@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/cli/jvmBom.js

@@ -1,5 +1,5 @@
 import { Buffer } from "node:buffer";
-import { readFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import process from "node:process";
@@ -7,7 +7,11 @@ import process from "node:process";
 import { build } from "@cdxgen/cdx-purl";
 import { gte, lte } from "semver";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  isSecureMode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
 import { commandOutputText, recordDegradation } from "../core/buildLedger.js";
 import {
   deferFailOnError,
@@ -41,9 +45,11 @@ import {
   buildObjectForGradleModule,
   collectGradleDependencies,
   executeParallelGradleProperties,
+  findMillDaemons,
   getGradleCommand,
   getMavenCommand,
   getMillCommand,
+  getMillVersion,
   hasGradleInvocationFailure,
   parseGradleDep,
   parseGradleInfoLogsForUrls,
@@ -52,29 +58,41 @@ import {
   parseGradleVersionCatalog,
   recordGradleInvocationFailure,
   splitOutputByGradleProjects,
+  stopMillDaemons,
 } from "../ecosystems/gradleutils.js";
 import {
   parseModuleBazel,
   parseModuleBazelLock,
 } from "../ecosystems/parsers-bazel.js";
 import {
+  MAVEN_MODULE_TREE_STEM,
   parseBazelActionGraph,
   parseBazelSkyframe,
   parseMavenTree,
   parseMavenTreeJson,
   parseMillDependency,
   parsePom,
+  readMavenModuleTrees,
 } from "../ecosystems/parsers-jvm.js";
 import {
   addPlugin,
   cleanupPlugin,
   determineSbtVersion,
   discoverSbtProjects,
+  isSbt2Version,
   parseSbtLock,
   parseSbtProjects,
   parseSbtRootProject,
   parseSbtTree,
+  sbt2DependencyTreeCommand,
+  sbtSpawnSync,
 } from "../ecosystems/sbtutils.js";
+import { collectScalaCliComponents } from "../ecosystems/scalacliutils.js";
+import { collectScalaJsNpmComponents } from "../ecosystems/scalasem.js";
+import {
+  isBuildToolRateLimited,
+  noteBuildToolRateLimit,
+} from "../inventory/buildToolRateLimit.js";
 import {
   collectJarNS,
   collectMvnDependencies,
@@ -85,8 +103,15 @@ import {
   attachIdentityTools,
   extractToolRefs,
 } from "../inventory/evidenceUtils.js";
+import {
+  coursierCacheDir,
+  findLocalMavenArtifact,
+  locateInCoursierCache,
+  projectSettingsArgs,
+} from "../inventory/jvmLocalRepos.js";
 import { readGradleWrapperVersion } from "../inventory/jvmToolEnv.js";
 import { applyPurl, mavenPurl } from "../inventory/purl.js";
+import { publishedArtifactId } from "../inventory/scalaCoords.js";
 import {
   buildBomNSData,
   createDefaultParentComponent,
@@ -136,6 +161,127 @@ export const GRADLE_INIT_SCRIPT = resolve(
 export const SBT_CACHE_DIR =
   readEnvironmentVariable("SBT_CACHE_DIR") || join(homedir(), ".ivy2", "cache");
 
+/**
+ * Collect the jars in the caches sbt uses: the Coursier cache, which sbt 1.3
+ * and later resolve into, and the Ivy cache named by SBT_CACHE_DIR, which
+ * older builds used.
+ *
+ * @returns {Promise<Object>} Jar namespace mapping, as collectJarNS returns.
+ */
+async function collectSbtCacheDependencies() {
+  let nsMapping = {};
+  for (const cacheDir of [coursierCacheDir(), SBT_CACHE_DIR]) {
+    if (cacheDir && safeExistsSync(cacheDir)) {
+      nsMapping = { ...nsMapping, ...(await collectJarNS(cacheDir)) };
+    }
+  }
+  return nsMapping;
+}
+
+/**
+ * The jar of a resolved sbt dependency in the user's own caches: the Coursier
+ * cache sbt 1.3 and later resolve into, the other local Maven caches, and the
+ * Ivy cache older builds used.
+ *
+ * @param {Object} pkg Package with group, name and version.
+ * @returns {string|undefined} Path of the jar.
+ */
+function localSbtDependencyJar(pkg) {
+  // Scala components are named without their binary suffix; the jar has it.
+  const name = publishedArtifactId(pkg);
+  const coursierDir = locateInCoursierCache(pkg.group, name, pkg.version)?.dir;
+  const coursierJar =
+    coursierDir && join(coursierDir, `${name}-${pkg.version}.jar`);
+  if (coursierJar && safeExistsSync(coursierJar)) {
+    return coursierJar;
+  }
+  const jarPath = findLocalMavenArtifact(pkg.group, name, pkg.version)?.jarPath;
+  if (jarPath) {
+    return jarPath;
+  }
+  for (const typeDir of ["jars", "bundles"]) {
+    const ivyJar = join(
+      SBT_CACHE_DIR,
+      pkg.group,
+      name,
+      typeDir,
+      `${name}-${pkg.version}.jar`,
+    );
+    if (safeExistsSync(ivyJar)) {
+      return ivyJar;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Collect the namespaces of the jars of resolved sbt dependencies. sbt has
+ * just downloaded them into the user's caches, so each is read from there;
+ * the rest of the cache is never walked.
+ *
+ * @param {Object[]} pkgList Packages from the sbt dependency trees.
+ * @param {Object} [known] Jar namespace mapping already collected. Packages
+ *   it covers are skipped.
+ * @returns {Promise<Object>} Jar namespace mapping keyed by package purl.
+ */
+export async function collectSbtDependencyJars(pkgList, known = {}) {
+  const nsMapping = {};
+  for (const pkg of pkgList || []) {
+    // Applications are the build's own projects, which no cache holds.
+    if (
+      !pkg?.purl ||
+      !pkg.group ||
+      !pkg.name ||
+      !pkg.version ||
+      pkg.type === "application" ||
+      known[pkg.purl] ||
+      nsMapping[pkg.purl]
+    ) {
+      continue;
+    }
+    const jarPath = localSbtDependencyJar(pkg);
+    if (!jarPath) {
+      continue;
+    }
+    const [entry] = Object.values(await collectJarNS(jarPath));
+    if (entry) {
+      nsMapping[pkg.purl] = entry;
+    }
+  }
+  return nsMapping;
+}
+
+/**
+ * The purls and bom-refs of a parent component and the module components
+ * nested under it.
+ *
+ * @param {Object} parentComponent Parent component.
+ * @returns {Set<string>} Purls and bom-refs.
+ */
+export function ownComponentRefs(parentComponent) {
+  const refs = new Set();
+  // The Gradle path nests modules that can point back at the parent, so the
+  // walk remembers what it has seen.
+  const seen = new Set();
+  const stack = parentComponent ? [parentComponent] : [];
+  while (stack.length) {
+    const component = stack.pop();
+    if (!component || typeof component !== "object" || seen.has(component)) {
+      continue;
+    }
+    seen.add(component);
+    for (const ref of [component.purl, component["bom-ref"]]) {
+      if (ref) {
+        refs.add(ref);
+      }
+    }
+    if (Array.isArray(component.components)) {
+      stack.push(...component.components);
+    }
+  }
+  return refs;
+}
+
 /**
  * Function to create bom string for Java jars
  *
@@ -167,18 +313,20 @@ export async function createJarBom(path, options) {
   const parentComponent = createDefaultParentComponent(path, "maven", options);
   if (options.useGradleCache) {
     nsMapping = await collectGradleDependencies(
-      getGradleCommand(path, null),
+      getGradleCommand(path, null, options),
       path,
       false,
       true,
     );
   } else if (options.useMavenCache) {
     nsMapping = await collectMvnDependencies(
-      getMavenCommand(path, null),
+      getMavenCommand(path, null, options),
       null,
       false,
       true,
     );
+  } else if (options.useSbtCache) {
+    nsMapping = await collectSbtCacheDependencies();
   }
   if (path.endsWith(".jar")) {
     jarFiles = [resolve(path)];
@@ -207,14 +355,17 @@ export async function createJarBom(path, options) {
     if (dlist?.length) {
       pkgList = pkgList.concat(dlist);
     }
-    if (pkgList.length) {
-      pkgList = await getMvnMetadata(pkgList);
-    }
     // Clean up
     if (tempDir?.startsWith(getTmpDir())) {
       safeRmSync(tempDir, { recursive: true, force: true });
     }
   }
+  // Metadata is resolved once for the whole scan. Inside the loop every jar
+  // re-resolved the packages of all the jars before it, and lookups that had
+  // failed were sent again each time.
+  if (pkgList.length) {
+    pkgList = await getMvnMetadata(pkgList);
+  }
   pkgList = pkgList.concat(await convertJarNSToPackages(nsMapping));
   return buildBomNSData(options, pkgList, "maven", {
     src: path,
@@ -222,6 +373,37 @@ export async function createJarBom(path, options) {
   });
 }
 
+/**
+ * Whether a project keeps source directories of its own. Used to keep the
+ * root project of an sbt build: a root with sources is usually the
+ * application itself and merely aggregates the modules for convenience,
+ * while a root without sources is a pure aggregator whose own resolution
+ * adds nothing.
+ *
+ * @param {string} basePath Directory of the sbt build
+ * @returns {boolean} True when the build root has main sources
+ */
+function sbtRootHasOwnSources(basePath) {
+  for (const language of ["scala", "java", "kotlin"]) {
+    if (safeExistsSync(join(basePath, "src", "main", language))) {
+      return true;
+    }
+  }
+  // A Play application keeps its sources in app/ instead of src/main
+  const appDir = join(basePath, "app");
+  if (safeExistsSync(appDir)) {
+    try {
+      const entries = readdirSync(appDir, { withFileTypes: true });
+      return entries.some(
+        (entry) => entry.isDirectory() || entry.name.endsWith(".scala"),
+      );
+    } catch (_err) {
+      return false;
+    }
+  }
+  return false;
+}
+
 /**
  * Discover the real sbt project ids for a build by invoking sbt's own
  * `projects` command. This is more reliable than scraping the build files with
@@ -229,32 +411,46 @@ export async function createJarBom(path, options) {
  * (commented-out code, examples, values that merely resemble project defs) that
  * can lead to hangs when those bogus scopes are later passed to `dependencyTree`.
  *
+ * The root project is kept when it has sources of its own, since it is then
+ * the application rather than a pure aggregator.
+ *
  * Falls back to the regex-based {@link discoverSbtProjects} heuristic when the
  * sbt invocation fails or yields nothing useful.
  *
  * @param {string} basePath Directory of the sbt build
  * @param {string} sbtCmd sbt executable
  * @param {Object} env Environment for the spawned process
+ * @param {string[]} [launcherArgs] Launcher options placed before the sbt arguments
  * @returns {string[]} List of sbt project ids
  */
-export function discoverSbtProjectsFromCmd(basePath, sbtCmd, env) {
+export function discoverSbtProjectsFromCmd(
+  basePath,
+  sbtCmd,
+  env,
+  launcherArgs = [],
+) {
   try {
-    const result = safeSpawnSync(
+    const result = sbtSpawnSync(
       sbtCmd,
-      ["-batch", "-no-colors", '"projects"'],
+      [...launcherArgs, "-batch", "-no-colors", '"projects"'],
       {
         cwd: basePath,
         shell: true,
+        // The quotes around the sbt command are for the shell to strip.
+        cdxgenRawShellArgs: true,
         env,
         encoding: "utf-8",
       },
+      true,
     );
     if (result.status === 0 && !result.error) {
       const { projects, root } = parseSbtProjects(result.stdout || "");
-      // Exclude the aggregating root project - its own dependencyTree is
-      // usually a subset of the aggregated subprojects and re-resolving it
-      // only adds noise/time.
-      const subprojects = projects.filter((p) => p !== root);
+      // Exclude the aggregating root project unless it has sources of its
+      // own: its dependencyTree is then the application's own dependencies
+      // and not a subset of the aggregated subprojects.
+      const subprojects = sbtRootHasOwnSources(basePath)
+        ? projects
+        : projects.filter((p) => p !== root);
       if (subprojects.length > 0) {
         if (DEBUG_MODE) {
           console.log(
@@ -318,6 +514,8 @@ export async function createJavaBom(path, options) {
   let tools;
   let possible_misses = false;
   let parallelPropTaskOut = "";
+  // Mill daemons already running belong to the user and outlive the scan
+  const millDaemonsBefore = findMillDaemons(path);
   try {
     // war/ear mode
     if (path.endsWith(".war") || path.endsWith(".jar")) {
@@ -327,8 +525,10 @@ export async function createJavaBom(path, options) {
           console.log(`Retrieving packages from ${path}`);
         }
         const tempDir = safeMkdtempSync(join(getTmpDir(), "war-deps-"));
-        jarNSMapping = await collectJarNS(tempDir);
-        pkgList = await extractJarArchive(path, tempDir, jarNSMapping);
+        // The nested jars are read from the extraction directory and their
+        // namespaces attached to each component there; the directory is
+        // removed afterwards, so no jar paths are kept for evinse.
+        pkgList = await extractJarArchive(path, tempDir);
         if (pkgList.length) {
           pkgList = await getMvnMetadata(pkgList);
         }
@@ -453,9 +653,21 @@ export async function createJavaBom(path, options) {
         }
       }
       const firstPom = pomFiles.length ? pomFiles[0] : undefined;
-      let mavenCmd = getMavenCommand(path, path);
+      let mavenCmd = getMavenCommand(path, path, options);
+      // Pom files whose own tree a recursive run of their aggregator already
+      // returned. Each is skipped when its turn comes, so a reactor is run
+      // once from its aggregator instead of once per member.
+      const coveredPomFiles = new Set();
       for (const f of pomFiles) {
         const basePath = dirname(f);
+        if (coveredPomFiles.has(f)) {
+          if (DEBUG_MODE) {
+            console.log(
+              `Skipped ${basePath}: the recursive dependency:tree run of its aggregator already resolved it.`,
+            );
+          }
+          continue;
+        }
         if (
           isQuarkus &&
           !options.deep &&
@@ -466,14 +678,39 @@ export async function createJavaBom(path, options) {
           }
           continue;
         }
-        const settingsXml = join(basePath, "settings.xml");
-        if (safeExistsSync(settingsXml)) {
-          console.log(
-            `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`,
-          );
+        if (isBuildToolRateLimited("maven")) {
+          // Every further Maven run in this scan would pay the same back-off
+          // for the same empty answer, so Maven is not asked again. The
+          // direct dependencies the pom declares are kept, as for a pom whose
+          // run failed.
+          if (DEBUG_MODE) {
+            console.log(
+              `Parsing ${f} without Maven: the repository rate limited Maven in this scan.`,
+            );
+          }
+          const dlist = parsePom(f)?.dependencies || [];
+          if (dlist.length) {
+            pkgList = pkgList.concat(dlist);
+          }
+          continue;
         }
         if (mavenCmd?.endsWith("mvn")) {
-          mavenCmd = getMavenCommand(basePath, path);
+          mavenCmd = getMavenCommand(basePath, path, options);
+        }
+        // A settings.xml beside the pom is passed as global settings, so the
+        // user's own settings.xml, with its mirrors and credentials, still
+        // applies on top of it.
+        const projectSettings = projectSettingsArgs(basePath, {
+          secureMode: isSecureMode,
+        });
+        if (projectSettings.args.length) {
+          console.log(
+            `Passing ${projectSettings.settingsFile} to Maven as global settings (-gs), so your own settings.xml still applies. Name a settings file in MVN_ARGS to change this.`,
+          );
+        } else if (projectSettings.skipped === "secure-mode") {
+          console.log(
+            `Ignoring ${projectSettings.settingsFile} in secure mode. If you trust it, pass it with MVN_ARGS='--global-settings ${projectSettings.settingsFile}'.`,
+          );
         }
         // Should we attempt to resolve class names
         if (options.resolveClass || options.deep) {
@@ -488,13 +725,18 @@ export async function createJavaBom(path, options) {
           }
         }
         // Use the cyclonedx maven plugin if there is no preference for maven deps tree
-        if (!useMavenDepsTree) {
+        if (!useMavenDepsTree && !isBuildToolRateLimited("maven")) {
           thoughtLog("The user wants me to use the cyclonedx-maven plugin.");
           console.log(`Executing '${mavenCmd}' in`, basePath);
           result = safeSpawnSync(mavenCmd, mvnArgs, {
             cwd: basePath,
             shell: isWin,
           });
+          noteBuildToolRateLimit("maven", commandOutputText(result), {
+            command: `${basename(mavenCmd)} ${mvnArgs.join(" ")}`,
+            exitCode:
+              typeof result.status === "number" ? result.status : undefined,
+          });
           // Check if the cyclonedx plugin created the required bom.json file
           // Sometimes the plugin fails silently for complex maven projects
           bomJsonFiles = getAllFiles(
@@ -520,8 +762,20 @@ export async function createJavaBom(path, options) {
         ) {
           const tempRoot = getTmpDir();
           const tempDir = safeMkdtempSync(join(tempRoot, "cdxgen-mvn-"));
-          const tempMvnTree = join(tempDir, "cdxgen-mvn-tree.json");
-          const tempMvnTreeText = join(tempDir, "cdxgen-mvn-tree.txt");
+          // The recursive run writes one tree per reactor module into these
+          // directories, so the aggregator's run returns every module.
+          const treeJsonDir = join(tempDir, "tree-json");
+          const treeTextDir = join(tempDir, "tree-text");
+          safeMkdirSync(treeJsonDir);
+          safeMkdirSync(treeTextDir);
+          const tempMvnTree = join(
+            treeJsonDir,
+            `${MAVEN_MODULE_TREE_STEM}.json`,
+          );
+          const tempMvnTreeText = join(
+            treeTextDir,
+            `${MAVEN_MODULE_TREE_STEM}.txt`,
+          );
           const tempMvnParentTree = join(
             tempDir,
             "cdxgen-mvn-parent-tree.json",
@@ -541,14 +795,11 @@ export async function createJavaBom(path, options) {
               addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
               mvnTreeArgs = mvnTreeArgs.concat(addArgs);
             }
-            // Automatically use settings.xml to improve the success for fallback
-            if (safeExistsSync(settingsXml)) {
-              mvnTreeArgs.push("-s");
-              mvnTreeArgs.push(settingsXml);
-            }
+            mvnTreeArgs = mvnTreeArgs.concat(projectSettings.args);
             // For the first pom alone, we need to execute first in non-recursive mode to capture
             // the parent component. Then, we execute all of them in recursive mode
-            if (f === firstPom) {
+            // A rate limit the --deep copy-dependencies run met ends it too.
+            if (f === firstPom && !isBuildToolRateLimited("maven")) {
               thoughtLog(
                 "What is the parent component here? Let's use maven command to find out.",
               );
@@ -558,14 +809,19 @@ export async function createJavaBom(path, options) {
                 `-DoutputFile=${tempMvnParentTree}`,
                 "-DoutputType=json",
               ];
-              if (addArgs.length) {
-                findParentComponentArgs =
-                  findParentComponentArgs.concat(addArgs);
-              }
+              findParentComponentArgs = findParentComponentArgs.concat(
+                addArgs,
+                projectSettings.args,
+              );
               result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
                 cwd: basePath,
                 shell: isWin,
               });
+              noteBuildToolRateLimit("maven", commandOutputText(result), {
+                command: `${basename(mavenCmd)} ${findParentComponentArgs.join(" ")}`,
+                exitCode:
+                  typeof result.status === "number" ? result.status : undefined,
+              });
               // If json is empty or unparseable, fallback to text parsing
               let emptyJson = !safeExistsSync(tempMvnParentTree);
               if (safeExistsSync(tempMvnParentTree)) {
@@ -581,16 +837,15 @@ export async function createJavaBom(path, options) {
                   }
                 }
               }
-              if (result.status !== 0 || result.error || emptyJson) {
+              if (
+                !isBuildToolRateLimited("maven") &&
+                (result.status !== 0 || result.error || emptyJson)
+              ) {
                 findParentComponentArgs = [
                   "dependency:tree",
                   "-N",
                   `-DoutputFile=${tempMvnParentTreeText}`,
-                ];
-                if (addArgs.length) {
-                  findParentComponentArgs =
-                    findParentComponentArgs.concat(addArgs);
-                }
+                ].concat(addArgs, projectSettings.args);
                 result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
                   cwd: basePath,
                   shell: isWin,
@@ -630,49 +885,60 @@ export async function createJavaBom(path, options) {
                 `Executing '${basename(mavenCmd)} dependency:tree ...' in ${basePath}`,
               );
             }
-            result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
-              cwd: basePath,
-              shell: isWin,
-            });
-            let emptyJson = !safeExistsSync(tempMvnTree);
-            if (safeExistsSync(tempMvnTree)) {
-              const mvnTreeString = readFileSync(tempMvnTree, {
-                encoding: "utf-8",
-              });
-              const parsedList = parseMavenTreeJson(mvnTreeString, f);
-              if (!parsedList?.pkgList?.length) {
-                emptyJson = true;
-                // Remove the invalid json file so text output is preferred below.
-                if (safeExistsSync(tempMvnTree)) {
-                  safeUnlinkSync(tempMvnTree);
-                }
-              }
-            }
-            if (result.status !== 0 || result.error || emptyJson) {
-              mvnTreeArgs = [
-                "dependency:tree",
-                `-DoutputFile=${tempMvnTreeText}`,
-              ];
-              if (addArgs.length) {
-                mvnTreeArgs = mvnTreeArgs.concat(addArgs);
-              }
-              if (safeExistsSync(settingsXml)) {
-                mvnTreeArgs.push("-s");
-                mvnTreeArgs.push(settingsXml);
-              }
+            if (isBuildToolRateLimited("maven")) {
+              // The parent or plugin run already met the rate limit, so the
+              // tree run is skipped rather than repeated for the same answer.
+              result = { status: 1 };
+            } else {
               result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
                 cwd: basePath,
                 shell: isWin,
               });
+              noteBuildToolRateLimit("maven", commandOutputText(result), {
+                command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
+                exitCode:
+                  typeof result.status === "number" ? result.status : undefined,
+              });
+              const emptyJson = !readMavenModuleTrees(
+                treeJsonDir,
+                f,
+              ).trees.some(
+                (tree) =>
+                  parseMavenTreeJson(tree.text, tree.pomFile)?.pkgList?.length,
+              );
+              if (emptyJson) {
+                // Remove the invalid json trees so the text output is
+                // preferred below.
+                safeRmSync(treeJsonDir, { recursive: true, force: true });
+              }
+              if (
+                !isBuildToolRateLimited("maven") &&
+                (result.status !== 0 || result.error || emptyJson)
+              ) {
+                mvnTreeArgs = [
+                  "dependency:tree",
+                  `-DoutputFile=${tempMvnTreeText}`,
+                ].concat(addArgs, projectSettings.args);
+                result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
+                  cwd: basePath,
+                  shell: isWin,
+                });
+                noteBuildToolRateLimit("maven", commandOutputText(result), {
+                  command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
+                  exitCode:
+                    typeof result.status === "number"
+                      ? result.status
+                      : undefined,
+                });
+              }
             }
             if (result.status !== 0 || result.error) {
               possible_misses = true;
               // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
               // These could be due to a range of reasons that are covered below.
               if (
-                pomFiles.length === 1 ||
-                DEBUG_MODE ||
-                PREFER_MAVEN_DEPS_TREE
+                !isBuildToolRateLimited("maven") &&
+                (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE)
               ) {
                 if (result.stdout) {
                   console.log(result.stdout);
@@ -771,16 +1037,18 @@ export async function createJavaBom(path, options) {
                 pkgList = pkgList.concat(dlist);
               }
             } else {
-              const treeFile = safeExistsSync(tempMvnTreeText)
-                ? tempMvnTreeText
-                : tempMvnTree;
-              if (safeExistsSync(treeFile)) {
-                const mvnTreeString = readFileSync(treeFile, {
-                  encoding: "utf-8",
-                });
-                const parsedList = treeFile.endsWith(".json")
-                  ? parseMavenTreeJson(mvnTreeString, f)
-                  : parseMavenTree(mvnTreeString, f);
+              // The text trees exist only when the JSON run failed and was
+              // retried. Each reactor module has its own tree, and a member
+              // whose tree is here is not run again on its own.
+              let moduleTrees = readMavenModuleTrees(treeTextDir, f);
+              if (!moduleTrees.trees.length) {
+                moduleTrees = readMavenModuleTrees(treeJsonDir, f);
+              }
+              for (const modulePom of moduleTrees.covered) {
+                coveredPomFiles.add(modulePom);
+              }
+              for (const tree of moduleTrees.trees) {
+                const parsedList = parseMavenTree(tree.text, tree.pomFile);
                 const dlist = parsedList.pkgList || [];
                 const tmpParentComponent = dlist.splice(0, 1)[0];
                 if (tmpParentComponent) {
@@ -1041,11 +1309,23 @@ export async function createJavaBom(path, options) {
       if (resolveGradleDistribution && gradleInitArgs.length) {
         gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
-      parallelPropTaskOut = executeParallelGradleProperties(
-        gradleRootPath,
-        [null].concat(includedBuilds),
-        gradleInitArgs,
-      );
+      // `gradle properties` evaluates the project's build scripts, so it is
+      // part of the dependency-tooling surface gated by --no-install-deps
+      // (and the pre-build lifecycle).
+      const gradleToolingAllowed =
+        options.installDeps !== false || options.introspect === true;
+      if (gradleToolingAllowed) {
+        parallelPropTaskOut = executeParallelGradleProperties(
+          gradleRootPath,
+          [null].concat(includedBuilds),
+          gradleInitArgs,
+          options,
+        );
+      } else {
+        console.log(
+          "Skipping 'gradle properties' since dependency installation is disabled. Only statically parsed Gradle metadata will be used.",
+        );
+      }
       if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
         const outputLines = parallelPropTaskOut.split("\n");
         for (const [_i, line] of outputLines.entries()) {
@@ -1073,7 +1353,14 @@ export async function createJavaBom(path, options) {
           }
           parallelPropTaskOut = parallelPropTaskOut.concat(
             "\n",
-            executeParallelGradleProperties(gradleRootPath, includedBuilds),
+            gradleToolingAllowed
+              ? executeParallelGradleProperties(
+                  gradleRootPath,
+                  includedBuilds,
+                  [],
+                  options,
+                )
+              : "",
           );
         }
       }
@@ -1114,6 +1401,8 @@ export async function createJavaBom(path, options) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
           allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+          [],
+          options,
         );
         const splitPropTaskOut = splitOutputByGradleProjects(
           parallelPropTaskOut,
@@ -1161,7 +1450,7 @@ export async function createJavaBom(path, options) {
       )
     ) {
       allProjects.push(parentComponent);
-      const gradleCmd = getGradleCommand(gradleRootPath, null);
+      const gradleCmd = getGradleCommand(gradleRootPath, null, options);
       const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         : "dependencies";
@@ -1196,6 +1485,14 @@ export async function createJavaBom(path, options) {
       );
       const allOutputs = [];
       for (const gradleArg of gradleArguments) {
+        if (isBuildToolRateLimited("gradle")) {
+          if (DEBUG_MODE) {
+            console.log(
+              "Skipping the remaining gradle dependency tasks: the repository rate limited gradle in this scan.",
+            );
+          }
+          break;
+        }
         if (DEBUG_MODE) {
           console.log(
             `Executing ${gradleCmd} with arguments ${gradleArg.join(" ").substring(0, 150)}... in ${gradleRootPath}`,
@@ -1211,6 +1508,13 @@ export async function createJavaBom(path, options) {
           cwd: gradleRootPath,
           shell: isWin,
         });
+        // The dependencies task exits 0 even when resolution failed under a
+        // rate limit, so the output decides, not the status.
+        noteBuildToolRateLimit("gradle", commandOutputText(sresult), {
+          command: `${basename(gradleCmd)} ${finalGradleArg.join(" ")}`,
+          exitCode:
+            typeof sresult.status === "number" ? sresult.status : undefined,
+        });
         if (sresult.status !== 0 || sresult.error) {
           if (options.failOnError || DEBUG_MODE) {
             console.error(sresult.stdout, sresult.stderr);
@@ -1621,8 +1925,6 @@ export async function createJavaBom(path, options) {
       `${options.multiProject ? "**/" : ""}build.sbt.lock`,
       options,
     );
-    const tempCacheDir = safeMkdtempSync(join(getTmpDir(), "sbt-cache-"));
-    safeMkdirSync(tempCacheDir, { recursive: true });
     if (
       sbtProjects?.length &&
       isPackageManagerAllowed(
@@ -1639,6 +1941,13 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         }
+      } else if (options.installDeps === false && !options.introspect) {
+        // Executing sbt evaluates the project's build definition (arbitrary
+        // Scala), so it belongs to the dependency-tooling surface disabled
+        // by --no-install-deps and the pre-build lifecycle.
+        console.log(
+          "Skipping sbt dependencyTree since dependency installation is disabled. Only statically parsed sbt metadata will be used.",
+        );
       } else {
         const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
         let sbtVersion = determineSbtVersion(path);
@@ -1681,20 +1990,46 @@ export async function createJavaBom(path, options) {
           }
         }
         safeWriteSync(tempSbtPlugins, sbtPluginDefinition);
-        let sbtExtraArgs = "";
+        // sbt resolves into the user's own caches, so a project that has been
+        // built resolves without the network. The dependency trees download
+        // the jar of every dependency they list, which is all --deep reads.
         const env = { ...process.env };
-        // We need to collect the jars from the cache
-        if (options.deep) {
-          sbtExtraArgs = " updateClassifiers";
-          env["COURSIER_CACHE"] = tempCacheDir;
-          env["SBT_IVY_HOME"] = tempCacheDir;
-        }
         for (const i in sbtProjects) {
+          if (isBuildToolRateLimited("sbt")) {
+            // Every remaining sbt build in this scan resolves from the same
+            // rate limited repository.
+            if (DEBUG_MODE) {
+              console.log(
+                `Skipping ${sbtProjects[i]}: the repository rate limited sbt in this scan.`,
+              );
+            }
+            break;
+          }
           const basePath = sbtProjects[i];
           const dlFile = join(tempDir, `dl-${i}.tmp`);
+          // The sbt version of the project itself decides the invocation
+          // form: sbt 2 both joins separate command-line arguments into a
+          // single command line and no longer offers `dependencyTree / toFile`.
+          const projectSbtVersion = determineSbtVersion(basePath) || sbtVersion;
+          const isSbt2 = isSbt2Version(projectSbtVersion);
+          // The sbt 2 launcher runs a thin client by default. When a server is
+          // already running for the build, an IDE's for example, the client
+          // prints neither the project list nor the trees, so sbt runs
+          // in-process instead. sbt.bat has no `--server` option.
+          const sbtLauncherArgs = isSbt2 && !isWin ? ["--server"] : [];
+          const sbtServerFile = join(
+            basePath,
+            "project",
+            "target",
+            "active.json",
+          );
+          const sbtServerWasRunning = isSbt2 && safeExistsSync(sbtServerFile);
           let sbtArgs = [];
           let pluginFile = null;
+          let pluginAdded = false;
           const subDlFiles = [];
+          const failedSubprojects = [];
+          let subprojects = [];
           if (standalonePluginFile) {
             sbtArgs = [
               `-addPluginSbtFile=${tempSbtPlugins}`,
@@ -1708,15 +2043,23 @@ export async function createJavaBom(path, options) {
             // `dependencyTree` fan-out yields a far more complete tree than a
             // single root resolution (which only captures the root project's own
             // libraryDependencies). See https://github.com/cdxgen/cdxgen/issues/4291
-            const subprojects = discoverSbtProjectsFromCmd(
+            subprojects = discoverSbtProjectsFromCmd(
               basePath,
               SBT_CMD,
               env,
+              sbtLauncherArgs,
             );
-            if (subprojects.length > 0 && useSlashSyntax) {
-              sbtArgs = [
-                `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs}`,
-              ];
+            if (isSbt2) {
+              const trees = subprojects.length
+                ? subprojects.map((sp) => ({
+                    project: sp,
+                    file: join(tempDir, `dl-${i}-${sp}.tmp`),
+                  }))
+                : [{ file: dlFile }];
+              subDlFiles.push(...trees.map((t) => t.file));
+              sbtArgs = [sbt2DependencyTreeCommand(trees)];
+            } else if (subprojects.length > 0 && useSlashSyntax) {
+              sbtArgs = ["'set ThisBuild / asciiGraphWidth := 800'"];
               for (const sp of subprojects) {
                 const subDlFile = join(tempDir, `dl-${i}-${sp}.tmp`);
                 subDlFiles.push(subDlFile);
@@ -1726,21 +2069,27 @@ export async function createJavaBom(path, options) {
               }
             } else if (useSlashSyntax) {
               sbtArgs = [
-                `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs} "dependencyTree / toFile ${dlFile} --force"`,
+                `'set ThisBuild / asciiGraphWidth := 800' "dependencyTree / toFile ${dlFile} --force"`,
               ];
               subDlFiles.push(dlFile);
             } else {
               sbtArgs = [
-                `'set asciiGraphWidth in ThisBuild := 800'${sbtExtraArgs} "dependencyTree::toFile ${dlFile} --force"`,
+                `'set asciiGraphWidth in ThisBuild := 800' "dependencyTree::toFile ${dlFile} --force"`,
               ];
               subDlFiles.push(dlFile);
             }
-            pluginFile = addPlugin(basePath, sbtPluginDefinition);
+            // sbt 2 enables its dependency tree plugin by default, so the
+            // build's plugins.sbt stays untouched and the build definition is
+            // not recompiled for the scan.
+            if (!isSbt2) {
+              pluginFile = addPlugin(basePath, sbtPluginDefinition);
+              pluginAdded = true;
+            }
           }
           // Run sbt in non-interactive batch mode so it never blocks waiting for
           // input on stdin (which can otherwise appear as an indefinite hang) and
           // does not emit ANSI colour codes into the dependency tree output.
-          sbtArgs = ["-batch", "-no-colors", ...sbtArgs];
+          sbtArgs = [...sbtLauncherArgs, "-batch", "-no-colors", ...sbtArgs];
           console.log(
             "Executing",
             SBT_CMD,
@@ -1751,13 +2100,31 @@ export async function createJavaBom(path, options) {
             tempSbtgDir,
           );
           // Note that the command has to be invoked with `shell: true` to properly execut sbt
-          const result = safeSpawnSync(SBT_CMD, sbtArgs, {
-            cwd: basePath,
-            shell: true,
-            env,
+          // sbt 2 is the exception: its ;-joined command argument contains a
+          // semicolon, so on POSIX the launcher is spawned directly and the
+          // argument reaches sbt verbatim.
+          const result = sbtSpawnSync(
+            SBT_CMD,
+            sbtArgs,
+            {
+              cwd: basePath,
+              shell: isWin || !isSbt2 || standalonePluginFile,
+              // The sbt commands below embed their own shell quoting, which the
+              // shell must strip for sbt to see separate commands.
+              cdxgenRawShellArgs: true,
+              env,
+            },
+            !isSbt2 || standalonePluginFile,
+          );
+          noteBuildToolRateLimit("sbt", commandOutputText(result), {
+            command: `${SBT_CMD} ${sbtArgs.join(" ")}`,
+            exitCode:
+              typeof result.status === "number" ? result.status : undefined,
           });
           if (result.status !== 0 || result.error) {
-            console.error(result.stdout, result.stderr);
+            if (!isBuildToolRateLimited("sbt")) {
+              console.error(result.stdout, result.stderr);
+            }
             recordDegradation("jvm.sbt.no-lockfile", {
               ecosystem: "java",
               tool: "sbt",
@@ -1768,15 +2135,20 @@ export async function createJavaBom(path, options) {
               detail:
                 "The sbt dependencyTree command did not succeed, so the declared sbt dependencies are the only evidence available.",
             });
-            console.log(
-              "1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.",
-            );
-            console.log(
-              "2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment",
-            );
-            console.log(
-              "3. Consider creating a lockfile using sbt-dependency-lock plugin. See https://github.com/stringbean/sbt-dependency-lock",
-            );
+            if (!isBuildToolRateLimited("sbt")) {
+              console.log(
+                "1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+, 2.12 + sbt 1.0+ and sbt 2.x are supported for now.",
+              );
+              // sbt 2 brings its own dependency tree, so no plugin is added.
+              if (!isSbt2) {
+                console.log(
+                  "2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment",
+                );
+              }
+              console.log(
+                `${isSbt2 ? 2 : 3}. Consider creating a lockfile using sbt-dependency-lock plugin. See https://github.com/stringbean/sbt-dependency-lock`,
+              );
+            }
             deferFailOnError(options, {
               ecosystem: "java",
               tool: "sbt",
@@ -1786,13 +2158,95 @@ export async function createJavaBom(path, options) {
               detail: "the sbt dependencyTree command failed",
             });
           }
-          if (!standalonePluginFile) {
+          // One failing subproject (for example an unresolvable SNAPSHOT)
+          // fails the combined command and would zero the whole SBOM. Retry
+          // each subproject on its own and keep the trees that succeed. A rate
+          // limited repository ends the retries as well: each would download
+          // the same artifacts against the same 429.
+          if (
+            !standalonePluginFile &&
+            subprojects.length > 0 &&
+            (result.status !== 0 || result.error) &&
+            !isBuildToolRateLimited("sbt")
+          ) {
+            for (const sp of subprojects) {
+              const subDlFile = join(tempDir, `dl-${i}-${sp}.tmp`);
+              if (safeExistsSync(subDlFile)) {
+                // The combined run produced this tree before it failed.
+                continue;
+              }
+              if (DEBUG_MODE) {
+                console.log(`Retrying the sbt tree of ${sp} on its own.`);
+              }
+              let retryArgs;
+              if (isSbt2) {
+                retryArgs = [
+                  ...sbtLauncherArgs,
+                  "-batch",
+                  "-no-colors",
+                  sbt2DependencyTreeCommand([{ project: sp, file: subDlFile }]),
+                ];
+              } else if (useSlashSyntax) {
+                retryArgs = [
+                  "-batch",
+                  "-no-colors",
+                  "'set ThisBuild / asciiGraphWidth := 800'",
+                  `"${sp}/dependencyTree / toFile ${subDlFile} --force"`,
+                ];
+              } else {
+                continue;
+              }
+              sbtSpawnSync(
+                SBT_CMD,
+                retryArgs,
+                {
+                  cwd: basePath,
+                  shell: isWin || !isSbt2,
+                  cdxgenRawShellArgs: true,
+                  env,
+                },
+                !isSbt2,
+              );
+              // The tree file is already listed for parsing, so a retry only
+              // has to produce it.
+              if (!safeExistsSync(subDlFile)) {
+                failedSubprojects.push(sp);
+              }
+            }
+            if (failedSubprojects.length) {
+              console.log(
+                `The sbt dependency trees of ${failedSubprojects.join(", ")} could not be resolved.`,
+              );
+            }
+          }
+          // Where the thin client still runs, it leaves the server it started
+          // behind. A server that was running before the scan is not ours to
+          // stop.
+          if (isSbt2 && !sbtServerWasRunning && safeExistsSync(sbtServerFile)) {
+            sbtSpawnSync(SBT_CMD, ["-batch", "-no-colors", "shutdown"], {
+              cwd: basePath,
+              shell: isWin,
+              env,
+            });
+          }
+          // Only a plugins.sbt cdxgen amended is restored: without a backup,
+          // the cleanup removes the file as one cdxgen created.
+          if (pluginAdded) {
             cleanupPlugin(basePath, pluginFile);
           }
           const sbtSubprojectRoots = [];
           for (const subDlFile of subDlFiles) {
             if (safeExistsSync(subDlFile)) {
-              const retMap = await parseSbtTree(subDlFile);
+              // The trees are temporary files that go away with the scan, so
+              // the components name the build definition they were resolved
+              // from instead: build.sbt, or for a build written only in
+              // project/*.scala, the build.properties beside it.
+              const sbtBuildFile =
+                [
+                  join(basePath, "build.sbt"),
+                  join(basePath, "project", "build.properties"),
+                ].find((f) => safeExistsSync(f)) || basePath;
+              const retMap = await parseSbtTree(subDlFile, sbtBuildFile);
               if (retMap.pkgList?.length) {
                 const tmpParentComponent = retMap.pkgList.splice(0, 1)[0];
                 tmpParentComponent.type = "application";
@@ -1840,19 +2294,38 @@ export async function createJavaBom(path, options) {
               "bom-ref": decodeURIComponent(rootPurl),
             };
             parentComponent = rootComponent;
-            dependencies.push({
-              ref: decodeURIComponent(rootPurl),
-              dependsOn: sbtSubprojectRoots
-                .map((c) => c["bom-ref"])
-                .filter(Boolean),
-            });
+            // Merged rather than appended, so the root lists every subproject
+            // once, and a root project with sources of its own, whose tree is
+            // the synthetic root itself, neither depends on itself nor gets a
+            // second dependency entry.
+            dependencies = mergeDependencies(
+              dependencies,
+              [
+                {
+                  ref: rootComponent["bom-ref"],
+                  dependsOn: sbtSubprojectRoots
+                    .map((c) => c["bom-ref"])
+                    .filter(Boolean),
+                },
+              ],
+              rootComponent,
+            );
           } else if (sbtSubprojectRoots.length > 0 && !parentComponent) {
             parentComponent = sbtSubprojectRoots[0];
           }
+          if (failedSubprojects.length && parentComponent?.name) {
+            parentComponent.properties ??= [];
+            parentComponent.properties.push({
+              name: "cdx:sbt:failedProjects",
+              value: failedSubprojects.join(", "),
+            });
+          }
         }
 
-        // Cleanup
-        safeUnlinkSync(tempSbtPlugins);
+        // The trees were parsed inside the loop, so neither directory is
+        // needed any more.
+        safeRmSync(tempDir, { recursive: true, force: true });
+        safeRmSync(tempSbtgDir, { recursive: true, force: true });
       } // else
 
       if (DEBUG_MODE) {
@@ -1860,7 +2333,10 @@ export async function createJavaBom(path, options) {
       }
       // Should we attempt to resolve class names
       if (options.resolveClass || options.deep) {
-        const tmpjarNSMapping = await collectJarNS(tempCacheDir);
+        const tmpjarNSMapping = await collectSbtDependencyJars(
+          pkgList,
+          jarNSMapping,
+        );
         if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
@@ -1884,15 +2360,10 @@ export async function createJavaBom(path, options) {
         }
       }
     }
-    if (tempCacheDir?.startsWith(getTmpDir())) {
-      safeRmSync(tempCacheDir, {
-        recursive: true,
-        force: true,
-      });
-    }
 
     if (
       millFiles?.length &&
+      (options.installDeps !== false || options.introspect === true) &&
       isPackageManagerAllowed(
         "mill",
         ["bazel", "sbt", "gradle", "maven"],
@@ -1905,7 +2376,13 @@ export async function createJavaBom(path, options) {
         "maven",
         options,
       );
-      const millCmd = getMillCommand(millRootPath);
+      const millCmd = getMillCommand(millRootPath, options);
+      // Mill 1.0 replaced the ivyDepsTree task with showMvnDepsTree
+      const millVersion = getMillVersion(millRootPath, millCmd);
+      const millTreeTask =
+        millVersion != null && gte(millVersion, "1.0.0")
+          ? "showMvnDepsTree"
+          : "ivyDepsTree";
       const millCommonArgs = [
         "--color",
         "false",
@@ -1917,7 +2394,7 @@ export async function createJavaBom(path, options) {
       if (!["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) {
         millCommonArgs.unshift("--no-server");
       }
-      const millArgs = [...millCommonArgs, "__.ivyDepsTree"];
+      const millArgs = [...millCommonArgs, `__.${millTreeTask}`];
       if (DEBUG_MODE) {
         console.log("Executing", millCmd, "in", millRootPath);
       }
@@ -1926,6 +2403,11 @@ export async function createJavaBom(path, options) {
         shell: isWin,
         maxBuffer: MAX_BUFFER * 10,
       });
+      noteBuildToolRateLimit("mill", commandOutputText(sresult), {
+        command: `${basename(millCmd)} ${millArgs.join(" ")}`,
+        exitCode:
+          typeof sresult.status === "number" ? sresult.status : undefined,
+      });
       if (sresult.status !== 0 || sresult.error) {
         if (options.failOnError || DEBUG_MODE) {
           console.error(sresult.stdout, sresult.stderr);
@@ -1935,10 +2417,14 @@ export async function createJavaBom(path, options) {
           tool: "mill",
           exitCode:
             typeof sresult.status === "number" ? sresult.status : undefined,
-          detail: "the mill ivyDepsTree command failed",
+          detail: "the mill dependency tree command failed",
         });
       }
-      const millResolveArgs = [...millCommonArgs, "resolve", "__.ivyDepsTree"];
+      const millResolveArgs = [
+        ...millCommonArgs,
+        "resolve",
+        `__.${millTreeTask}`,
+      ];
       if (DEBUG_MODE) {
         console.log(
           "Executing",
@@ -1948,6 +2434,9 @@ export async function createJavaBom(path, options) {
           millRootPath,
         );
       }
+      // The resolve run only lists the build's tasks and downloads nothing,
+      // so it runs even after a rate limit: the trees of the modules that did
+      // resolve under --keep-going are read through it.
       sresult = safeSpawnSync(millCmd, millResolveArgs, {
         cwd: millRootPath,
         shell: isWin,
@@ -1970,6 +2459,8 @@ export async function createJavaBom(path, options) {
         const modules = sstdout
           .trim()
           .split("\n")
+          // Mill 1.x prints headers around the module list
+          .filter((a) => a.endsWith(`.${millTreeTask}`))
           .map((a) => a.substring(0, a.lastIndexOf(".")))
           .filter((a) =>
             ["true", "1"].includes(readEnvironmentVariable("MILL_EXCLUDE_TEST"))
@@ -1982,7 +2473,13 @@ export async function createJavaBom(path, options) {
         relations.set(parentComponent["bom-ref"], []);
         for (const module of modules) {
           moduleBomRefs.push(
-            parseMillDependency(module, packages, relations, millRootPath),
+            parseMillDependency(
+              module,
+              packages,
+              relations,
+              millRootPath,
+              `${millTreeTask}.log`,
+            ),
           );
         }
         for (const module of moduleBomRefs) {
@@ -2035,6 +2532,34 @@ export async function createJavaBom(path, options) {
         }
       }
     }
+    // scala-cli projects declare everything with //> using directives in
+    // their sources and have none of the build files handled above.
+    if (
+      !pomFiles?.length &&
+      !gradleFiles?.length &&
+      !millFiles?.length &&
+      !sbtProjects.length &&
+      isPackageManagerAllowed(
+        "scala-cli",
+        ["bazel", "sbt", "gradle", "maven", "mill"],
+        options,
+      )
+    ) {
+      const dlist = collectScalaCliComponents(path, options);
+      if (dlist?.length) {
+        thoughtLog(
+          `**SCALA-CLI**: Found ${dlist.length} declared dependencies.`,
+        );
+        pkgList = pkgList.concat(dlist);
+        if (!parentComponent?.name) {
+          parentComponent = createDefaultParentComponent(
+            path,
+            "maven",
+            options,
+          );
+        }
+      }
+    }
   } catch (err) {
     if (!isDeferredFailOnError(err)) {
       throw err;
@@ -2044,11 +2569,47 @@ export async function createJavaBom(path, options) {
     thoughtLog(
       "Completing the java BOM with the components collected before the deferred failure.",
     );
+  } finally {
+    // A build this scan ran can have started a Mill daemon of its own
+    // without --no-server; stop those even when a later step failed.
+    stopMillDaemons(path, millDaemonsBefore);
+  }
+  // A Scala.js build bundles npm packages: scalajs-bundler installs them
+  // under target, and a bundler workspace keeps its lock file beside the
+  // build. Their npm components join the BOM so module imports can be
+  // attributed to them, and the project depends on the workspaces' direct
+  // dependencies.
+  try {
+    const scalajsNpm = await collectScalaJsNpmComponents(
+      path,
+      pkgList,
+      options,
+    );
+    if (scalajsNpm.components.length) {
+      pkgList = pkgList.concat(scalajsNpm.components);
+      const npmEdges = [...scalajsNpm.dependencies];
+      if (parentComponent?.["bom-ref"] && scalajsNpm.roots.length) {
+        npmEdges.push({
+          ref: parentComponent["bom-ref"],
+          dependsOn: scalajsNpm.roots,
+        });
+      }
+      dependencies = mergeDependencies(dependencies, npmEdges, parentComponent);
+    }
+  } catch (err) {
+    if (DEBUG_MODE) {
+      console.log("Unable to collect the Scala.js npm dependencies", err);
+    }
   }
   // Deduplication and metadata belong to whatever was collected, so they run
   // on the deferred path too.
   pkgList = trimComponents(pkgList);
-  pkgList = await getMvnMetadata(pkgList, jarNSMapping, options.deep);
+  // --deep collects namespaces; it does not opt in to remote licence lookups,
+  // which FETCH_LICENSE controls. The project's own modules are never looked
+  // up remotely: they are not published.
+  pkgList = await getMvnMetadata(pkgList, jarNSMapping, false, {
+    skipPurls: ownComponentRefs(parentComponent),
+  });
   return buildBomNSData(options, pkgList, "maven", {
     src: path,
     nsMapping: jarNSMapping,