@cdxgen/cdxgen 13.4.0 → 13.6.0

package/README.md

@@ -16,7 +16,7 @@ cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create, vali
 
 Supported BOM formats:
 
-- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems.
+- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS, Linux amd64/arm64, and Windows amd64/arm64 systems.
 - Software (SBOM) - For many languages and container images.
 - Cryptography (CBOM) - For Java keystores and certificates, plus JavaScript and TypeScript source-level algorithm inventory.
 - Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.
@@ -175,7 +175,7 @@ Regardless of how you install, the following commands are available:
 | `obom`          | Alias for `cdxgen -t os`                                                                                             | yes                              |
 | `saasbom`       | Alias for SaaSBOM-oriented `cdxgen` defaults                                                                         | yes                              |
 | `spdxgen`       | Alias for `cdxgen --format spdx`                                                                                     | use `cdxgen`                     |
-| `cdxgen-secure` | Alias for hardened `cdxgen` defaults                                                                                 | use `cdxgen`                     |
+| `cdxgen-secure` | `cdxgen` in secure mode, with dependency installation always off                                                     | use `cdxgen`                     |
 
 Standalone GitHub release binaries are published for `cdxgen`, `cdxgen-slim`, `aibom`, `cbom`, `obom`, `saasbom`, `hbom`, `hbom-slim`, `cdx-audit`, `cdx-convert`, `cdx-sign`, `cdx-validate`, `cdx-verify`, and `tracebom`.
 
@@ -187,7 +187,7 @@ The `cbom` and `saasbom` release binaries bundle the Atom analysis stack (`@appt
 
 For AI-heavy repositories, cdxgen also supports an AI-BOM workflow via the `aibom` command or the `-t ai` project type aliases (`ai`, `aibom`, `ai-bom`). This emits AI service/model evidence and pairs naturally with the `ai-bom` BOM-audit category alias for governance, security, performance, AI-agent, and MCP findings.
 
-For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime, and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified.
+For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime (including Windows drive letters), and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified. On Windows, `--privileged` only helps from an already-elevated session, and a non-administrator over SSH or WinRM is denied every WMI query; see [HBOM permissions](docs/PERMISSIONS.md#hbom-permissions).
 
 ### Standalone executables (recommended)
 
@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.4.0"
+VERSION="v13.6.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.4.0"
+VERSION="v13.6.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.4.0"
+$Version = "v13.6.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.4.0 \
+      gh release download v13.6.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -296,7 +296,7 @@ winget install cdxgen
 
 You can also use the cdxgen container image with node, deno, or bun runtime versions.
 
-The default version uses Node.js 24
+The default version uses Node.js 26
 
 ```bash
 docker run --rm -e CDXGEN_DEBUG_MODE=debug -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cdxgen/cdxgen:master -r /app -o /app/bom.json
@@ -337,7 +337,7 @@ npm install -g @cdxgen/cdxgen --ignore-scripts --min-release-age=2
 **pnpm**:
 
 ```shell
-pnpm add -g @cdxgen/cdxgen --omit=optional --ignore-scripts --minimum-release-age=2880
+pnpm add -g @cdxgen/cdxgen --ignore-scripts --config.minimum-release-age=2880
 ```
 
 **bun**:

package/bin/cdxgen-secure.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// cdxgen-secure: cdxgen in secure mode.
+//
+// This is an entry point of its own rather than a second name for
+// bin/cdxgen.js. cdxgen recognised the command from the script path in
+// process.argv[1], but bun reports the real file behind a symlink there and
+// the npm shims on Windows always name bin/cdxgen.js, so in both cases a
+// `cdxgen-secure` that pointed at bin/cdxgen.js ran as plain cdxgen. Turning
+// secure mode on here, before any cdxgen module loads, also means the modules
+// that read CDXGEN_SECURE_MODE once at import see it.
+import process from "node:process";
+
+process.env.CDXGEN_SECURE_MODE = "true";
+
+await import("./cdxgen.js");

package/bin/cdxgen.js

@@ -4,7 +4,6 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { tmpdir } from "node:os";
 import {
   basename,
   dirname,
@@ -22,6 +21,7 @@ import { hideBin } from "yargs/helpers";
 import { getExactAiInventoryType } from "../lib/cli/bomAssembly.js";
 import {
   applyAdvancedOptions as applyAdvancedOptionsImpl,
+  applyOperatorToolingChoice,
   buildOptionsFromArgs,
   isUserProvided,
   validateSpecVersion,
@@ -39,6 +39,7 @@ import {
   PROJECT_CONFIG_FILENAMES,
   sanitizeProjectConfig,
 } from "../lib/core/projectConfig.js";
+import { isSecureModeActive } from "../lib/core/projectTooling.js";
 import {
   ui as defaultUi,
   installConsoleShim,
@@ -103,6 +104,7 @@ import {
   printSummary,
   printTable,
 } from "../lib/inventory/display.js";
+import { runsEvidenceAnalysis } from "../lib/inventory/dosai.js";
 import {
   ensureNoMixedHbomProjectTypes,
   ensureSupportedHbomSpecVersion,
@@ -138,6 +140,11 @@ import { prepareEnv } from "../lib/stages/pregen/pregen.js";
 import { validateSpdx } from "../lib/validator/bomValidator.js";
 import { validateGeneratedBom } from "../lib/validator/index.js";
 
+// The environment as the operator launched cdxgen. The CLI later copies some
+// parsed options into the environment (--introspect becomes
+// CDXGEN_INTROSPECT), so the operator's own choices are read from this copy.
+const launchEnv = { ...process.env };
+
 // Support for config files. The config file lives in the directory under
 // analysis, so it carries that directory's trust level; see
 // sanitizeProjectConfig for the boundary this applies.
@@ -483,6 +490,10 @@ const args = _yargs
     description: "Path for the usages slices file created by atom.",
     hidden: true,
   })
+  .option("callsites-slices-file", {
+    description: "Path for the callsites slices file created by atom.",
+    hidden: true,
+  })
   .option("data-flow-slices-file", {
     description: "Path for the data-flow slices file created by atom.",
     hidden: true,
@@ -1127,8 +1138,10 @@ let autoLedgerSidecar;
 if (options.introspect) {
   process.env.CDXGEN_INTROSPECT = "true";
   if (!isDryRun && !readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER")) {
+    // The temp directory, not the OS one: under the permission model it is
+    // the directory cdxgen is granted writes to.
     autoLedgerSidecar = join(
-      tmpdir(),
+      getTmpDir(),
       `cdxgen-introspect-ledger-${process.pid}.jsonl`,
     );
     process.env.CDXGEN_INTROSPECT_LEDGER = autoLedgerSidecar;
@@ -1266,7 +1279,15 @@ if (options.lifecycle) {
 }
 const isHbomOnlyInvocation = isHbomOnlyProjectTypes(options.projectType);
 const advancedWarnings = applyAdvancedOptionsImpl(options, {
-  isSecureMode,
+  isSecureMode: isSecureModeActive(),
+});
+// The config file comes from the working directory, usually the scanned
+// project, so whether the project's own code may run stays the operator's
+// choice from the command line and environment.
+applyOperatorToolingChoice(options, {
+  env: launchEnv,
+  isSecureMode: isSecureModeActive(),
+  projectConfig: config,
 });
 if (options?.technique && Array.isArray(options.technique)) {
   if (options.technique.length === 1) {
@@ -2128,7 +2149,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   let internalCycloneDxInputPath = outputPlan.outputs.cyclonedx;
-  if ((options.evidence || options.includeCrypto) && bomNSData?.bomJson) {
+  if (runsEvidenceAnalysis(options) && bomNSData?.bomJson) {
     if (!internalCycloneDxInputPath) {
       internalCycloneDxInputPath = join(
         getTmpDir(),
@@ -2151,7 +2172,10 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   // Evidence generation
-  if (options.evidence || options.includeCrypto) {
+  // The same helper decides in createCsharpBom whether the dosai methods
+  // report may be trimmed: --include-crypto alone runs evinse too, so testing
+  // options.evidence alone here would trim a report this scan needs full.
+  if (runsEvidenceAnalysis(options)) {
     if (isDryRun) {
       recordActivity({
         kind: "write",

package/bin/evinse.js

@@ -226,6 +226,11 @@ const args = yargs(hideBin(process.argv))
     default: false,
     type: "boolean",
   })
+  .option("install-deps", {
+    description:
+      "Let evinse run the project's own build tools, such as Maven and SwiftPM, to collect evidence. On by default, and off in secure mode. Pass --no-install-deps for projects you do not trust.",
+    type: "boolean",
+  })
   .option("with-deep-jar-collector", {
     description:
       "Enable collection of all jars from maven cache directory. Useful to improve the recall for callstack evidence.",
@@ -264,6 +269,9 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("callsites-slices-file", {
+    description: "Use an existing callsites slices file (JS/TS).",
+  })
   .option("scalasem-command", {
     description:
       "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",

package/bin/hbom.js

@@ -26,7 +26,10 @@ import {
   ensureSupportedHbomSpecVersion,
   hasHbomProjectType,
 } from "../lib/inventory/hbom.js";
-import { getHbomSummary } from "../lib/inventory/hbomAnalysis.js";
+import {
+  getHbomPrivilegeGuidance,
+  getHbomSummary,
+} from "../lib/inventory/hbomAnalysis.js";
 import {
   importProtobomModule,
   isProtoBomPath,
@@ -130,12 +133,13 @@ const args = _yargs
   })
   .option("privileged", {
     description:
-      "Enable privileged Linux enrichment and non-interactive sudo retries for documented permission-sensitive commands.",
+      "Enable privileged enrichment for documented permission-sensitive sources. Linux: privileged enrichment and non-interactive sudo retries. Windows: the TPM, BitLocker, storage-reliability and Secure Boot batch, which only an already-elevated (Run as administrator) session can read; HBOM never prompts for UAC and records permission-denied diagnostics otherwise. No effect on macOS.",
     type: "boolean",
     default: false,
   })
   .option("plist-enrichment", {
-    description: "Enable additional Darwin plist-based enrichment.",
+    description:
+      "Enable additional plist-based enrichment. Darwin only; ignored on Linux and Windows.",
     type: "boolean",
     default: false,
   })
@@ -172,7 +176,10 @@ const args = _yargs
     ["$0", "Generate an HBOM file for the current host"],
     ["$0 -p", "Print the generated HBOM to stdout"],
     ["$0 --platform linux --arch amd64", "Override target selection"],
-    ["$0 --privileged --pretty", "Enable privileged Linux enrichment"],
+    [
+      "$0 --privileged --pretty",
+      "Enable privileged enrichment: sudo retries on Linux, the elevated-only batch on Windows (run from an administrator prompt)",
+    ],
     [
       "$0 diagnostics",
       "Run a live HBOM diagnostic pass and summarize missing commands or permission-sensitive enrichments",
@@ -226,6 +233,9 @@ const options = {
   arch: args.arch,
   command: selectedCommand,
   commandName: hbomCommandName,
+  // yargs turns `--no-command-enrichment` into `commandEnrichment: false` and
+  // leaves `noCommandEnrichment` at its default, so forward both spellings.
+  commandEnrichment: args.commandEnrichment,
   dryRun: args.dryRun,
   input: args.input ? resolve(args.input) : undefined,
   noCommandEnrichment: args.noCommandEnrichment,
@@ -420,9 +430,7 @@ function printHbomDiagnosticsReport(bomJson) {
   }
 
   if (hbomSummary.requiresPrivilegedEnrichment) {
-    console.log(
-      "\nSome Linux enrichments can likely succeed only with --privileged and a target environment that allows non-interactive sudo.",
-    );
+    console.log(`\n${getHbomPrivilegeGuidance(hbomSummary.platform)}`);
   }
 }
 

package/bin/repl.js

@@ -25,6 +25,8 @@ import {
   printAiBomPedigree,
   printAiBomVariants,
   printCallStack,
+  printCertificateChain,
+  printCertificatesTable,
   printDependencyTree,
   printFormulation,
   printOccurrences,
@@ -1224,6 +1226,32 @@ cdxgenRepl.defineCommand("cryptos", {
     this.displayPrompt();
   },
 });
+cdxgenRepl.defineCommand("certs", {
+  help: "print the certificate components with role, issuer, expiry and SPKI prefix",
+  action() {
+    if (sbom) {
+      printCertificatesTable(sbom);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
+cdxgenRepl.defineCommand("certchain", {
+  help: "show the issuer chain above a certificate and the certificates issued under it (.certchain <bom-ref|spki-prefix|cert-prefix>)",
+  action(selector) {
+    if (sbom) {
+      printCertificateChain(sbom, selector);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
 cdxgenRepl.defineCommand("sourcecryptos", {
   help: "show source-derived cryptographic assets detected from JS AST analysis",
   action() {
@@ -2203,6 +2231,7 @@ cdxgenRepl.defineCommand("tagcloud", {
 });
 // Let's dynamically define more commands from the queries
 [
+  "apk_packages",
   "apt_sources",
   "behavioral_reverse_shell",
   "certificates",

package/bin/validate.js

@@ -19,6 +19,7 @@ import process from "node:process";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
+import { installConsoleShim, restoreConsole } from "../lib/core/ui.js";
 import {
   dirNameStr,
   retrieveCdxgenVersion,
@@ -144,6 +145,11 @@ const args = _yargs
   .help()
   .wrap(Math.min(120, yargs().terminalWidth())).argv;
 
+// stdout carries the report and nothing else; messages from the validators
+// go to the diagnostic stream so `-r json` and `-r sarif` stay parseable.
+installConsoleShim();
+process.once("exit", restoreConsole);
+
 /**
  * Loads the BOM. When signatures are verified, the text must also pass
  * parseStrictJson(), and `strictError` explains why it did not.

package/data/cbomosdb-queries.json

@@ -17,6 +17,12 @@
     "purlType": "rpm",
     "componentType": "library"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm",
+    "componentType": "library"
+  },
   "python_packages": {
     "query": "select * from python_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "Python packages installed on system.",
@@ -32,7 +38,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "List all homebrew_packages.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "library"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries among the active MacPorts ports.",
+    "purlType": "macports",
     "componentType": "library"
   },
   "authorized_keys": {

package/data/component-tags.json

@@ -164,6 +164,7 @@
       "windows_programs",
       "processor",
       "services_snapshot",
+      "apk_packages",
       "apt_sources",
       "apt_ppa_sources",
       "behavioral_reverse_shell",
@@ -180,6 +181,13 @@
       "gatekeeper",
       "vscode_extensions",
       "homebrew_packages",
+      "macports_packages",
+      "pacman_packages",
+      "snap_packages",
+      "flatpak_packages",
+      "ai_agent_skills",
+      "gpu_info",
+      "chrome_search_engines",
       "installed_applications",
       "interface_addresses",
       "kernel_info",

package/data/license-aliases.json

@@ -18,8 +18,6 @@
   "httpsopensourceorglicenseapache20": "Apache-2.0",
   "httpwwwapacheorglicenseslicense20html": "Apache-2.0",
   "zeroclausebsd": "0BSD",
-  "newbsdlicense": "BSD-3-Clause",
-  "newbsd": "BSD-3-Clause",
   "bsd2clause": "BSD-2-Clause",
   "bsd2clauselicense": "BSD-2-Clause",
   "thebsd2clauselicense": "BSD-2-Clause",
@@ -30,11 +28,13 @@
   "thebsd3clauselicense": "BSD-3-Clause",
   "bsd3clauseneworrevisedlicensebsd3clause": "BSD-3-Clause",
   "eclipsedistributionlicensenewbsdlicense": "BSD-3-Clause",
+  "newbsdlicense": "BSD-3-Clause",
   "modifiedbsdlicense": "BSD-3-Clause",
   "revisedbsd": "BSD-3-Clause",
   "revisedbsdlicense": "BSD-3-Clause",
   "thenewbsdlicense": "BSD-3-Clause",
   "3clausebsdlicense": "BSD-3-Clause",
+  "newbsd": "BSD-3-Clause",
   "bsd4clause": "BSD-4-Clause",
   "bsd4clauselicense": "BSD-4-Clause",
   "thebsd4clauselicense": "BSD-4-Clause",
@@ -258,6 +258,8 @@
   "aswfdigitalassetslicenseversion10": "ASWF-Digital-Assets-1.0",
   "aswfdigitalassets11": "ASWF-Digital-Assets-1.1",
   "aswfdigitalassetslicense11": "ASWF-Digital-Assets-1.1",
+  "atcgame": "atc-game",
+  "atcgamelicense": "atc-game",
   "baekmuk": "Baekmuk",
   "baekmuklicense": "Baekmuk",
   "bahyph": "Bahyph",
@@ -309,6 +311,8 @@
   "bsd2clausepluspatentlicense": "BSD-2-Clause-Patent",
   "bsd2clausepkgconfdisclaimer": "BSD-2-Clause-pkgconf-disclaimer",
   "bsd2clausepkgconfdisclaimervariant": "BSD-2-Clause-pkgconf-disclaimer",
+  "bsd2clauseposunchanged": "BSD-2-Clause-pos-unchanged",
+  "bsd2clausepositionunchangedvariant": "BSD-2-Clause-pos-unchanged",
   "bsd2clauseviews": "BSD-2-Clause-Views",
   "bsd2clausewithviewssentence": "BSD-2-Clause-Views",
   "bsd3clauseneworrevisedlicense": "BSD-3-Clause",
@@ -331,6 +335,8 @@
   "bsd3clausenonuclearwarranty": "BSD-3-Clause-No-Nuclear-Warranty",
   "bsd3clauseopenmpi": "BSD-3-Clause-Open-MPI",
   "bsd3clauseopenmpivariant": "BSD-3-Clause-Open-MPI",
+  "bsd3clauseopenwebui": "BSD-3-Clause-OpenWebUI",
+  "bsd3clauseopenwebuivariant": "BSD-3-Clause-OpenWebUI",
   "bsd3clausesun": "BSD-3-Clause-Sun",
   "bsd3clausesunmicrosystems": "BSD-3-Clause-Sun",
   "bsd3clausetso": "BSD-3-Clause-Tso",
@@ -345,6 +351,7 @@
   "bsd43tahoelicense": "BSD-4.3TAHOE",
   "bsdadvertisingacknowledgement": "BSD-Advertising-Acknowledgement",
   "bsdadvertisingacknowledgementlicense": "BSD-Advertising-Acknowledgement",
+  "bsdasktoendorse": "BSD-ask-to-endorse",
   "bsdattributionhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdwithattributionandhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdinfernonettverk": "BSD-Inferno-Nettverk",
@@ -352,10 +359,14 @@
   "bsdmarkmodificationslicense": "BSD-Mark-Modifications",
   "bsdprotection": "BSD-Protection",
   "bsdprotectionlicense": "BSD-Protection",
+  "bsdsourcealtgpl": "BSD-Source-alt-GPL",
+  "bsdsourcecodeattributiongplalternative": "BSD-Source-alt-GPL",
   "bsdsourcebeginningfile": "BSD-Source-beginning-file",
   "bsdsourcecodeattributionbeginningoffilevariant": "BSD-Source-beginning-file",
   "bsdsourcecode": "BSD-Source-Code",
   "bsdsourcecodeattribution": "BSD-Source-Code",
+  "bsdsourcecodenodisclaimer": "BSD-Source-Code-no-disclaimer",
+  "bsdsourcecodeattributionnodisclaimer": "BSD-Source-Code-no-disclaimer",
   "bsdsystemics": "BSD-Systemics",
   "systemicsbsdvariantlicense": "BSD-Systemics",
   "bsdsystemicsw3works": "BSD-Systemics-W3Works",
@@ -364,6 +375,8 @@
   "boostsoftwarelicense10": "BSL-1.0",
   "buddy": "Buddy",
   "buddylicense": "Buddy",
+  "bugroff": "Bugroff",
+  "bugrofflicense": "Bugroff",
   "busl11": "BUSL-1.1",
   "businesssourcelicense11": "BUSL-1.1",
   "bzip2105": "bzip2-1.0.6",
@@ -420,6 +433,8 @@
   "creativecommonsattributionnoncommercial30unported": "CC-BY-NC-3.0",
   "ccbync30de": "CC-BY-NC-3.0-DE",
   "creativecommonsattributionnoncommercial30germany": "CC-BY-NC-3.0-DE",
+  "ccbync30igo": "CC-BY-NC-3.0-IGO",
+  "creativecommonsattributionnoncommercial30igo": "CC-BY-NC-3.0-IGO",
   "ccbync40": "CC-BY-NC-4.0",
   "creativecommonsattributionnoncommercial40international": "CC-BY-NC-4.0",
   "ccbyncnd10": "CC-BY-NC-ND-1.0",
@@ -657,6 +672,8 @@
   "fuzzybitmaplicense": "FBM",
   "fdkaac": "FDK-AAC",
   "fraunhoferfdkaaccodeclibrary": "FDK-AAC",
+  "fdkmpegh": "FDK-MPEG-H",
+  "fraunhoferfdkmpeghsoftware": "FDK-MPEG-H",
   "fergusontwofish": "Ferguson-Twofish",
   "fergusontwofishlicense": "Ferguson-Twofish",
   "frameworx10": "Frameworx-1.0",
@@ -795,6 +812,8 @@
   "hidapilicense": "HIDAPI",
   "hippocratic21": "Hippocratic-2.1",
   "hippocraticlicense21": "Hippocratic-2.1",
+  "hippocratic30core": "Hippocratic-3.0-core",
+  "hippocraticlicense30": "Hippocratic-3.0-core",
   "hp1986": "HP-1986",
   "hewlettpackard1986license": "HP-1986",
   "hp1989": "HP-1989",
@@ -873,6 +892,8 @@
   "imlib2license": "Imlib2",
   "infozip": "Info-ZIP",
   "infoziplicense": "Info-ZIP",
+  "informatica": "Informatica",
+  "informaticalicense": "Informatica",
   "innernet20": "Inner-Net-2.0",
   "innernetlicensev20": "Inner-Net-2.0",
   "innosetup": "InnoSetup",
@@ -1660,6 +1681,7 @@
   "shl21": "SHL-2.1",
   "solderpadhardwarelicensev21": "SHL-2.1",
   "simplelibraryusageexception": "Simple-Library-Usage-exception",
+  "spellingproviderlgplexception": "Spelling-Provider-LGPL-exception",
   "sqlitestudioopensslexception": "sqlitestudio-OpenSSL-exception",
   "stunnelexception": "stunnel-exception",
   "swiexception": "SWI-exception",

package/data/queries-darwin.json

@@ -29,6 +29,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "apps": {
     "query": "select * from apps;",
     "description": "macOS applications installed in known search paths (e.g., /Applications).",
@@ -47,6 +59,12 @@
     "purlType": "swid",
     "componentType": "application"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "certificates": {
     "query": "SELECT * FROM certificates WHERE path != 'Other People';",
     "description": "List all certificates in the trust store.",
@@ -74,7 +92,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages;",
     "description": "Homebrew formula and cask inventory including auto-update behavior.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "application"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages;",
+    "description": "Retrieves the active ports of the MacPorts registry.",
+    "purlType": "macports",
     "componentType": "application"
   },
   "npm_packages": {

package/data/queries-win.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "browser_plugins": {
     "query": "select browser_plugins.* from users join browser_plugins using (uid);",
     "description": "Retrieves the list of C/NPAPI browser plugin in the target system.",
@@ -88,6 +100,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, uid, type, gid FROM users;",
     "description": "Local and domain-backed user account inventory on Windows endpoints.",
@@ -167,7 +185,7 @@
     "componentType": "data"
   },
   "windows_bitlocker_info": {
-    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status FROM bitlocker_info;",
+    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status, protector_types FROM bitlocker_info;",
     "description": "BitLocker protection and encryption state for local drives.",
     "purlType": "swid",
     "componentType": "data"