidence
-      pkg.scope = "optional";
-    }
     const { group, name } = pkg;
     // Evidence belonging to a type must be associated with the package
     if (group === "@types") {
@@ -155,7 +154,6 @@ export async function addEvidenceForImports(
         aliases.push(jsrSpecifier);
       }
     }
-    let isImported = false;
     for (const alias of aliases) {
       const isWasmAlias = /\.wasm([?#].*)?$/i.test(alias);
       const all_includes = impPkgs.filter(
@@ -213,11 +211,22 @@ export async function addEvidenceForImports(
       }
       // Identify all the imported modules of a component
       if (impPkgs.includes(alias) || all_includes.length) {
-        isImported = true;
         let importedModules = new Set();
         let wasmExportedModules = new Set();
         const seenOccurrenceLocations = new Set();
-        pkg.scope = "required";
+        // A package imported only for its types is erased at compile time.
+        // Scoping it excluded here, rather than when the BOM is assembled,
+        // keeps propagateRequiredScopeFromDependencies from promoting what it
+        // depends on. A package whose bin command is used is still required.
+        if (
+          isPkgTypeOnlyImport(allImports, group, name) &&
+          !getNpmBinCommandEvidenceKeys(allImports, pkg).length
+        ) {
+          pkg.scope = "excluded";
+          setNpmTypeOnlyProperty(pkg);
+        } else {
+          pkg.scope = "required";
+        }
         for (const subevidence of all_includes) {
           const evidences = allImports[subevidence];
           for (const evidence of evidences) {
@@ -273,16 +282,6 @@ export async function addEvidenceForImports(
         }
         break;
       }
-      if (
-        impPkgs?.length > 0 &&
-        !isImported &&
-        DEBUG_MODE &&
-        pkg?.scope !== "optional"
-      ) {
-        console.debug(
-          `\x1b[1;35mNotice: Package ${pkg.name} has no usage in code. Check if it is needed.\x1b[0m`,
-        );
-      }
       // Capture metadata such as description from local node_modules in deep mode
       if (deep && !pkg.description && pkg.properties) {
         let localNodeModulesPath;

package/lib/ecosystems/kosi.js

@@ -11,7 +11,11 @@ import {
   safeSpawnSync,
 } from "../core/fs.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
-import { tryBuildPurl, tryParsePurl } from "../inventory/purl.js";
+import {
+  parsePurlLoose,
+  tryBuildPurl,
+  tryParsePurl,
+} from "../inventory/purl.js";
 
 /**
  * kosi — JS bridge to the Kotlin-native evidence binary (thirdparty/kosi in
@@ -46,7 +50,10 @@ export function kosiWorkspaceComponent(workspaceModule) {
   if (!workspaceModule?.purl) {
     return undefined;
   }
-  const version = workspaceModule.purl.split("@")[1] || "unspecified";
+  // The version is read through the purl parser: cutting the text after `@`
+  // kept its escaping (`1.0.0%2Bbuild`) and any `?type=jar` qualifiers.
+  const version =
+    parsePurlLoose(workspaceModule.purl)?.version || "unspecified";
   const cleanName = (workspaceModule.name || "").replace(/^['"]|['"]+$/g, "");
   const purl =
     tryParsePurl(workspaceModule.purl) ||
@@ -59,7 +66,7 @@ export function kosiWorkspaceComponent(workspaceModule) {
     name: cleanName || workspaceModule.name,
     version,
     purl,
-    "bom-ref": purl,
+    "bom-ref": decodeURIComponent(purl),
   };
 }
 

package/lib/ecosystems/npmutils.js

@@ -2,8 +2,10 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
+import { clean } from "semver";
 
 import { safeExistsSync } from "../core/fs.js";
+import { parsePurlLoose } from "../inventory/purl.js";
 import { parseNpmrc, parseNpmrcFromEnv } from "../parsers/npmrc.js";
 
 const npmPackageHydrationFields = [
@@ -84,6 +86,89 @@ export function setNpmPeerProperty(pkg) {
   addComponentProperty(pkg, "cdx:npm:package:peer", "true");
 }
 
+/**
+ * Marks an npm component as imported only for its TypeScript types.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export function setNpmTypeOnlyProperty(pkg) {
+  addComponentProperty(pkg, "cdx:npm:package:type-only", "true");
+}
+
+/**
+ * Clean an npm version the way `npm publish` does before it records a release.
+ *
+ * Publishing a directory runs the manifest through `npm pkg fix`
+ * (`fixVersionField` in `@npmcli/package-json`, which calls `semver.clean` in
+ * loose mode) and then through libnpmpublish, which calls `semver.clean` again
+ * in strict mode and records the result as the packument version, the
+ * dist-tag, the `_id` and the tarball file name. Semver build metadata
+ * (`1.0.0+build.5`), a leading `v` or `=`, surrounding whitespace and leading
+ * zeros are dropped; a prerelease is kept.
+ *
+ * The `package.json` inside the published tarball keeps the original string,
+ * and so do the lockfiles npm, pnpm, yarn and bun write for a project, a
+ * workspace member or a git, file or link dependency. The cleaned form is the
+ * version the npm registry knows the package by.
+ *
+ * @param {string} version Version as a manifest or lockfile records it
+ * @returns {string|null} The cleaned version, or null when npm would reject `version` as invalid semver
+ */
+export function cleanNpmVersion(version) {
+  if (typeof version !== "string" || !version.trim()) {
+    return null;
+  }
+  const looseClean = clean(version, { loose: true });
+  if (!looseClean) {
+    return null;
+  }
+  return clean(looseClean);
+}
+
+/**
+ * Record the version npm would publish when it differs from the recorded one.
+ *
+ * Sets `cdx:npm:cleanedVersion` on an npm component whose version is valid
+ * semver but not in the form {@link cleanNpmVersion} produces, for example
+ * `1.0.0+build.5` (published as `1.0.0`). The component's `version` and `purl`
+ * keep the recorded string: that is what the manifest and lockfile say. A
+ * component whose version is already clean, or not semver at all (a git
+ * commit, a `file:` path), is left without the property, and a stale value from
+ * an earlier pass is replaced.
+ *
+ * @param {object} component Component or package object with `version` and `purl`
+ * @returns {object} The same component, for chaining
+ */
+export function setNpmCleanedVersionProperty(component) {
+  if (!component || typeof component !== "object") {
+    return component;
+  }
+  const purl = component.purl;
+  if (typeof purl !== "string" || !purl.startsWith("pkg:npm/")) {
+    return component;
+  }
+  const cleaned = cleanNpmVersion(component.version);
+  const wanted = cleaned && cleaned !== component.version ? cleaned : undefined;
+  const existing = component.properties?.filter(
+    (property) => property?.name === "cdx:npm:cleanedVersion",
+  );
+  if (
+    (!existing?.length && !wanted) ||
+    (existing?.length === 1 && existing[0].value === wanted)
+  ) {
+    return component;
+  }
+  const properties = (component.properties || []).filter(
+    (property) => property?.name !== "cdx:npm:cleanedVersion",
+  );
+  if (wanted) {
+    properties.push({ name: "cdx:npm:cleanedVersion", value: wanted });
+  }
+  component.properties = properties;
+  return component;
+}
+
 /**
  * Helper function to create a properly encoded workspace PURL
  *
@@ -130,14 +215,18 @@ export function findMatchingNpmWorkspace(workspacePackages, packageName) {
     return undefined;
   }
 
-  const expectedEncodedPurl = createNpmWorkspacePurl(packageName);
-  const simplePurl = `pkg:npm/${packageName}`;
-
-  return workspacePackages.find(
-    (workspacePackage) =>
-      workspacePackage.startsWith(expectedEncodedPurl) ||
-      workspacePackage.startsWith(simplePurl),
-  );
+  // Compare the parsed coordinates: a prefix match on the purl text would let
+  // `ws` match `wsmember`, and the reference may be escaped or decoded.
+  return workspacePackages.find((workspacePackage) => {
+    const parts = parsePurlLoose(workspacePackage);
+    if (parts?.type !== "npm") {
+      return false;
+    }
+    const fullName = parts.namespace
+      ? `${parts.namespace}/${parts.name}`
+      : parts.name;
+    return fullName === packageName;
+  });
 }
 
 /**
@@ -201,6 +290,12 @@ export function collectNpmManifestSources(node) {
     return manifestSources;
   }
   for (const edge of node.edgesIn) {
+    // Arborist adds a `workspace` edge from the root to every member, with an
+    // absolute `file:` spec it builds from the checkout path. No manifest
+    // declares it, and copying it would put the local path into the BOM.
+    if (edge?.workspace || edge?.type === "workspace") {
+      continue;
+    }
     const manifestSource = classifyNpmManifestSource(edge?.spec);
     if (!manifestSource) {
       continue;
@@ -520,7 +615,9 @@ export function parsePnpmGitLockKey(lockKey) {
  * @returns {Object<string, object>} Map of lookup key to git package reference.
  */
 export function buildPnpmGitPkgRefs(packages, snapshots, npmrcConfig = {}) {
-  const gitPkgRefs = {};
+  // A null prototype keeps inherited Object properties (such as `constructor`)
+  // from masquerading as lookup hits for keys that were never registered.
+  const gitPkgRefs = Object.create(null);
   const registerEntry = (lockKey, packageNode) => {
     const resolution = packageNode?.resolution;
     const parsed = parsePnpmGitLockKey(lockKey);
@@ -531,6 +628,10 @@ export function buildPnpmGitPkgRefs(packages, snapshots, npmrcConfig = {}) {
       return;
     }
     const { group, name, gitSpec, fullName, packageName } = parsed;
+    if (name === "__proto__" || packageName === "__proto__") {
+      // A crafted lock key cannot become a lookup entry under this name.
+      return;
+    }
     const version = packageNode?.version || resolution?.commit || "";
     const repo = resolution?.repo || "";
     const commit = resolution?.commit || "";

package/lib/ecosystems/parsers-dotnet.js

@@ -466,6 +466,21 @@ export function getPropertyGroupTextNodes(propsFiles) {
   return matches;
 }
 
+/**
+ * Read the trimmed text of an MSBuild property from a parsed PropertyGroup.
+ *
+ * @param {Object} propertyGroup PropertyGroup parsed by xml2js in compact mode
+ * @param {string} key Property name
+ * @returns {string|undefined} The text, or undefined when absent or empty
+ */
+function propertyGroupText(propertyGroup, key) {
+  const text = propertyGroup?.[key]?.[0]?._?.[0];
+  if (typeof text !== "string" || !text.trim().length) {
+    return undefined;
+  }
+  return text.trim();
+}
+
 /**
  * Method to parse .csproj like xml files
  *
@@ -514,6 +529,35 @@ export function parseCsProjData(
     return pkgList;
   }
   const project = projects[0];
+  // SDK-style projects declare their version through the MSBuild properties
+  // that `dotnet pack` reads: PackageVersion, which defaults to Version, which
+  // in turn defaults to VersionPrefix plus an optional `-VersionSuffix`. A
+  // property may be set in any PropertyGroup, so they are collected first.
+  const sdkVersionProps = {};
+  for (const apg of project?.PropertyGroup || []) {
+    for (const key of [
+      "PackageVersion",
+      "Version",
+      "VersionPrefix",
+      "VersionSuffix",
+    ]) {
+      const value = propertyGroupText(apg, key);
+      if (value !== undefined) {
+        sdkVersionProps[key] = value;
+      }
+    }
+  }
+  let sdkVersion =
+    sdkVersionProps.PackageVersion ||
+    sdkVersionProps.Version ||
+    (sdkVersionProps.VersionPrefix
+      ? `${sdkVersionProps.VersionPrefix}${sdkVersionProps.VersionSuffix ? `-${sdkVersionProps.VersionSuffix}` : ""}`
+      : undefined);
+  // An MSBuild property reference such as $(BuildNumber) is only known at
+  // build time, so a version that still contains one is not reported.
+  if (sdkVersion?.includes("$(")) {
+    sdkVersion = undefined;
+  }
   // First make up a parentcomponent name based on the .csproj file name
   if (projFile) {
     parentComponent.name = basename(projFile).replaceAll(
@@ -571,10 +615,6 @@ export function parseCsProjData(
         if (outputType === "Library") {
           parentComponent.type = "library";
         }
-        applyPurl(
-          parentComponent,
-          nugetPurl(parentComponent.name, parentComponent.version || "latest"),
-        );
         // The MSBuild OutputType (Exe, WinExe, …) used to ride along as an
         // `output_type` purl qualifier, which nuget does not define — every such
         // purl was invalid. It is project metadata, so it belongs in properties.
@@ -924,21 +964,22 @@ export function parseCsProjData(
       }
     }
   }
-  // If the parent still lacks a purl, add one based on the name and version
-  if (parentComponent && !parentComponent.purl && parentComponent.name) {
+  if (sdkVersion) {
+    parentComponent.version = sdkVersion;
+  }
+  // The purl is built once every PropertyGroup has been read, so a version
+  // declared after OutputType is not lost.
+  if (parentComponent.name) {
     applyPurl(
       parentComponent,
       nugetPurl(parentComponent.name, parentComponent.version || "latest"),
     );
   }
-  if (parentComponent?.purl) {
-    parentComponent["bom-ref"] = parentComponent.purl;
-  }
   let dependencies = [];
   if (parentComponent?.["bom-ref"]) {
     dependencies = [
       {
-        ref: parentComponent.purl,
+        ref: parentComponent["bom-ref"],
         dependsOn: [...new Set(pkgList.map((p) => p["bom-ref"]))].sort(),
       },
     ];

package/lib/ecosystems/parsers-go.js

@@ -7,7 +7,12 @@ import { Purl } from "@cdxgen/cdx-purl";
 import { DEBUG_MODE } from "../core/activity.js";
 import { shouldFetchLicense, shouldFetchVCS } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
-import { applyPurl, tryBuildPurl, tryParsePurl } from "../inventory/purl.js";
+import {
+  applyPurl,
+  canonicalPurlFromLooseString,
+  tryBuildPurl,
+  tryParsePurl,
+} from "../inventory/purl.js";
 import {
   _clearMetadataCache,
   getGoPkgLicense,
@@ -443,6 +448,23 @@ function _addGoComponentEvidence(component, goModFile, confidence = 0.8) {
   return component;
 }
 
+/**
+ * Build the purl of one `module@version` token from `go mod graph` output.
+ *
+ * The version is written the way Go prints it, so `+incompatible` and the build
+ * metadata of a pseudo-version are unescaped. Reading the token strictly would
+ * reject it and leave a reference that keeps the module path's upper-case
+ * letters, which then never matches the lower-cased component and drops the
+ * dependency edge.
+ *
+ * @param {string} token Module path, optionally followed by `@version`
+ * @returns {Purl|null} Parsed purl, or null when the token forms no valid golang purl
+ */
+function goModGraphTokenPurl(token) {
+  const canonical = canonicalPurlFromLooseString(`pkg:golang/${token}`);
+  return canonical ? Purl.parse(canonical) : null;
+}
+
 /**
  * Parse go mod graph
  *
@@ -512,22 +534,20 @@ export async function parseGoModGraph(
           // cdx-purl requires a namespace. Use the raw ref when parsing fails.
           let sourceRefString;
           let sourceName = tmpA[0].split("@")[0];
-          let sourcePurl = null;
-          try {
-            sourcePurl = Purl.parse(`pkg:golang/${tmpA[0]}`);
+          const sourcePurl = goModGraphTokenPurl(tmpA[0]);
+          if (sourcePurl) {
             sourceRefString = decodeURIComponent(sourcePurl.toString());
             sourceName = `${sourcePurl.namespace ? `${sourcePurl.namespace}/` : ""}${sourcePurl.name}`;
-          } catch {
+          } else {
             sourceRefString = `pkg:golang/${tmpA[0]}`;
           }
           let dependsRefString;
           let dependsName = tmpA[1].split("@")[0];
-          let dependsPurl = null;
-          try {
-            dependsPurl = Purl.parse(`pkg:golang/${tmpA[1]}`);
+          const dependsPurl = goModGraphTokenPurl(tmpA[1]);
+          if (dependsPurl) {
             dependsRefString = decodeURIComponent(dependsPurl.toString());
             dependsName = `${dependsPurl.namespace ? `${dependsPurl.namespace}/` : ""}${dependsPurl.name}`;
-          } catch {
+          } else {
             dependsRefString = `pkg:golang/${tmpA[1]}`;
           }
           // Since go mod graph over-reports direct dependencies we use the existing list
@@ -683,6 +703,24 @@ export function parseGoModWhy(rawOutput) {
   return undefined;
 }
 
+/**
+ * Reports whether `go mod why -m` output says the main module does not need
+ * the module. go prints `(main module does not need module X)`, or
+ * `(main module does not need to vendor module X)` with `-vendor`, and exits
+ * with status 0 either way.
+ *
+ * @param {string} rawOutput Output from go mod why
+ * @returns {boolean} True when go reports the module as not needed
+ */
+export function isGoModWhyNotNeeded(rawOutput) {
+  if (typeof rawOutput !== "string") {
+    return false;
+  }
+  return rawOutput
+    .split("\n")
+    .some((line) => line.trim().startsWith("(main module does not need "));
+}
+
 /**
  * Parse go sum data
  * @param {string} gosumData Content of go.sum