@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/ecosystems/parsers-misc.js

@@ -4,6 +4,7 @@ import {
   sep as _sep,
   basename,
   dirname,
+  isAbsolute,
   join,
   relative,
   resolve,
@@ -12,11 +13,7 @@ import {
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
 
-import {
-  cdxgenAgent,
-  DEBUG_MODE,
-  readEnvironmentVariable,
-} from "../core/activity.js";
+import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
@@ -28,10 +25,12 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import { registerRunReset } from "../core/runState.js";
 import { mesonWrapDB } from "../core/state.js";
 import { isGitHubUrl } from "../core/urls.js";
 import { parseWorkflowFile } from "../inventory/ciParsers/githubActions.js";
 import {
+  gatedGet,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
@@ -59,6 +58,22 @@ import { parsePkgJson } from "./parsers-js.js";
  */
 const MAX_FLAKE_INPUTS_BLOCK_LENGTH = 16 * 1024;
 
+/**
+ * Whether a package registry can hold a pubspec.lock entry.
+ *
+ * The entry's `source` names where the package comes from. `sdk` packages ship
+ * with the Dart or Flutter SDK, `path` packages live in the working tree, and
+ * `git` packages come from a repository. None is published on a registry, and
+ * asking about them leaks their names and imports a look-alike's metadata.
+ *
+ * @param {Object} packageData One pubspec.lock `packages` entry.
+ * @returns {boolean}
+ */
+function canPubRegistryServe(packageData) {
+  const source = packageData?.source;
+  return source === undefined || source === "hosted";
+}
+
 /**
  * Method to parse pubspec.lock files.
  *
@@ -71,10 +86,11 @@ export async function parsePubLockData(pubLockData, lockFile) {
   if (!pubLockData) {
     return [];
   }
-  let pkgList = [];
+  const pkgList = [];
   const rootList = [];
   const data = _load(pubLockData);
   const packages = data.packages;
+  const lookupList = [];
   for (const [packageName, packageData] of Object.entries(packages)) {
     const pkg = {
       name: packageName,
@@ -131,9 +147,15 @@ export async function parsePubLockData(pubLockData, lockFile) {
       };
     }
     pkgList.push(pkg);
+    if (canPubRegistryServe(packageData)) {
+      lookupList.push(pkg);
+    }
   }
   if (shouldFetchLicense()) {
-    pkgList = await getDartMetadata(pkgList);
+    // getDartMetadata enriches in place, so the sdk, path and git packages
+    // stay in pkgList with the lockfile's answers and are simply not handed
+    // to it.
+    await getDartMetadata(lookupList);
   }
   return { rootList, pkgList };
 }
@@ -3002,14 +3024,67 @@ export function parseMakeDFile(dfile) {
   return pkgFilesMap;
 }
 
+/**
+ * Resolve a path a lockfile names against the lockfile's directory, refusing
+ * absolute paths and any that leave the scanned directory. The value comes
+ * from the scanned project, so it must not steer the scan at files outside
+ * it. The bound is the scan root, not the lockfile's directory: a React
+ * Native `ios/Podfile` names its pods as `../node_modules/...`.
+ *
+ * @param {String} projectPath Directory of the Podfile.lock
+ * @param {String} value Path as the lockfile writes it
+ * @param {String} [scanRoot] Directory the scan was asked for; the lockfile's
+ *   directory when not given
+ * @returns {String|undefined} The resolved path, or undefined when refused
+ */
+function resolveInsideScan(projectPath, value, scanRoot = projectPath) {
+  if (typeof value !== "string" || !value.length) {
+    return undefined;
+  }
+  if (
+    isAbsolute(value) ||
+    /^[a-zA-Z]:[\\/]/.test(value) ||
+    value.startsWith("\\\\")
+  ) {
+    return undefined;
+  }
+  const resolved = resolve(projectPath, value);
+  const back = relative(resolve(scanRoot), resolved);
+  if (back.startsWith("..") || isAbsolute(back)) {
+    return undefined;
+  }
+  return resolved;
+}
+
+/**
+ * Whether a pod name can be used as a file name. Pod names come from the
+ * lockfile and are joined onto directories.
+ *
+ * @param {String} podName Root pod name
+ * @returns {Boolean}
+ */
+function isSafePodFileName(podName) {
+  return (
+    typeof podName === "string" &&
+    podName.length > 0 &&
+    !podName.includes("/") &&
+    !podName.includes("\\") &&
+    !podName.includes("\0") &&
+    podName !== "." &&
+    podName !== ".."
+  );
+}
+
 /**
  * Parse the contents of a 'Podfile.lock'
  *
  * @param {Object} podfileLock The content of the podfile.lock as an Object
  * @param {String} projectPath The path to the project root
+ * @param {String} [scanRoot] Directory the scan was asked for. Local `:path`
+ *   and `:podspec` sources outside it are not read. Defaults to projectPath.
  * @returns {Map} Map of all dependencies with their direct dependencies
  */
-export async function parsePodfileLock(podfileLock, projectPath) {
+export async function parsePodfileLock(podfileLock, projectPath, scanRoot) {
   const dependencies = new Map();
   for (const pod of podfileLock["PODS"]) {
     const dependency = {};
@@ -3031,58 +3106,103 @@ export async function parsePodfileLock(podfileLock, projectPath) {
           dependency.metadata.name.indexOf("/"),
         )
       : dependency.metadata.name;
-    if (podfileLock["EXTERNAL SOURCES"]?.[podName]) {
+    if (
+      podfileLock["EXTERNAL SOURCES"]?.[podName] &&
+      isSafePodFileName(podName)
+    ) {
       const externalPod = podfileLock["EXTERNAL SOURCES"][podName];
       if (externalPod[":git"]) {
-        let projectRepo = externalPod[":git"];
-        if (isGitHubUrl(projectRepo)) {
-          projectRepo = projectRepo.replace(
-            "github.com",
-            "raw.githubusercontent.com",
-          );
-        }
-        if (projectRepo.endsWith(".git")) {
-          projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+        // The podspec of a checked out pod, which `pod install` writes
+        // alongside the sources it downloaded. Reading it needs no request,
+        // so it answers before any raw repository URL.
+        const localPodspec = join(
+          projectPath,
+          "Pods",
+          "Local Podspecs",
+          `${podName}.podspec.json`,
+        );
+        if (safeExistsSync(localPodspec)) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: localPodspec,
+            },
+          ];
+        } else {
+          let projectRepo = externalPod[":git"];
+          if (isGitHubUrl(projectRepo)) {
+            projectRepo = projectRepo.replace(
+              "github.com",
+              "raw.githubusercontent.com",
+            );
+          }
+          if (projectRepo.endsWith(".git")) {
+            projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+          }
+          // The commit the lockfile recorded in CHECKOUT OPTIONS names the
+          // exact revision CocoaPods checked out, so its podspec is asked
+          // for directly instead of probing the default branch names. It
+          // wins over a branch, whose head may have moved since.
+          const checkoutCommit =
+            podfileLock["CHECKOUT OPTIONS"]?.[podName]?.[":commit"];
+          const projectRepoBranchOrTag =
+            typeof checkoutCommit === "string" &&
+            /^[0-9a-f]{7,64}$/i.test(checkoutCommit)
+              ? checkoutCommit
+              : externalPod[":tag"]
+                ? `refs/tags/${externalPod[":tag"]}`
+                : externalPod[":branch"]
+                  ? `refs/heads/${externalPod[":branch"]}`
+                  : "refs/heads/<DEFAULT>";
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: `${projectRepo}/${projectRepoBranchOrTag}/${podName}.podspec`,
+            },
+          ];
         }
-        const projectRepoBranchOrTag = externalPod[":tag"]
-          ? `tags/${externalPod[":tag"]}`
-          : `heads/${externalPod[":branch"] ? externalPod[":branch"] : "<DEFAULT>"}`;
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:podspecLocation",
-            value: `${projectRepo}/refs/${projectRepoBranchOrTag}/${podName}.podspec`,
-          },
-        ];
       } else if (externalPod[":path"]) {
-        const projectLocation = resolve(projectPath, externalPod[":path"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: projectLocation,
-          },
-        ];
-        let podspec = join(projectLocation, `${podName}.podspec`);
-        if (!safeExistsSync(podspec)) {
-          podspec = `${podspec}.json`;
-        }
-        if (safeExistsSync(podspec)) {
-          dependency.metadata.properties.push({
-            name: "cdx:pods:podspecLocation",
-            value: podspec,
-          });
+        const projectLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":path"],
+          scanRoot,
+        );
+        if (projectLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: projectLocation,
+            },
+          ];
+          let podspec = join(projectLocation, `${podName}.podspec`);
+          if (!safeExistsSync(podspec)) {
+            podspec = `${podspec}.json`;
+          }
+          if (safeExistsSync(podspec)) {
+            dependency.metadata.properties.push({
+              name: "cdx:pods:podspecLocation",
+              value: podspec,
+            });
+          }
         }
       } else if (externalPod[":podspec"]) {
-        const podspecLocation = resolve(projectPath, externalPod[":podspec"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: dirname(podspecLocation),
-          },
-          {
-            name: "cdx:pods:podspecLocation",
-            value: podspecLocation,
-          },
-        ];
+        const podspecLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":podspec"],
+          scanRoot,
+        );
+        if (podspecLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: dirname(podspecLocation),
+            },
+            {
+              name: "cdx:pods:podspecLocation",
+              value: podspecLocation,
+            },
+          ];
+        }
       }
     }
     dependencies.set(dependency.metadata.name, dependency);
@@ -3408,6 +3528,8 @@ export function resetCocoaPodspecPrefetch() {
   cocoaPodspecPrefetch = new Map();
 }
 
+registerRunReset("cocoapods:podspecs", resetCocoaPodspecPrefetch);
+
 /**
  * Prefetch the remote podspecs a full CocoaPods scan is about to read.
  *
@@ -3510,7 +3632,7 @@ async function fullScanCocoaPod(dependency, component, options) {
           try {
             httpResult =
               prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
-              (await cdxgenAgent.get(candidate));
+              (await gatedGet(candidate, { responseType: "text" }));
             podspecLocation = candidate;
           } catch (_err) {
             continue;
@@ -3525,6 +3647,11 @@ async function fullScanCocoaPod(dependency, component, options) {
       } else {
         podspecContent = readFileSync(podspecLocation, "utf-8");
       }
+      // A location none of the candidates served contributes nothing: the
+      // component keeps what the lockfile already said about the pod.
+      if (podspecContent === undefined) {
+        return;
+      }
       for (const replacement of replacements) {
         const replacementPair = replacement.split("=");
         let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");

package/lib/ecosystems/parsers-python.js

@@ -4,13 +4,13 @@ import process from "node:process";
 import { URL } from "node:url";
 
 import { build } from "@cdxgen/cdx-purl";
-import * as toml from "smol-toml";
 import { parse as _load } from "yaml";
 
 import { DEBUG_MODE } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { PYTHON_STD_MODULES } from "../core/state.js";
+import { parseToml } from "../core/toml.js";
 import { tryBuildPurl } from "../inventory/purl.js";
 import {
   createExternalReferenceKey,
@@ -95,8 +95,11 @@ export function parsePyRequiresDist(dist_string) {
  * Method to parse pipfile.lock data
  *
  * @param {Object} lockData JSON data from Pipfile.lock
+ * @param {Object[]} [installedMetadata] Components parsed from the installed
+ *   `*.dist-info/METADATA` files of this machine, which answer before PyPI
+ *   is asked
  */
-export async function parsePiplockData(lockData) {
+export async function parsePiplockData(lockData, installedMetadata) {
   const pkgList = [];
   Object.keys(lockData)
     .filter((i) => i !== "_meta")
@@ -112,6 +115,9 @@ export async function parsePiplockData(lockData) {
         }
       });
     });
+  // The installed distributions answer first, so PyPI is asked only about
+  // the packages they do not cover.
+  enrichFromInstalledMetadata(pkgList, installedMetadata);
   return await getPyMetadata(pkgList, false);
 }
 
@@ -274,8 +280,12 @@ function collectPythonManifestSource(pkg) {
     { kind: "url", value: pkg?.vcs?.url },
     { kind: "url", value: pkg?.source?.url },
     { kind: "path", value: pkg?.source?.path },
+    { kind: "path", value: pkg?.source?.directory },
     { kind: "path", value: pkg?.source?.editable },
     { kind: "path", value: pkg?.source?.virtual },
+    { kind: "path", value: pkg?.directory?.path },
+    { kind: "url", value: pkg?.archive?.url },
+    { kind: "path", value: pkg?.archive?.path },
   ];
   for (const candidate of sourceCandidates) {
     if (typeof candidate.value !== "string" || !candidate.value.trim()) {
@@ -395,7 +405,7 @@ export function parsePyProjectTomlFile(tomlFile) {
   const groupDepsKeys = {};
   const dependencySourceMap = {};
   try {
-    tomlData = toml.parse(readFileSync(tomlFile, { encoding: "utf-8" }));
+    tomlData = parseToml(readFileSync(tomlFile, { encoding: "utf-8" }));
   } catch (err) {
     console.log(`Error while parsing the pyproject file ${tomlFile}.`, err);
   }
@@ -788,14 +798,114 @@ function collectPythonLockMetadataDistributionReferences(fileEntries) {
   return distributionReferences;
 }
 
+/**
+ * Normalise a Python distribution name the way PEP 503 does, so an installed
+ * distribution and the lockfile entry it belongs to compare equal whatever
+ * separator and case each of them used.
+ *
+ * @param {string} value Distribution name
+ * @returns {string|undefined} The normalised name, or undefined for no name
+ */
+export function normalizePep503Name(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return undefined;
+  }
+  return value
+    .trim()
+    .toLowerCase()
+    .replaceAll(/[-_.]+/g, "-");
+}
+
+/**
+ * The key an installed distribution and a lockfile entry are matched by: the
+ * PEP 503 normalised name and the version.
+ *
+ * @param {Object} p Component with `name` and `version`
+ * @returns {string|undefined} The key, or undefined without a name or version
+ */
+export function installedMetadataKey(p) {
+  const name = normalizePep503Name(p?.name);
+  const version = typeof p?.version === "string" ? p.version.trim() : "";
+  return name && version ? `${name}@${version}` : undefined;
+}
+
+/**
+ * Enrich lockfile entries from the installed distributions on this machine,
+ * before PyPI is asked.
+ *
+ * Each entry of `installedMetadata` is a component as
+ * {@link parseBdistMetadata} builds it from an installed `*.dist-info/METADATA`
+ * file. An entry is matched to the lockfile component with the same PEP 503
+ * normalised name and the same version, and fills the fields it lacks, so the
+ * registry is left only what the installed distributions do not answer. An
+ * installed release of another version describes a different release, so it
+ * enriches nothing. The distributions enrich the entries in place; no new
+ * components are created.
+ *
+ * @param {Object[]} pkgList Lockfile components, enriched in place
+ * @param {Object[]} installedMetadata Components parsed from installed
+ *   `*.dist-info/METADATA` files
+ * @returns {Set<string>} The keys of the installations that enriched an entry,
+ *   as {@link installedMetadataKey} builds them, so a caller that also walks
+ *   the METADATA files can skip those as components
+ */
+export function enrichFromInstalledMetadata(pkgList, installedMetadata) {
+  const byKey = new Map();
+  for (const p of pkgList || []) {
+    const key = installedMetadataKey(p);
+    if (key && !byKey.has(key)) {
+      byKey.set(key, p);
+    }
+  }
+  const enriched = new Set();
+  for (const md of installedMetadata || []) {
+    const key = installedMetadataKey(md);
+    const p = key ? byKey.get(key) : undefined;
+    if (!p) {
+      continue;
+    }
+    enriched.add(key);
+    if (!p.description?.trim() && md.description?.trim()) {
+      p.description = md.description;
+    }
+    if (!p.license && md.licenses?.length) {
+      // The licence field holds the names a lockfile consumer expects; the
+      // CycloneDX licence objects travel in `licenses`.
+      p.license = md.licenses
+        .map((alicense) => alicense.expression || alicense.license?.name)
+        .filter((aname) => aname?.length);
+      p.licenses = md.licenses;
+    }
+    if (!p.homepage && md.homepage) {
+      p.homepage = md.homepage;
+    }
+    if (!p.repository && md.repository) {
+      p.repository = md.repository;
+    }
+    if (!p.author && md.author) {
+      p.author = md.author;
+    }
+  }
+  return enriched;
+}
+
 /**
  * Method to parse python lock files such as poetry.lock, pdm.lock, uv.lock, and pylock.toml.
  *
  * @param {string} lockData Raw TOML text from poetry.lock, pdm.lock, uv.lock, or pylock.toml
  * @param {string} lockFile Lock file name for evidence
  * @param {string} pyProjectFile pyproject.toml file
+ * @param {Object} [options] Options
+ * @param {Object[]} [options.installedMetadata] Components parsed from the
+ *   installed `*.dist-info/METADATA` files of this machine, which answer
+ *   before PyPI is asked
  */
-export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
+export async function parsePyLockData(
+  lockData,
+  lockFile,
+  pyProjectFile,
+  options = {},
+) {
   let pkgList = [];
   const rootList = [];
   const dependenciesList = [];
@@ -942,7 +1052,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   }
   let lockTomlObj;
   try {
-    lockTomlObj = toml.parse(lockData);
+    lockTomlObj = parseToml(lockData);
   } catch (err) {
     if (lockFile) {
       // The failing file names the manager whose lock command regenerates
@@ -1418,6 +1528,9 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       dependsOn: [...dependsOnList].sort(),
     });
   }
+  // The installed distributions answer first, so PyPI is asked only about the
+  // packages they do not cover.
+  enrichFromInstalledMetadata(pkgList, options.installedMetadata);
   pkgList = await getPyMetadata(pkgList, false);
   return {
     parentComponent,
@@ -1444,11 +1557,18 @@ const PEP440_VERSION_CLAUSE = /(===|==|!=|<=|>=|~=|<|>)\s*([0-9A-Za-z.*_+!-]*)/;
  *
  * @param {String} reqFile Requirements.txt file
  * @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
+ * @param {Object[]} [installedMetadata] Components parsed from the installed
+ *   `*.dist-info/METADATA` files of this machine, which answer before PyPI
+ *   is asked
  *
  * @returns {Promise[Array<Object>]} List of direct dependencies from the requirements file
  */
-export async function parseReqFile(reqFile, fetchDepsInfo = false) {
-  return await parseReqData(reqFile, null, fetchDepsInfo);
+export async function parseReqFile(
+  reqFile,
+  fetchDepsInfo = false,
+  installedMetadata = undefined,
+) {
+  return await parseReqData(reqFile, null, fetchDepsInfo, installedMetadata);
 }
 
 const LICENSE_ID_COMMENTS_PATTERN =
@@ -1477,9 +1597,17 @@ function parseLicenseComment(comment) {
  * @param {String} reqFile Requirements.txt file
  * @param {Object} reqData Requirements.txt data for internal invocations from setup.py file etc.
  * @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
+ * @param {Object[]} [installedMetadata] Components parsed from the installed
+ *   `*.dist-info/METADATA` files of this machine, which answer before PyPI
+ *   is asked
  * @returns {Promise<Array<Object>>} List of direct dependencies from the requirements file
  */
-async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
+async function parseReqData(
+  reqFile,
+  reqData = null,
+  fetchDepsInfo = false,
+  installedMetadata = undefined,
+) {
   const pkgList = [];
   let compScope;
   if (!reqFile && !reqData) {
@@ -1732,6 +1860,9 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       pkgList.push(apkg);
     }
   }
+  // The installed distributions answer first, so PyPI is asked only about
+  // the packages they do not cover.
+  enrichFromInstalledMetadata(pkgList, installedMetadata);
   return await getPyMetadata(pkgList, fetchDepsInfo);
 }
 
@@ -2042,7 +2173,7 @@ export function parsePixiTomlFile(pixiToml) {
   const pixiTomlFile = readFileSync(pixiToml, { encoding: "utf-8" });
   let tomlData;
   try {
-    tomlData = toml.parse(pixiTomlFile);
+    tomlData = parseToml(pixiTomlFile);
   } catch (err) {
     console.log(`Error while parsing the pixi file ${pixiToml}.`, err);
     return {};
@@ -2118,7 +2249,7 @@ export function generatePixiLockFile(_path) {
 export function parseMojoProject(mojoProjectFile) {
   let manifest;
   try {
-    manifest = toml.parse(readFileSync(mojoProjectFile, "utf-8"));
+    manifest = parseToml(readFileSync(mojoProjectFile, "utf-8"));
   } catch (error) {
     console.warn(`Failed to parse ${mojoProjectFile}: ${error.message}`);
     return { pkgList: [], parentComponent: {} };

package/lib/ecosystems/parsers-rust.js

@@ -3,12 +3,12 @@ import { sep as _sep, basename, dirname, join, resolve } from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 import { globSync } from "glob";
-import * as toml from "smol-toml";
 
 import { DEBUG_MODE } from "../core/activity.js";
 import { shouldFetchLicense } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
 import { traceLog } from "../core/logger.js";
+import { parseToml } from "../core/toml.js";
 import { getCratesMetadata, normalizeCargoIntegrity } from "./ecosystems.js";
 
 /**
@@ -204,7 +204,7 @@ function readCargoTomlData(cargoTomlFile) {
     return undefined;
   }
   try {
-    return toml.parse(readFileSync(cargoTomlFile, { encoding: "utf-8" }));
+    return parseToml(readFileSync(cargoTomlFile, { encoding: "utf-8" }));
   } catch (error) {
     traceLog("cargo", {
       cargoTomlFile,
@@ -1082,7 +1082,7 @@ export async function parseCargoData(
     return pkgList;
   }
 
-  const cargoData = toml.parse(
+  const cargoData = parseToml(
     readFileSync(cargoLockFile, { encoding: "utf-8" }),
   );
   if (!cargoData) {
@@ -1290,7 +1290,7 @@ export function parseCargoManifestDependencyData(cargoTomlFile, context = {}) {
  */
 export function parseCargoDependencyData(cargoLockData) {
   const purlFromPackageInfo = (pkg) => decodeURIComponent(buildCargoPurl(pkg));
-  const cargoData = toml.parse(cargoLockData);
+  const cargoData = parseToml(cargoLockData);
   const packageNode = cargoData?.package;
   if (!packageNode || !Array.isArray(packageNode)) {
     return [];