@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/cli/jsBom.js

@@ -13,7 +13,11 @@ import {
 } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
-import { hasAnyProjectType, isPackageManagerAllowed } from "../core/env.js";
+import {
+  hasAnyProjectType,
+  isPackageManagerAllowed,
+  shouldFetchPackageMetadata,
+} from "../core/env.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import {
@@ -24,7 +28,10 @@ import {
   rewriteExtractedArchivePaths,
 } from "../ecosystems/asarutils.js";
 import { parseBunLock } from "../ecosystems/bunutils.js";
-import { parseCaxaMetadata } from "../ecosystems/caxa.js";
+import {
+  enrichCaxaMetadataFromApp,
+  parseCaxaMetadata,
+} from "../ecosystems/caxa.js";
 import {
   CHROME_EXTENSION_PURL_TYPE,
   collectChromeExtensionsFromPath,
@@ -36,8 +43,12 @@ import {
   parseDenoJsonFile,
   parseDenoLock,
 } from "../ecosystems/denoutils.js";
+import { getNpmMetadata } from "../ecosystems/ecosystems.js";
 import { addEvidenceForImports } from "../ecosystems/jsEvidence.js";
-import { createNpmWorkspacePurl } from "../ecosystems/npmutils.js";
+import {
+  createNpmWorkspacePurl,
+  loadNpmrcConfig,
+} from "../ecosystems/npmutils.js";
 import {
   parseBowerJson,
   parseMinJs,
@@ -77,6 +88,7 @@ import {
 } from "../inventory/analyzer.js";
 import {
   markNpmTypesPackagesAsExcluded,
+  markTypeOnlyDependenciesOptional,
   mergeDependencies,
   mergeServices,
   propagateRequiredScopeFromDependencies,
@@ -216,12 +228,20 @@ export async function createNodejsBom(path, options) {
     const pkgJsonFiles = getAllFiles(path, "**/package.json", options);
     // Are there any package.json files in the container?
     if (pkgJsonFiles.length) {
+      // Every manifest is read locally first, and the registry is asked about
+      // the ones still missing fields in one round, rather than once per file.
+      const npmrcConfig = loadNpmrcConfig(path);
       for (const pj of pkgJsonFiles) {
-        const dlist = await parsePkgJson(pj);
+        const dlist = await parsePkgJson(pj, false, false, {
+          fetchMetadata: false,
+        });
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       }
+      if (shouldFetchPackageMetadata() && pkgList.length) {
+        pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
+      }
       if (includedAiInventoryTypes.length) {
         aiInventory = collectAiInventory(
           path,
@@ -567,7 +587,16 @@ export async function createNodejsBom(path, options) {
         recordSensitiveFileRead(npmrcFile, {
           label: "npm registry configuration",
         });
-        const npmrcObj = parseNpmrc(npmrcData);
+        let npmrcObj = {};
+        try {
+          npmrcObj = parseNpmrc(npmrcData);
+        } catch (e) {
+          // A malformed .npmrc must degrade to a warning, never abort the scan.
+          console.warn(
+            `Unable to parse ${npmrcFile}. Continuing without it. ${e?.message || ""}`,
+          );
+          npmrcObj = {};
+        }
         for (const [key, value] of Object.entries(npmrcObj)) {
           const baseKey = key.replace(/^(?:\/\/[^/]+\/|@[^:]+:)/, "");
           if (
@@ -957,8 +986,12 @@ export async function createNodejsBom(path, options) {
   ) {
     // Rush.js creates node_modules inside common/temp directory
     const nmDir = join(path, "common", "temp", "node_modules");
-    // Do rush install if we don't have node_modules directory
-    if (!safeExistsSync(nmDir)) {
+    // Do rush install if we don't have node_modules directory. `rush install`
+    // drives pnpm without cdxgen's --ignore-scripts hardening and
+    // --bypass-policy disables rush's own policy gate, so it must respect
+    // --no-install-deps and the pre-build lifecycle like every other
+    // installer.
+    if (!safeExistsSync(nmDir) && options.installDeps !== false) {
       console.log("Executing 'rush install --no-link'", path);
       const result = safeSpawnSync(
         "rush",
@@ -990,14 +1023,12 @@ export async function createNodejsBom(path, options) {
     if (safeExistsSync(swFile)) {
       let pkgList = await parseNodeShrinkwrap(swFile);
       pkgList = addWasmComponentsFromImports(pkgList, allImports);
-      if (allImports && Object.keys(allImports).length) {
-        pkgList = await addEvidenceForImports(
-          pkgList,
-          allImports,
-          allExports,
-          options.deep,
-        );
-      }
+      pkgList = await addEvidenceForImports(
+        pkgList,
+        allImports,
+        allExports,
+        options.deep,
+      );
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
         src: path,
@@ -1026,16 +1057,15 @@ export async function createNodejsBom(path, options) {
           pnpmLockObj.dependenciesList,
         );
       }
-      if (allImports && Object.keys(allImports).length) {
-        pkgList = await addEvidenceForImports(
-          pkgList,
-          allImports,
-          allExports,
-          options.deep,
-        );
-      }
+      pkgList = await addEvidenceForImports(
+        pkgList,
+        allImports,
+        allExports,
+        options.deep,
+      );
       pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
       pkgList = markNpmTypesPackagesAsExcluded(pkgList);
+      pkgList = markTypeOnlyDependenciesOptional(pkgList, dependencies);
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
         allExports,
@@ -1120,25 +1150,25 @@ export async function createNodejsBom(path, options) {
               );
               workspacePackages.push(workspaceRef);
               workspaceSrcFiles[workspaceRef] = relativePkgJsonFile;
-              if (pkgData?.dependencies || pkgData?.devDependencies) {
-                const dlist = new Set();
-                for (const [k, v] of Object.entries({
-                  ...(pkgData.dependencies || {}),
-                  ...(pkgData.devDependencies || {}),
-                })) {
-                  if (v.match(/^\d/)) {
-                    dlist.add(`pkg:npm/${k}@${v}`);
-                  } else {
-                    dlist.add(`pkg:npm/${k}`);
-                  }
-                }
-                workspaceDirectDeps[workspaceRef] = Array.from(dlist);
-                for (const dep of workspaceDirectDeps[workspaceRef]) {
-                  if (!depsWorkspaceRefs[dep]) {
-                    depsWorkspaceRefs[dep] = [];
-                  }
-                  depsWorkspaceRefs[dep].push(workspaceRef);
+              // The declared name and range of each direct dependency, which
+              // parseYarnLock resolves against the lock file to link the
+              // member into the dependency tree.
+              const declaredDeps = {
+                ...(pkgData.dependencies || {}),
+                ...(pkgData.optionalDependencies || {}),
+                ...(pkgData.devDependencies || {}),
+              };
+              if (Object.keys(declaredDeps).length) {
+                workspaceDirectDeps[workspaceRef] = declaredDeps;
+              }
+              for (const [k, v] of Object.entries(declaredDeps)) {
+                const dep = /^\d/.test(String(v))
+                  ? `pkg:npm/${k}@${v}`
+                  : `pkg:npm/${k}`;
+                if (!depsWorkspaceRefs[dep]) {
+                  depsWorkspaceRefs[dep] = [];
                 }
+                depsWorkspaceRefs[dep].push(workspaceRef);
               }
             }
           }
@@ -1410,12 +1440,21 @@ export async function createNodejsBom(path, options) {
       options,
     );
     manifestFiles = manifestFiles.concat(pkgJsonFiles);
+    // The installed manifests answer locally; one round asks the registry only
+    // about the packages still missing fields, instead of one round per file.
     for (const pkgjf of pkgJsonFiles) {
-      const dlist = await parsePkgJson(pkgjf);
+      const dlist = await parsePkgJson(pkgjf, false, false, {
+        fetchMetadata: false,
+      });
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
     }
+    if (shouldFetchPackageMetadata() && pkgList.length) {
+      pkgList = await getNpmMetadata(pkgList, undefined, {
+        npmrcConfig: loadNpmrcConfig(path),
+      });
+    }
     if (!parentComponent || !Object.keys(parentComponent).length) {
       if (safeExistsSync(join(path, "package.json"))) {
         const pcs = await parsePkgJson(join(path, "package.json"), true, true);
@@ -1460,15 +1499,15 @@ export async function createNodejsBom(path, options) {
   if ("project-name" in options && !options.parentComponent) {
     options.parentComponent = parentComponent;
   }
-  if (allImports && Object.keys(allImports).length) {
-    pkgList = addWasmComponentsFromImports(pkgList, allImports);
-    pkgList = await addEvidenceForImports(
-      pkgList,
-      allImports,
-      allExports,
-      options.deep,
-    );
-  }
+  // The evidence pass runs without imports too: it also fills deep-mode
+  // metadata and removes internal:LocalNodeModulesPath from every component.
+  pkgList = addWasmComponentsFromImports(pkgList, allImports);
+  pkgList = await addEvidenceForImports(
+    pkgList,
+    allImports,
+    allExports,
+    options.deep,
+  );
   if (mcpInventory.components?.length) {
     pkgList = trimComponents(pkgList.concat(mcpInventory.components));
   }
@@ -1495,6 +1534,7 @@ export async function createNodejsBom(path, options) {
   );
   pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
   pkgList = markNpmTypesPackagesAsExcluded(pkgList);
+  pkgList = markTypeOnlyDependenciesOptional(pkgList, dependencies);
   if (exactAiInventoryType === "mcp") {
     pkgList = trimComponents(filterInventorySubjectsByTypes(pkgList, ["mcp"]));
     dependencies = filterInventoryDependencies(
@@ -1624,8 +1664,14 @@ export async function createCaxaBom(path, options) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${mfile}`);
     }
-    const { parentComponent, components, dependencies } =
-      await parseCaxaMetadata(mfile);
+    let mdata = await parseCaxaMetadata(mfile);
+    if (options.caxaAppDir) {
+      mdata = await enrichCaxaMetadataFromApp(
+        mdata,
+        resolve(options.caxaAppDir),
+      );
+    }
+    const { parentComponent, components, dependencies } = mdata;
     if (parentComponent) {
       if (!finalParentComponent) {
         finalParentComponent = parentComponent;