@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/cli/jsBom.js

@@ -13,7 +13,11 @@ import {
 } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
-import { hasAnyProjectType, isPackageManagerAllowed } from "../core/env.js";
+import {
+  hasAnyProjectType,
+  isPackageManagerAllowed,
+  shouldFetchPackageMetadata,
+} from "../core/env.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import {
@@ -39,8 +43,12 @@ import {
   parseDenoJsonFile,
   parseDenoLock,
 } from "../ecosystems/denoutils.js";
+import { getNpmMetadata } from "../ecosystems/ecosystems.js";
 import { addEvidenceForImports } from "../ecosystems/jsEvidence.js";
-import { createNpmWorkspacePurl } from "../ecosystems/npmutils.js";
+import {
+  createNpmWorkspacePurl,
+  loadNpmrcConfig,
+} from "../ecosystems/npmutils.js";
 import {
   parseBowerJson,
   parseMinJs,
@@ -220,12 +228,20 @@ export async function createNodejsBom(path, options) {
     const pkgJsonFiles = getAllFiles(path, "**/package.json", options);
     // Are there any package.json files in the container?
     if (pkgJsonFiles.length) {
+      // Every manifest is read locally first, and the registry is asked about
+      // the ones still missing fields in one round, rather than once per file.
+      const npmrcConfig = loadNpmrcConfig(path);
       for (const pj of pkgJsonFiles) {
-        const dlist = await parsePkgJson(pj);
+        const dlist = await parsePkgJson(pj, false, false, {
+          fetchMetadata: false,
+        });
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       }
+      if (shouldFetchPackageMetadata() && pkgList.length) {
+        pkgList = await getNpmMetadata(pkgList, undefined, { npmrcConfig });
+      }
       if (includedAiInventoryTypes.length) {
         aiInventory = collectAiInventory(
           path,
@@ -1007,14 +1023,12 @@ export async function createNodejsBom(path, options) {
     if (safeExistsSync(swFile)) {
       let pkgList = await parseNodeShrinkwrap(swFile);
       pkgList = addWasmComponentsFromImports(pkgList, allImports);
-      if (allImports && Object.keys(allImports).length) {
-        pkgList = await addEvidenceForImports(
-          pkgList,
-          allImports,
-          allExports,
-          options.deep,
-        );
-      }
+      pkgList = await addEvidenceForImports(
+        pkgList,
+        allImports,
+        allExports,
+        options.deep,
+      );
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
         src: path,
@@ -1043,14 +1057,12 @@ export async function createNodejsBom(path, options) {
           pnpmLockObj.dependenciesList,
         );
       }
-      if (allImports && Object.keys(allImports).length) {
-        pkgList = await addEvidenceForImports(
-          pkgList,
-          allImports,
-          allExports,
-          options.deep,
-        );
-      }
+      pkgList = await addEvidenceForImports(
+        pkgList,
+        allImports,
+        allExports,
+        options.deep,
+      );
       pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
       pkgList = markNpmTypesPackagesAsExcluded(pkgList);
       pkgList = markTypeOnlyDependenciesOptional(pkgList, dependencies);
@@ -1428,12 +1440,21 @@ export async function createNodejsBom(path, options) {
       options,
     );
     manifestFiles = manifestFiles.concat(pkgJsonFiles);
+    // The installed manifests answer locally; one round asks the registry only
+    // about the packages still missing fields, instead of one round per file.
     for (const pkgjf of pkgJsonFiles) {
-      const dlist = await parsePkgJson(pkgjf);
+      const dlist = await parsePkgJson(pkgjf, false, false, {
+        fetchMetadata: false,
+      });
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
     }
+    if (shouldFetchPackageMetadata() && pkgList.length) {
+      pkgList = await getNpmMetadata(pkgList, undefined, {
+        npmrcConfig: loadNpmrcConfig(path),
+      });
+    }
     if (!parentComponent || !Object.keys(parentComponent).length) {
       if (safeExistsSync(join(path, "package.json"))) {
         const pcs = await parsePkgJson(join(path, "package.json"), true, true);
@@ -1478,15 +1499,15 @@ export async function createNodejsBom(path, options) {
   if ("project-name" in options && !options.parentComponent) {
     options.parentComponent = parentComponent;
   }
-  if (allImports && Object.keys(allImports).length) {
-    pkgList = addWasmComponentsFromImports(pkgList, allImports);
-    pkgList = await addEvidenceForImports(
-      pkgList,
-      allImports,
-      allExports,
-      options.deep,
-    );
-  }
+  // The evidence pass runs without imports too: it also fills deep-mode
+  // metadata and removes internal:LocalNodeModulesPath from every component.
+  pkgList = addWasmComponentsFromImports(pkgList, allImports);
+  pkgList = await addEvidenceForImports(
+    pkgList,
+    allImports,
+    allExports,
+    options.deep,
+  );
   if (mcpInventory.components?.length) {
     pkgList = trimComponents(pkgList.concat(mcpInventory.components));
   }