@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/ecosystems/gradleutils.js

@@ -1,10 +1,11 @@
 import { Buffer } from "node:buffer";
-import { chmodSync, readFileSync } from "node:fs";
+import { chmodSync, readdirSync, readFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { basename, join, resolve } from "node:path";
+import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
-import * as toml from "smol-toml";
+import { valid } from "semver";
 
 import {
   DEBUG_MODE,
@@ -22,6 +23,12 @@ import {
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
+import { parseToml } from "../core/toml.js";
+import {
+  isBuildToolRateLimited,
+  noteBuildToolRateLimit,
+} from "../inventory/buildToolRateLimit.js";
 import { collectJarNS } from "../inventory/deps.js";
 import { minimumGradleVersionForJava } from "../inventory/jvmToolEnv.js";
 import { applyPurl, tryBuildPurl } from "../inventory/purl.js";
@@ -38,13 +45,16 @@ function isJvmToolPinned() {
   );
 }
 
+// The gate lives in lib/core so that every layer can reach it; it stays
+// exported here for existing callers.
+export { isProjectToolingAllowed };
+
 /**
  * Method to return the gradle command to use.
  *
  * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
- * the scanned project, so they are only used when dependency tooling is
- * allowed (`options.installDeps !== false`); otherwise the system Gradle is
- * used.
+ * the scanned project, so they are only used when the project's own tooling
+ * may run (see isProjectToolingAllowed); otherwise the system Gradle is used.
  *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
@@ -53,10 +63,7 @@ function isJvmToolPinned() {
 export function getGradleCommand(srcPath, rootPath, options = {}) {
   let gradleCmd = "gradle";
   const pinnedToolSelected = isJvmToolPinned();
-  // Introspection mode exists to observe the project's own toolchain, so it
-  // keeps using wrappers even when dependency installation is disabled.
-  const allowProjectWrappers =
-    options.installDeps !== false || options.introspect === true;
+  const allowProjectWrappers = isProjectToolingAllowed(options);
 
   let findGradleFile = "gradlew";
   if (platform() === "win32") {
@@ -152,6 +159,65 @@ export function getGradleCommand(srcPath, rootPath, options = {}) {
   return gradleCmd;
 }
 
+/**
+ * System properties that force the evaluation model cdxgen's Gradle
+ * introspection depends on.
+ *
+ * The bundled init script registers `afterEvaluate` on every project and a
+ * `taskGraph.whenReady` listener, so it cannot run under isolated projects
+ * (which forbid reaching into another project's model and fail the build at
+ * configuration time, see issue #4444) nor under the configuration cache (whose
+ * reuse skips init scripts entirely, dropping the `<CDXGEN:repository>` and
+ * `<CDXGEN:includedBuild>` markers even when the first run succeeded). Both
+ * features are commonly enabled from `gradle.properties` (e.g. okhttp), which
+ * command-line `-D` flags override, so every cdxgen invocation turns them
+ * off: these are ephemeral introspection builds, not the user's build. The
+ * isolated-projects property is spelled `org.gradle.unsafe.isolated-projects`
+ * from Gradle 8.6 until Gradle 9.7 renamed it, so both spellings are forced
+ * off to cover every Gradle in between. The configuration cache likewise
+ * keeps its pre-8.1 `org.gradle.unsafe.configuration-cache` spelling.
+ *
+ * Each feature is handled as one group. Gradle disables a feature when any of
+ * its spellings is explicitly `false`, so if the user already chose a value
+ * via `GRADLE_ARGS`, either as a `-D` property under any spelling or as the
+ * `--[no-]isolated-projects` / `--[no-]configuration-cache` option (which
+ * beats `-D` properties), cdxgen adds no override for that feature at all.
+ *
+ * @param {string[]} gradleArguments User-supplied general gradle arguments.
+ * @returns {string[]} The `-D` flags to inject before the user's arguments.
+ */
+function gradleEvaluationOverrides(gradleArguments) {
+  const features = [
+    {
+      option: "isolated-projects",
+      properties: [
+        "org.gradle.isolated-projects",
+        "org.gradle.unsafe.isolated-projects",
+      ],
+    },
+    {
+      option: "configuration-cache",
+      properties: [
+        "org.gradle.configuration-cache",
+        "org.gradle.unsafe.configuration-cache",
+      ],
+    },
+  ];
+  const overrides = [];
+  for (const { option, properties } of features) {
+    const userChose = gradleArguments.some(
+      (arg) =>
+        arg === `--${option}` ||
+        arg === `--no-${option}` ||
+        properties.some((property) => arg.startsWith(`-D${property}=`)),
+    );
+    if (!userChose) {
+      overrides.push(...properties.map((property) => `-D${property}=false`));
+    }
+  }
+  return overrides;
+}
+
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -175,6 +241,7 @@ export function buildGradleCommandArguments(
     "--no-parallel",
   ]
     .concat(getGradleDaemonParameter())
+    .concat(gradleEvaluationOverrides(gradleArguments))
     .concat(gradleArguments);
   const maxCliArgsLength = isWin
     ? 7500 - gradleCommandLength - mainGradleArguments.join(" ").length - 2
@@ -217,47 +284,87 @@ function getGradleDaemonParameter() {
   }
 }
 
+/**
+ * Parse a Gradle task header line such as `> Task :app:dependencies FAILED`
+ * into the path of the project that owns the task and the task's name.
+ *
+ * @param {string} line A line of Gradle output
+ * @returns {{projectPath: string, taskName: string}|undefined} The owning
+ *   project's path (`""` for a root task such as `:dependencies`) and the task
+ *   name, or undefined when the line is not a task header
+ */
+function parseGradleTaskHeader(line) {
+  if (!line.startsWith("> Task :")) {
+    return undefined;
+  }
+  // The path is the first token: a status such as UP-TO-DATE or FAILED may
+  // follow it, and a CRLF line keeps its carriage return.
+  const taskPath = line.slice("> Task ".length).trim().split(/\s+/)[0];
+  const lastColon = taskPath.lastIndexOf(":");
+  return {
+    projectPath: taskPath.slice(0, lastColon),
+    taskName: taskPath.slice(lastColon + 1),
+  };
+}
+
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
+ * Gradle groups console output by task and prints a `> Task :path` header
+ * before each group, repeating it whenever a task's output resumes after
+ * another task's. Each group is therefore keyed by the project in its own
+ * header (`> Task :app:dependencies` belongs to `:app`), never by whatever
+ * report header happened to precede it, and the groups of one project are
+ * concatenated in order, so reordering or interrupting the task reports cannot
+ * move a report to another project or overwrite one (issue 4465). The groups
+ * of a root task (`:dependencies`) all take the root project's name from the
+ * `Root project '…'` header that only a root task prints, so a continuation
+ * group, which carries no report header, stays with the rest of the root
+ * report. The groups of other tasks are dropped along with their headers.
+ *
  * @param {string} rawOutput Full output produced by Gradle using parallel processing
  * @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
  * @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
  */
 export function splitOutputByGradleProjects(rawOutput, relevantTasks) {
   const outputSplitBySubprojects = new Map();
-  let subProjectOut = "";
-  const outSplitByLine = rawOutput.split("\n");
-  let currentProjectName = "root";
-  const regexPatternForRelevantTasks = `.*:(${relevantTasks.join("|")})(?=s|\r|$)`;
-  const regexForRelevantTasks = new RegExp(regexPatternForRelevantTasks);
-  for (const [i, line] of outSplitByLine.entries()) {
-    //filter out everything before first task output
-    if (!line.startsWith("> Task :") && subProjectOut === "") {
-      continue;
+  const relevantTaskNames = new Set(relevantTasks);
+  const taskChunks = [];
+  // Lines before the first task header (build logs) belong to no task.
+  let currentChunk;
+  for (const line of rawOutput.split("\n")) {
+    const taskHeader = parseGradleTaskHeader(line);
+    if (taskHeader) {
+      currentChunk = relevantTaskNames.has(taskHeader.taskName)
+        ? { projectPath: taskHeader.projectPath, lines: [line] }
+        : undefined;
+      if (currentChunk) {
+        taskChunks.push(currentChunk);
+      }
+    } else if (currentChunk) {
+      currentChunk.lines.push(line);
     }
-
-    //ignore output of irrelevant tasks
-    if (line.startsWith("> Task :") && !regexForRelevantTasks.test(line)) {
+  }
+  let rootProjectName;
+  for (const chunk of taskChunks) {
+    if (chunk.projectPath) {
       continue;
     }
-
-    if (line.startsWith("Root project '") || line.startsWith("Project ':")) {
-      currentProjectName = line.split("'")[1];
-      outputSplitBySubprojects.set(currentProjectName, "");
-    }
-    // if previous subProject has ended, push to array and reset subProject string
-    if (line.startsWith("> Task :") && subProjectOut !== "") {
-      outputSplitBySubprojects.set(currentProjectName, subProjectOut);
-      subProjectOut = "";
-    }
-    //if in subproject block, keep appending to string
-    subProjectOut += `${line}\n`;
-    //if end of last dependencies output block, push to array
-    if (i === outSplitByLine.length - 1) {
-      outputSplitBySubprojects.set(currentProjectName, subProjectOut);
+    const rootHeader = chunk.lines.find((line) =>
+      line.startsWith("Root project '"),
+    );
+    if (rootHeader) {
+      rootProjectName = rootHeader.split("'")[1];
+      break;
     }
   }
+  for (const chunk of taskChunks) {
+    const projectName = chunk.projectPath || rootProjectName || "root";
+    outputSplitBySubprojects.set(
+      projectName,
+      `${outputSplitBySubprojects.get(projectName) || ""}${chunk.lines.join("\n")}\n`,
+    );
+  }
   return outputSplitBySubprojects;
 }
 
@@ -397,6 +504,11 @@ export function executeParallelGradleProperties(
   extraArgs = [],
   options = {},
 ) {
+  // This runs once per properties round, so a rate limit an earlier round met
+  // ends the later rounds too.
+  if (isBuildToolRateLimited("gradle")) {
+    return "";
+  }
   const gradleCmd = getGradleCommand(dir, null, options);
   const gradleArgs = buildGradleCommandArguments(
     extraArgs.concat(
@@ -423,6 +535,22 @@ export function executeParallelGradleProperties(
       cwd: dir,
       shell: isWin,
     });
+    // A properties invocation needs the same repository the build does, so a
+    // 429 answer here ends every further gradle invocation in this scan. The
+    // dependencies task can even exit 0 under a rate limit, so the output is
+    // read whatever the status is. The properties this invocation did print
+    // are kept.
+    if (
+      noteBuildToolRateLimit("gradle", commandOutputText(result), {
+        command: `${basename(gradleCmd)} ${gradleArg.join(" ")}`,
+        exitCode: typeof result.status === "number" ? result.status : undefined,
+      })
+    ) {
+      if (result.stdout) {
+        allOutputs.push(result.stdout);
+      }
+      break;
+    }
     if (result.status !== 0 || result.error) {
       recordGradleInvocationFailure(result, {
         command: `${basename(gradleCmd)} ${gradleArg.join(" ")}`,
@@ -1222,15 +1350,18 @@ export async function collectGradleDependencies(
  * Method to return the mill command to use.
  *
  * The project-local `mill` script is an attacker-controlled file in the
- * scanned project, so it is only used when dependency tooling is allowed
- * (`options.installDeps !== false`).
+ * scanned project, so it is only used when the project's own tooling may run
+ * (see isProjectToolingAllowed).
  *
  * @param {string} srcPath Path to look for mill wrapper
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export function getMillCommand(srcPath, options = {}) {
   let millCmd = `mill${platform() === "win32" ? ".bat" : ""}`;
-  if (options.installDeps !== false && safeExistsSync(join(srcPath, millCmd))) {
+  if (
+    isProjectToolingAllowed(options) &&
+    safeExistsSync(join(srcPath, millCmd))
+  ) {
     // Use local mill wrapper if available
     // Enable execute permission
     try {
@@ -1244,12 +1375,178 @@ export function getMillCommand(srcPath, options = {}) {
   return millCmd;
 }
 
+/**
+ * Determine the Mill version of a build.
+ *
+ * The version is read from the `.mill-version` file, from the
+ * `//| mill-version:` header of the build file, or from the launcher itself.
+ *
+ * @param {string} millRootPath Root of the Mill build
+ * @param {string} millCmd Mill command to use for the fallback probe
+ * @returns {string|null} The Mill version, or null when it cannot be determined
+ */
+export function getMillVersion(millRootPath, millCmd) {
+  const millVersionFile = join(millRootPath, ".mill-version");
+  if (safeExistsSync(millVersionFile)) {
+    const version = (readFileSync(millVersionFile, "utf-8") || "").trim();
+    if (valid(version)) {
+      return version;
+    }
+  }
+  for (const buildFile of ["build.mill", "build.sc"]) {
+    const buildFilePath = join(millRootPath, buildFile);
+    if (!safeExistsSync(buildFilePath)) {
+      continue;
+    }
+    const headerMatch = /^\/\/[|\s]\s*mill-version:\s*(\S+)/m.exec(
+      readFileSync(buildFilePath, "utf-8"),
+    );
+    if (headerMatch?.[1] && valid(headerMatch[1])) {
+      return headerMatch[1];
+    }
+  }
+  const versionResult = safeSpawnSync(millCmd, ["--no-server", "--version"], {
+    cwd: millRootPath,
+    shell: isWin,
+  });
+  const versionMatch = /version\s+(\S+)/.exec(`${versionResult.stdout || ""}`);
+  return versionMatch?.[1] && valid(versionMatch[1]) ? versionMatch[1] : null;
+}
+
+/**
+ * Find the Mill daemons running under a tree.
+ *
+ * Daemons record their process id in `out/mill-daemon*` (Mill 1.x) or
+ * `out/mill-server*` directories, directly or one level below (Mill 0.12
+ * keeps one subdirectory per server). Only processes that are still alive
+ * are returned.
+ *
+ * @param {string} rootPath Tree to search
+ * @returns {Map<string, Set<number>>} Live daemon process ids by the root of
+ *   the build they belong to
+ */
+export function findMillDaemons(rootPath) {
+  const daemons = new Map();
+  const readPid = (dir) => {
+    for (const candidate of [dir, ...safeSubdirs(dir)]) {
+      try {
+        const pid = Number.parseInt(
+          readFileSync(join(candidate, "processId"), "utf-8").trim(),
+          10,
+        );
+        if (pid > 0 && isProcessAlive(pid)) {
+          return pid;
+        }
+      } catch (_err) {
+        // no process id recorded in this directory
+      }
+    }
+    return undefined;
+  };
+  const visit = (dir, depth) => {
+    if (depth > 4) {
+      return;
+    }
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch (_err) {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      if (entry.name === "out") {
+        for (const name of safeSubdirs(join(dir, entry.name))) {
+          const base = basename(name);
+          if (
+            !base.startsWith("mill-daemon") &&
+            !base.startsWith("mill-server")
+          ) {
+            continue;
+          }
+          const pid = readPid(name);
+          if (pid) {
+            if (!daemons.has(dir)) {
+              daemons.set(dir, new Set());
+            }
+            daemons.get(dir).add(pid);
+          }
+        }
+      } else if (!["target", "node_modules", ".git"].includes(entry.name)) {
+        visit(join(dir, entry.name), depth + 1);
+      }
+    }
+  };
+  visit(rootPath, 0);
+  return daemons;
+}
+
+function safeSubdirs(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => join(dir, entry.name));
+  } catch (_err) {
+    return [];
+  }
+}
+
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+
+/**
+ * Stop the Mill daemons that started under the scanned tree during the scan.
+ *
+ * cdxgen's own Mill calls run with --no-server, but a project build cdxgen
+ * runs can shell out to Mill without it and leave a daemon behind. Daemons
+ * that were already running when the scan started belong to the user, for
+ * example to an IDE, and are left alone; every other live daemon is shut
+ * down through the launcher of the build it belongs to.
+ *
+ * @param {string} rootPath Scanned tree
+ * @param {Map<string, Set<number>>} [runningBefore] Result of
+ *   {@link findMillDaemons} taken before the scan
+ * @param {Object} [options] CLI options
+ */
+export function stopMillDaemons(
+  rootPath,
+  runningBefore = new Map(),
+  options = {},
+) {
+  // The daemon PID files live in the scanned tree. When the scan was not
+  // allowed to run Mill it started no daemon, and running the build's own
+  // launcher here would execute a script from the scanned project.
+  if (!isProjectToolingAllowed(options)) {
+    return;
+  }
+  for (const [buildRoot, pids] of findMillDaemons(rootPath)) {
+    const before = runningBefore.get(buildRoot) || new Set();
+    if ([...pids].every((pid) => before.has(pid))) {
+      continue;
+    }
+    const launcher = getMillCommand(buildRoot, options);
+    console.log("Stopping the Mill daemon the scan started in", buildRoot);
+    safeSpawnSync(launcher, ["shutdown"], {
+      cwd: buildRoot,
+      shell: isWin,
+    });
+  }
+}
+
 /**
  * Method to return the maven command to use.
  *
  * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
- * scanned project, so they are only used when dependency tooling is allowed
- * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ * scanned project, so they are only used when the project's own tooling may
+ * run (see isProjectToolingAllowed); otherwise the installed Maven is used.
  *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper
@@ -1261,10 +1558,7 @@ export function getMavenCommand(srcPath, rootPath, options = {}) {
   let isWrapperReady = false;
   let isWrapperFound = false;
   const pinnedToolSelected = isJvmToolPinned();
-  // Introspection mode exists to observe the project's own toolchain, so it
-  // keeps using wrappers even when dependency installation is disabled.
-  const allowProjectWrappers =
-    options.installDeps !== false || options.introspect === true;
+  const allowProjectWrappers = isProjectToolingAllowed(options);
   let findMavenFile = "mvnw";
   let mavenWrapperCmd = null;
   if (platform() === "win32") {
@@ -1445,7 +1739,7 @@ export function getMavenCommand(srcPath, rootPath, options = {}) {
 export function parseGradleVersionCatalog(catalogFile) {
   let catalog;
   try {
-    catalog = toml.parse(readFileSync(catalogFile, "utf-8"));
+    catalog = parseToml(readFileSync(catalogFile, "utf-8"));
   } catch (error) {
     console.warn(`Failed to parse ${catalogFile}: ${error.message}`);
     return [];

package/lib/ecosystems/jsEvidence.js

@@ -6,7 +6,7 @@
 // import parsers-js directly instead of having parsePkgJson threaded in as an
 // injected helper from the CLI.
 
-import { join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 
 import { safeExistsSync } from "../core/fs.js";
 import { createOccurrenceEvidence } from "../inventory/evidenceUtils.js";
@@ -104,6 +104,85 @@ function applyNpmBinCommandEvidence(pkg, allImports) {
   }
 }
 
+/**
+ * Full npm package name (`@scope/name` or `name`) of a component or manifest.
+ *
+ * @param {{group?: string, name?: string}} pkg Component or parsed manifest.
+ * @returns {string} The package name npm installs it under.
+ */
+function npmPackageName({ group, name }) {
+  const scope = group?.startsWith("@") ? group.substring(1) : group;
+  return scope ? `@${scope}/${name}` : name;
+}
+
+/**
+ * Fill in a component's missing npm metadata (description, author, license,
+ * homepage, repository) from the package.json of its installed copy.
+ *
+ * `internal:LocalNodeModulesPath` holds either an absolute install directory
+ * (pnpm) or an arborist `node.location`. A location that starts with
+ * `node_modules/` is relative to the directory of the component's
+ * `internal:SrcFile`. Other relative locations, such as a workspace member or a
+ * package nested under one, have no recorded base and are skipped; the deep npm
+ * parse reads those manifests from the arborist node itself. The manifest is
+ * used only when it names the component's package and version, and it fills
+ * only the fields the component lacks.
+ *
+ * @param {object} pkg Package component to enrich in place.
+ */
+async function fillMissingMetadataFromLocalNodeModules(pkg) {
+  if (pkg.description || !Array.isArray(pkg.properties)) {
+    return;
+  }
+  const propValue = (propName) =>
+    pkg.properties.find((property) => property.name === propName)?.value;
+  const localNodeModulesPath = propValue("internal:LocalNodeModulesPath");
+  if (!localNodeModulesPath) {
+    return;
+  }
+  let pkgJsonFile;
+  if (isAbsolute(localNodeModulesPath)) {
+    pkgJsonFile = join(localNodeModulesPath, "package.json");
+  } else {
+    const srcFile = propValue("internal:SrcFile");
+    if (!srcFile || !localNodeModulesPath.startsWith("node_modules/")) {
+      return;
+    }
+    pkgJsonFile = resolve(
+      dirname(srcFile),
+      localNodeModulesPath,
+      "package.json",
+    );
+  }
+  if (!safeExistsSync(pkgJsonFile)) {
+    return;
+  }
+  const lnmPkgList = await parsePkgJson(pkgJsonFile, true);
+  const lnmMetadata = lnmPkgList?.length === 1 ? lnmPkgList[0] : undefined;
+  if (
+    !lnmMetadata ||
+    npmPackageName(lnmMetadata) !== npmPackageName(pkg) ||
+    lnmMetadata.version !== pkg.version
+  ) {
+    return;
+  }
+  if (!pkg.description && lnmMetadata.description) {
+    pkg.description = lnmMetadata.description;
+  }
+  if (!pkg.author && lnmMetadata.author) {
+    pkg.author = lnmMetadata.author;
+  }
+  if (!pkg.license && lnmMetadata.license) {
+    pkg.license = lnmMetadata.license;
+  }
+  if (!pkg.homepage && lnmMetadata.homepage) {
+    pkg.homepage = lnmMetadata.homepage;
+  }
+  if (!pkg.repository && lnmMetadata.repository) {
+    pkg.repository = lnmMetadata.repository;
+  }
+}
+
 /**
  * Attach JS/TS import and export usage evidence to matching package components.
  *
@@ -136,6 +215,11 @@ export async function addEvidenceForImports(
     if (group === "@types") {
       continue;
     }
+    // Runs ahead of the alias loop, which a matching import ends with a break,
+    // so that every component is enriched whichever alias the source imports.
+    if (deep) {
+      await fillMissingMetadataFromLocalNodeModules(pkg);
+    }
     const aliases = group?.length
       ? [name, `${group}/${name}`, `@${group}/${name}`]
       : [name];
@@ -282,29 +366,6 @@ export async function addEvidenceForImports(
         }
         break;
       }
-      // Capture metadata such as description from local node_modules in deep mode
-      if (deep && !pkg.description && pkg.properties) {
-        let localNodeModulesPath;
-        for (const aprop of pkg.properties) {
-          if (aprop.name === "internal:LocalNodeModulesPath") {
-            localNodeModulesPath = resolve(join(aprop.value, "package.json"));
-            break;
-          }
-        }
-        if (localNodeModulesPath && safeExistsSync(localNodeModulesPath)) {
-          const lnmPkgList = await parsePkgJson(localNodeModulesPath, true);
-          if (lnmPkgList && lnmPkgList.length === 1) {
-            const lnmMetadata = lnmPkgList[0];
-            if (lnmMetadata && Object.keys(lnmMetadata).length) {
-              pkg.description = lnmMetadata.description;
-              pkg.author = lnmMetadata.author;
-              pkg.license = lnmMetadata.license;
-              pkg.homepage = lnmMetadata.homepage;
-              pkg.repository = lnmMetadata.repository;
-            }
-          }
-        }
-      }
     } // for alias
     // Trim the properties
     applyNpmBinCommandEvidence(pkg, allImports);

package/lib/ecosystems/kosi.js

@@ -10,6 +10,7 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { resolvePluginSourceDir } from "../core/pluginRun.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 import {
   parsePurlLoose,
@@ -174,14 +175,25 @@ export function analyzeKosiProject(src, options = {}) {
     );
     return undefined;
   }
+  // cdxgen may run with its working directory already inside the project
+  // while the source argument is relative to a repository root; a plain
+  // resolve would join the two into a directory that does not exist.
+  const analysisDir = resolvePluginSourceDir(src, [
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+    "classpath.txt",
+  ]);
   const tempDir = safeMkdtempSync(join(getTmpDir(), "kosi-"));
   try {
     const outputFile = join(tempDir, "kosi-all.json");
-    const allArgs = kosiArgs(kosi, src, outputFile, "all");
+    const allArgs = kosiArgs(kosi, analysisDir, outputFile, "all");
     if (DEBUG_MODE) {
       console.log("Executing", kosi.cmd, allArgs.join(" "));
     }
-    const report = runKosi(kosi, src, allArgs, outputFile, options);
+    const report = runKosi(kosi, analysisDir, allArgs, outputFile, options);
     if (!report) {
       return undefined;
     }
@@ -191,10 +203,15 @@ export function analyzeKosiProject(src, options = {}) {
     // all-pass's. Losing it would silently drop the filtered evidence,
     // so a failure here names itself but keeps the all-pass evidence.
     const reachableFile = join(tempDir, "kosi-reachable.json");
-    const reachableArgs = kosiArgs(kosi, src, reachableFile, "reachable");
+    const reachableArgs = kosiArgs(
+      kosi,
+      analysisDir,
+      reachableFile,
+      "reachable",
+    );
     const reachableReport = runKosi(
       kosi,
-      src,
+      analysisDir,
       reachableArgs,
       reachableFile,
       options,