@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/ecosystems/parsers-js.js

@@ -18,7 +18,7 @@ import { recordDegradation } from "../core/buildLedger.js";
 import { shouldFetchPackageMetadata } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
 import { analyzeSuspiciousJsFile } from "../inventory/analyzer.js";
-import { encodeForPurl, npmPurl } from "../inventory/purl.js";
+import { npmPurl, parsePurlLoose } from "../inventory/purl.js";
 import Arborist from "../third-party/arborist/lib/index.js";
 import { getNpmMetadata } from "./ecosystems.js";
 import {
@@ -31,6 +31,7 @@ import {
   loadNpmrcConfig,
   normalizePnpmLockKey,
   parsePnpmGitLockKey,
+  resolveNpmLicense,
   setNpmDevelopmentProperty,
   setNpmOptionalProperty,
   setNpmPeerProperty,
@@ -135,6 +136,11 @@ const NPM_LIFECYCLE_JS_SOURCE_FILE_PATTERN = /\.[cm]?[jt]sx?$/i;
 
 const SHELL_ENV_ASSIGNMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=.*/;
 
+// The root component's name when neither package.json, --project-name, nor
+// the directory names one (a tree rooted at a file-system root): a purl needs
+// a name.
+const UNNAMED_NPM_PROJECT = "unnamed-project";
+
 function splitLifecycleScriptCommands(scriptValue) {
   const commands = [];
   let current = "";
@@ -432,6 +438,9 @@ function analyzeNpmLifecycleScripts(pkgJsonFile, scripts) {
  *   identity evidence and skip npm registry metadata fetching.
  * @param {boolean} [securityProps=false] When true, append npm security-relevant
  *   properties such as lifecycle scripts, binaries, native addons, and deprecation notices.
+ * @param {Object} [options] Options
+ * @param {boolean} [options.fetchMetadata=true] When false, skip the npm
+ *   registry round so that a caller can make one round for many manifests.
  * @returns {Promise<Array<object>>} Parsed component list, enriched with npm
  *   registry metadata when available and not in simple mode.
  */
@@ -439,11 +448,15 @@ export async function parsePkgJson(
   pkgJsonFile,
   simple = false,
   securityProps = false,
+  options = {},
 ) {
   const pkgList = [];
   if (safeExistsSync(pkgJsonFile)) {
     try {
-      const pkgData = JSON.parse(readFileSync(pkgJsonFile, "utf8"));
+      // npm and Node.js both accept a package.json that starts with a UTF-8 BOM
+      const pkgData = JSON.parse(
+        readFileSync(pkgJsonFile, "utf8").replace(/^\uFEFF/, ""),
+      );
       const pkgIdentifier = parsePackageJsonName(pkgData.name);
       let name = pkgIdentifier.fullName || pkgData.name;
       if (!name && !pkgJsonFile.includes("node_modules")) {
@@ -471,7 +484,7 @@ export async function parsePkgJson(
         purl: purl,
         "bom-ref": decodeURIComponent(purl),
         author: authorString,
-        license: pkgData.license,
+        license: resolveNpmLicense(pkgData),
       };
       if (pkgData.homepage) {
         apkg.homepage = { url: pkgData.homepage };
@@ -662,7 +675,12 @@ export async function parsePkgJson(
       // continue regardless of error
     }
   }
-  if (!simple && shouldFetchPackageMetadata() && pkgList?.length) {
+  if (
+    !simple &&
+    options.fetchMetadata !== false &&
+    shouldFetchPackageMetadata() &&
+    pkgList?.length
+  ) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch npm registry metadata for ${pkgList.length} packages in parsePkgJson`,
@@ -899,6 +917,9 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
 
     let pkg;
     let purlString;
+    // The license the installed package.json declares, for a package whose
+    // lockfile entry carries none (see the spoofing check below).
+    let installedManifestLicense;
     const author = nodePackage.author;
     const authorString =
       author instanceof Object
@@ -908,22 +929,36 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         : author;
     if (node === rootNode) {
       const projectGroup = options.projectGroup;
+      // A package.json without a name still installs, so the root of a deep
+      // tree can lack one: name the root component after its directory, the
+      // way the scans without node_modules already do, rather than fail to
+      // build its purl (issue 4440). A tree rooted at a file-system root has
+      // no directory name either, and neither has the --project-name the CLI
+      // derives from it.
       const projectName =
-        "project-name" in options ? options.projectName : node.packageName;
+        ("project-name" in options && options.projectName) ||
+        node.packageName ||
+        basename(node.path || "") ||
+        node.name ||
+        UNNAMED_NPM_PROJECT;
       const projectVersion = options.projectVersion || node.version;
       // A package.json need not declare a version, and npm installs without
       // one, so the root of a lockfile can reach here with none. A purl carries
       // no version rather than an empty one.
-      purlString = Purl.parse(
-        `pkg:npm/${projectGroup ? `${encodeURIComponent(projectGroup).replace(/%2F/g, "/")}/` : ""}${encodeURIComponent(projectName).replace(/%2F/g, "/")}${projectVersion ? `@${projectVersion}` : ""}`,
-      )
-        .toString()
-        .replace(/%2F/g, "/");
+      purlString = (
+        projectGroup
+          ? build({
+              type: "npm",
+              namespace: projectGroup,
+              name: projectName,
+              version: projectVersion || null,
+            })
+          : npmPurl(projectName, projectVersion)
+      ).replace(/%2F/g, "/");
       pkg = {
         author: authorString,
         group: options.projectGroup || "",
-        name:
-          "project-name" in options ? options.projectName : node.packageName,
+        name: projectName,
         version: options.projectVersion || node.version,
         type: "application",
         purl: purlString,
@@ -959,13 +994,19 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         });
       }
     } else {
+      // A package.json without a name installs as a file: or workspace
+      // dependency too, and arborist then has no packageName for it: such a
+      // package goes by the name its folder has in the tree, which is also
+      // the name the edges into it carry (issue 4440).
+      const packageName =
+        node.packageName || node.name || basename(node.path || "");
       let namespace = "";
-      let name = node.packageName;
-      if (node.packageName.startsWith("@")) {
-        const slashIndex = node.packageName.indexOf("/");
+      let name = packageName;
+      if (packageName.startsWith("@")) {
+        const slashIndex = packageName.indexOf("/");
         if (slashIndex > 0) {
-          namespace = node.packageName.substring(0, slashIndex);
-          name = node.packageName.substring(slashIndex + 1);
+          namespace = packageName.substring(0, slashIndex);
+          name = packageName.substring(slashIndex + 1);
         }
       }
       let qualifiers = null;
@@ -1078,9 +1119,17 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         });
       }
       if (node?.binPaths?.length) {
+        // Absolute bin paths would leak the generating machine's home
+        // directory into the SBOM and differ between checkouts, so they are
+        // emitted relative to the project root the package was resolved from,
+        // with forward slashes on every platform (issue 4467).
         pkg.properties.push({
           name: "cdx:npm:binPaths",
-          value: node.binPaths.join(", "),
+          value: node.binPaths
+            .map((binPath) =>
+              relative(srcFilePath, binPath).split(_sep).join("/"),
+            )
+            .join(", "),
         });
       }
       if (nodePackage?.bin) {
@@ -1149,9 +1198,14 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         try {
           const onDiskPkg =
             diskPkg || JSON.parse(readFileSync(packageJsonPath, "utf8"));
-          if (!onDiskPkg.name || onDiskPkg.name !== node.packageName) {
+          // A package that declares no name on disk and none in the lockfile
+          // (a nameless file: dependency) disagrees with nothing.
+          if (
+            (onDiskPkg.name || node.packageName) &&
+            onDiskPkg.name !== node.packageName
+          ) {
             console.warn(
-              `\x1b[1;35mWARNING: Package name spoofing detected for ${node.packageName}! Lockfile says ${node.packageName}, but disk says ${onDiskPkg.name}.\x1b[0m`,
+              `\x1b[1;35mWARNING: Package name spoofing detected for ${packageName}! Lockfile says ${node.packageName}, but disk says ${onDiskPkg.name}.\x1b[0m`,
             );
             if (onDiskPkg.name) {
               pkg.properties.push({
@@ -1160,9 +1214,12 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
               });
             }
           }
-          if (!onDiskPkg.version || onDiskPkg.version !== node.version) {
+          if (
+            (onDiskPkg.version || node.version) &&
+            onDiskPkg.version !== node.version
+          ) {
             console.warn(
-              `\x1b[1;35mWARNING: Package version spoofing detected for ${node.packageName}! Lockfile says ${node.version}, but disk says ${onDiskPkg.version}.\x1b[0m`,
+              `\x1b[1;35mWARNING: Package version spoofing detected for ${packageName}! Lockfile says ${node.version}, but disk says ${onDiskPkg.version}.\x1b[0m`,
             );
             if (onDiskPkg.version) {
               pkg.properties.push({
@@ -1171,6 +1228,17 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
               });
             }
           }
+          // npm records only the modern `license` field in the lockfile, so a
+          // package that declares the legacy `licenses` array (issue 4466) has
+          // no license in the tree loaded from it. The installed manifest is
+          // then the only local declaration, and only when it is the package
+          // the lockfile describes.
+          if (
+            onDiskPkg.name === node.packageName &&
+            onDiskPkg.version === node.version
+          ) {
+            installedManifestLicense = resolveNpmLicense(onDiskPkg);
+          }
         } catch (_err) {
           // ignore
         }
@@ -1226,9 +1294,11 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         pkg.description = nodePackage.description;
       }
     }
-    if (nodePackage?.license) {
+    const npmLicense =
+      resolveNpmLicense(nodePackage) || installedManifestLicense;
+    if (npmLicense) {
       // License will be overridden if shouldFetchLicense() is enabled
-      pkg.license = nodePackage.license;
+      pkg.license = npmLicense;
     }
     const deprecatedMessage = nodePackage?.deprecated;
     if (deprecatedMessage) {
@@ -1602,7 +1672,7 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
         `About to fetch npm registry metadata for ${pkgList.length} packages in parsePkgLock`,
       );
     }
-    pkgList = await getNpmMetadata(pkgList);
+    pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
     return { pkgList, dependenciesList };
   }
   return {
@@ -1778,17 +1848,15 @@ function _resolveYarnDependencyBomRef(
       packageNameToUse,
     );
     if (matchingWorkspace) {
-      const versionMatch = matchingWorkspace.match(/@([^@]+)$/);
-      if (versionMatch) {
-        resolvedVersion = versionMatch[1];
-      }
+      // The workspace reference may be an escaped purl, so its version is read
+      // through the purl parser rather than cut out of the string.
+      resolvedVersion =
+        parsePurlLoose(matchingWorkspace)?.version || resolvedVersion;
     }
   }
-  let purlPart = `pkg:npm/${encodeURIComponent(packageNameToUse).replace(/%2F/g, "/")}`;
-  if (resolvedVersion?.length) {
-    purlPart = `${purlPart}@${resolvedVersion}`;
-  }
-  return decodeURIComponent(Purl.parse(purlPart).toString());
+  return decodeURIComponent(
+    npmPurl(packageNameToUse, resolvedVersion?.length ? resolvedVersion : null),
+  );
 }
 
 function _collectYarnRootDependencyRefs(
@@ -1919,7 +1987,7 @@ function _markYarnDependencyScopeClosures(
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
+ * @param {Object} workspaceDirectDeps Declared dependencies (name to range) of each workspace package
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  */
 export async function parseYarnLock(
@@ -1927,12 +1995,14 @@ export async function parseYarnLock(
   parentComponent = null,
   workspacePackages = [],
   workspaceSrcFiles = {},
-  _workspaceDirectDeps = {},
+  workspaceDirectDeps = {},
   depsWorkspaceRefs = {},
 ) {
   let pkgList = [];
   const dependenciesList = [];
   const depKeys = {};
+  // The lock keys and the resolved version required to solve the dependency tree
+  let identMap = {};
   let yarnRootRefs = _createYarnRootDependencyRefs();
   const yarnOptionalDependencyRefs = new Set();
   const npmrcConfig = loadNpmrcConfig(dirname(yarnLockFile));
@@ -1951,8 +2021,7 @@ export async function parseYarnLock(
     const pkgAddedMap = {};
     // Map to track workspace package PURL replacements from 0.0.0-use.local to actual versions
     const workspacePurlMap = {};
-    // This would have the keys and the resolved version required to solve the dependency tree
-    const identMap = yarnLockToIdentMap(lockData);
+    identMap = yarnLockToIdentMap(lockData);
     yarnRootRefs = _collectYarnRootDependencyRefs(
       yarnLockFile,
       identMap,
@@ -2020,8 +2089,8 @@ export async function parseYarnLock(
               const actualWorkspacePurl = workspacePackages.find(
                 (wp) =>
                   wp.startsWith(expectedPurlStart) ||
-                  wp.includes(
-                    `pkg:npm/${encodeForPurl(group ? `${group}/${name}` : name)}@`,
+                  wp.startsWith(
+                    `${npmPurl(group ? `${group}/${name}` : name)}@`,
                   ),
               );
               // Also check if this package already exists in pkgList with a real version
@@ -2286,23 +2355,21 @@ export async function parseYarnLock(
           if (DEBUG_MODE) {
             console.log(`Processing workspace package: "${workspacePkg}"`);
           }
-          let purlObj;
-          // For workspace packages that already have versions in the PURL format
-          if (
-            workspacePkg.includes("@") &&
-            workspacePkg.lastIndexOf("@") > workspacePkg.indexOf("/")
-          ) {
-            // This is a scoped package with version like "npm:@swc/helpers@0.4.14"
-            const lastAtIndex = workspacePkg.lastIndexOf("@");
-            const purlWithoutVersion = workspacePkg.substring(0, lastAtIndex);
-            const version = workspacePkg.substring(lastAtIndex + 1);
-            // Parse the PURL without version first, then set the version.
-            purlObj = Purl.parse(purlWithoutVersion);
-            purlObj.version = version;
-          } else {
-            // Parse the PURL as-is (no version or simple package)
-            purlObj = Purl.parse(workspacePkg);
+          // Workspace references arrive both escaped (built by cdx-purl) and in
+          // the decoded bom-ref form, so they are split structurally and
+          // rebuilt. Copying the version text across forms is what turned
+          // `3.0.0+ws` into `3.0.0%252Bws`.
+          const workspaceParts = parsePurlLoose(workspacePkg);
+          if (!workspaceParts) {
+            continue;
           }
+          const purlObj = new Purl({
+            type: "npm",
+            namespace: workspaceParts.namespace,
+            name: workspaceParts.name,
+            version: workspaceParts.version,
+            subpath: workspaceParts.subpath,
+          });
 
           // Create the workspace component using the properly parsed PURL
           const workspaceComponent = {
@@ -2405,6 +2472,41 @@ export async function parseYarnLock(
         }
       }
     }
+    // A yarn v1 lock file has no entries for workspace packages, so a member
+    // would otherwise have no dependency entry and nothing would reach it.
+    // Each member gets one built from the dependencies its own package.json
+    // declares; the root's entry, built from every dependency entry, then
+    // includes the member too. A lock file that already recorded the member
+    // (yarn berry) keeps the entry it produced.
+    const recordedRefs = new Set(dependenciesList.map((d) => d.ref));
+    for (const workspacePkg of workspacePackages) {
+      const workspaceRef = decodeURIComponent(workspacePkg);
+      if (
+        recordedRefs.has(workspaceRef) ||
+        !pkgList.some((pkg) => pkg["bom-ref"] === workspaceRef)
+      ) {
+        continue;
+      }
+      const dependsOn = new Set();
+      for (const [depName, depRange] of Object.entries(
+        workspaceDirectDeps?.[workspacePkg] || {},
+      )) {
+        const depRef = _resolveYarnDependencyBomRef(
+          depName,
+          String(depRange),
+          identMap,
+          workspacePackages,
+        );
+        if (depRef && depRef !== workspaceRef) {
+          dependsOn.add(depRef);
+        }
+      }
+      dependenciesList.push({
+        ref: workspaceRef,
+        dependsOn: [...dependsOn].sort(),
+      });
+      recordedRefs.add(workspaceRef);
+    }
   }
 
   _markYarnDependencyScopeClosures(
@@ -2420,7 +2522,7 @@ export async function parseYarnLock(
         `About to fetch npm registry metadata for ${pkgList.length} packages in parseYarnLock`,
       );
     }
-    pkgList = await getNpmMetadata(pkgList);
+    pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
     return {
       pkgList,
       dependenciesList,
@@ -2439,6 +2541,7 @@ export async function parseYarnLock(
  */
 export async function parseNodeShrinkwrap(swFile) {
   const pkgList = [];
+  const npmrcConfig = loadNpmrcConfig(dirname(swFile));
   if (safeExistsSync(swFile)) {
     const lockData = JSON.parse(readFileSync(swFile, "utf8"));
     const pkgKeys = Object.keys(lockData);
@@ -2497,7 +2600,7 @@ export async function parseNodeShrinkwrap(swFile) {
         `About to fetch npm registry metadata for ${pkgList.length} packages in parseNodeShrinkwrap`,
       );
     }
-    return await getNpmMetadata(pkgList);
+    return await getNpmMetadata(pkgList, undefined, { npmrcConfig });
   }
   return pkgList;
 }
@@ -2646,7 +2749,10 @@ export function stripPnpmPeerSuffix(version) {
  * {@link stripPnpmPeerSuffix}.
  *
  * @param {string|object} depPkg Dependency version string or package object.
- * @param {string} relativePath Base path for resolving link/file references.
+ * @param {string} relativePath Base path for resolving link/file references:
+ *   the directory of the importer that declares the dependency. Without it the
+ *   path is tried against the working directory, which only works when cdxgen
+ *   runs from the lock file's directory.
  * @returns {Promise<string|undefined>} The resolved published version.
  */
 export async function getVersionNumPnpm(depPkg, relativePath) {
@@ -2662,13 +2768,13 @@ export async function getVersionNumPnpm(depPkg, relativePath) {
       : join(version.replaceAll("../", "packages/"), "package.json");
     if (safeExistsSync(relativePkgJson)) {
       const importedComponentObj = await parsePkgJson(relativePkgJson, true);
-      version = importedComponentObj[0].version;
+      version = importedComponentObj[0]?.version;
     } else if (safeExistsSync(join(version, "package.json"))) {
       const importedComponentObj = await parsePkgJson(
         join(version, "package.json"),
         true,
       );
-      version = importedComponentObj[0].version;
+      version = importedComponentObj[0]?.version;
     } else if (
       safeExistsSync(join(version.replaceAll("../", ""), "package.json"))
     ) {
@@ -2676,7 +2782,7 @@ export async function getVersionNumPnpm(depPkg, relativePath) {
         join(version.replaceAll("../", ""), "package.json"),
         true,
       );
-      version = importedComponentObj[0].version;
+      version = importedComponentObj[0]?.version;
     }
   } else {
     // version: 3.0.1(ajv@8.14.0) or, under lockfile 5, 3.0.1_ajv@8.14.0
@@ -2685,6 +2791,25 @@ export async function getVersionNumPnpm(depPkg, relativePath) {
   return version;
 }
 
+/**
+ * Split the package name of a pnpm `file:` lock key into scope and name.
+ *
+ * @param {string} fullName Package name as written before `@file:`, eg `@scope/pkg`
+ * @returns {{group: string, name: string}} Scope (with its `@`) and bare name
+ */
+function splitPnpmFilePackageName(fullName) {
+  if (fullName.startsWith("@")) {
+    const slash = fullName.indexOf("/");
+    if (slash > 0) {
+      return {
+        group: fullName.slice(0, slash),
+        name: fullName.slice(slash + 1),
+      };
+    }
+  }
+  return { group: "", name: fullName };
+}
+
 /**
  * Resolve a pnpm dependency to its PURL string.
  *
@@ -2723,11 +2848,16 @@ export async function getPnpmDepPurl(
     }
     gitPkgRefs[versionObj.version] = { group, name, version };
   } else {
+    const rawSpec =
+      typeof versionObj?.version === "string" ? versionObj.version : "";
     version = await getVersionNumPnpm(depPkg, relativePath);
     const gitEntry =
       gitPkgRefs[packageName] ||
       gitPkgRefs[version] ||
-      gitPkgRefs[normalizePnpmLockKey(`${packageName}@${version}`)];
+      gitPkgRefs[normalizePnpmLockKey(`${packageName}@${version}`)] ||
+      (rawSpec.startsWith("file:")
+        ? gitPkgRefs[normalizePnpmLockKey(`${packageName}@${rawSpec}`)]
+        : undefined);
     if (gitEntry) {
       group = gitEntry.group;
       name = gitEntry.name;
@@ -2980,7 +3110,8 @@ export async function pnpmMetadata(pkgList, lockFilePath) {
       // Silently ignore parsing errors for individual packages
       if (DEBUG_MODE) {
         console.log(
-          `Failed to parse package.json at ${packageJsonPath}:`,
+          "Failed to parse package.json at %s:",
+          packageJsonPath,
           error.message,
         );
       }
@@ -3148,6 +3279,33 @@ export async function parsePnpmLock(
         npmrcConfig,
       ),
     );
+    // A `file:` package is keyed by its path (`localdep@file:localdep.tgz`) and
+    // pnpm copies the manifest version into its `packages` entry. Registering
+    // it lets an importer that names the path resolve to the same ref the
+    // package loop below builds, instead of a version made from the path.
+    if (lockfileVersion >= 9) {
+      for (const [lockKey, pkgEntry] of Object.entries(
+        yamlObj.packages || {},
+      )) {
+        const fileAt = lockKey.indexOf("@file:", 1);
+        if (fileAt < 1 || !pkgEntry?.version) {
+          continue;
+        }
+        const normalizedKey = normalizePnpmLockKey(lockKey);
+        if (gitPkgRefs[normalizedKey]) {
+          continue;
+        }
+        const { group, name } = splitPnpmFilePackageName(
+          lockKey.slice(0, fileAt),
+        );
+        gitPkgRefs[normalizedKey] = {
+          group,
+          name,
+          version: String(pkgEntry.version),
+          vcsUrl: lockKey.slice(fileAt + 1),
+        };
+      }
+    }
     // This logic matches the pnpm list command to include only direct dependencies
     if (ppurl !== "" && yamlObj?.importers) {
       // In lock file version 6, direct dependencies is under importers
@@ -3184,7 +3342,7 @@ export async function parsePnpmLock(
           rootDevDeps[rdk],
           rdk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3206,7 +3364,7 @@ export async function parsePnpmLock(
           rootOptionalDeps[rdk] || rootPeerDeps[rdk],
           rdk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3229,7 +3387,7 @@ export async function parsePnpmLock(
           rootDirectDeps[dk],
           dk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3340,7 +3498,7 @@ export async function parsePnpmLock(
             versionObj,
             cdk,
             gitPkgRefs,
-            importedComponentName,
+            join(pnpmLockDir, importedComponentName),
             githubServerHost,
             npmrcConfig,
           );
@@ -3357,7 +3515,10 @@ export async function parsePnpmLock(
           }
         }
         for (const cdk of Object.keys(componentDevDeps)) {
-          const version = await getVersionNumPnpm(componentDevDeps[cdk]);
+          const version = await getVersionNumPnpm(
+            componentDevDeps[cdk],
+            join(pnpmLockDir, importedComponentName),
+          );
           const dpurl = build({
             type: "npm",
             namespace: "" || null,
@@ -3375,6 +3536,7 @@ export async function parsePnpmLock(
         })) {
           const version = await getVersionNumPnpm(
             componentOptionalDeps[cdk] || componentPeerDeps[cdk],
+            join(pnpmLockDir, importedComponentName),
           );
           const dpurl = build({
             type: "npm",
@@ -3399,6 +3561,11 @@ export async function parsePnpmLock(
     // snapshots is a new key under lockfile version 9
     const snapshots = yamlObj.snapshots || {};
     const pkgKeys = { ...Object.keys(packages), ...Object.keys(snapshots) };
+    // A lock entry named `__proto__` is not a real package: emitting it as a
+    // component produces SBOM data that breaks naive JSON consumers, and the
+    // name can never come from the npm registry. Legitimate names such as
+    // `constructor` or `prototype` are unaffected.
+    const protoLockKey = /(^|\/)__proto__(@|$)/;
     for (const k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
       // In lockfileVersion 6, /@babel/code-frame@7.18.6
@@ -3407,6 +3574,9 @@ export async function parsePnpmLock(
       if (lockfileVersion >= 6 && fullName.includes("(")) {
         fullName = fullName.split("(")[0];
       }
+      if (protoLockKey.test(pkgKeys[k]) || protoLockKey.test(fullName)) {
+        continue;
+      }
       const parts = fullName.split("/");
       const packageNode =
         packages[pkgKeys[k]] ||
@@ -3465,9 +3635,17 @@ export async function parsePnpmLock(
         }
         let opurlString;
         if (vers.includes("@")) {
-          opurlString = Purl.parse(
-            `pkg:npm/${vers.replace(/^@/g, "%40")}`,
-          ).toString();
+          // An aliased optional dependency records `name@version`, and the
+          // version may carry semver build metadata that must be escaped.
+          const aliasParts = parsePurlLoose(`pkg:npm/${vers}`);
+          opurlString = aliasParts
+            ? npmPurl(
+                aliasParts.namespace
+                  ? `${aliasParts.namespace}/${aliasParts.name}`
+                  : aliasParts.name,
+                aliasParts.version,
+              )
+            : npmPurl(opkgName, vers);
         } else {
           opurlString = npmPurl(opkgName, vers);
         }
@@ -3536,8 +3714,17 @@ export async function parsePnpmLock(
             possibleHttpParts[possibleHttpParts.length - 1].startsWith("file")
           ) {
             srcUrl = possibleHttpParts[possibleHttpParts.length - 1];
-            name = fullName.replace(`@${srcUrl}`, "");
-            version = "";
+            ({ group, name } = splitPnpmFilePackageName(
+              fullName.replace(`@${srcUrl}`, ""),
+            ));
+            // The key names the path, not a version. pnpm copies the version
+            // from the package's own manifest into its `packages` entry, and
+            // that may carry semver build metadata (`2.0.0+local`).
+            version = String(
+              packages[pkgKeys[k]]?.version ||
+                packages[fullName]?.version ||
+                "",
+            );
           } else {
             group = parts.length > 1 ? parts[0] : "";
             const tmpA = parts[parts.length - 1].split("@");
@@ -4004,7 +4191,7 @@ export async function parsePnpmLock(
         `About to fetch npm registry metadata for ${pkgList.length} packages in parsePnpmLock`,
       );
     }
-    pkgList = await getNpmMetadata(pkgList);
+    pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
     return {
       pkgList,
       dependenciesList,
@@ -4034,7 +4221,7 @@ export async function parseBowerJson(bowerJsonFile) {
         group: pkgIdentifier.scope || "",
         version: pkgData.version || "",
         description: pkgData.description || "",
-        license: pkgData.license || "",
+        license: resolveNpmLicense(pkgData) || "",
         properties: [
           {
             name: "internal:SrcFile",