@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/parsers/largeJson.js

@@ -54,9 +54,20 @@ function applySpec(value, spec) {
     return value;
   }
   if (Array.isArray(value)) {
+    let elements = value;
+    if (spec.map) {
+      const mapped = [];
+      for (const element of elements) {
+        const transformed = spec.map(element);
+        if (transformed !== undefined) {
+          mapped.push(transformed);
+        }
+      }
+      elements = mapped;
+    }
     return spec.filter
-      ? value.filter((element) => spec.filter(element))
-      : value;
+      ? elements.filter((element) => spec.filter(element))
+      : elements;
   }
   if (!spec.members) {
     return value;
@@ -294,9 +305,10 @@ function scanObjectMembers(cursor, stopAt = undefined) {
   }
 }
 
-// Decode the array at the cursor in runs of whole elements, keeping those that
-// `filter` accepts.
-function readArrayElements(cursor, filter, batchBytes) {
+// Decode the array at the cursor in runs of whole elements, mapping each one
+// through `spec.map` (an undefined result drops it) and keeping those that
+// `spec.filter` accepts.
+function readArrayElements(cursor, spec, batchBytes) {
   if (cursor.nextToken() !== OPEN_BRACKET) {
     cursor.fail("Expected an array");
   }
@@ -310,8 +322,12 @@ function readArrayElements(cursor, filter, batchBytes) {
     for (const element of JSON.parse(
       `[${cursor.endCapture(cursor.pos - 1)}]`,
     )) {
-      if (!filter || filter(element)) {
-        elements.push(element);
+      const mapped = spec?.map ? spec.map(element) : element;
+      if (mapped === undefined) {
+        continue;
+      }
+      if (!spec?.filter || spec.filter(mapped)) {
+        elements.push(mapped);
       }
     }
   };
@@ -367,7 +383,7 @@ function decodeRange(fd, start, end, spec, options) {
       );
     }
   } else if (first === OPEN_BRACKET) {
-    value = readArrayElements(cursor, spec?.filter, options.batchBytes);
+    value = readArrayElements(cursor, spec, options.batchBytes);
   } else {
     // A string or number this large has no smaller parts; JSON.parse reports
     // it the way it would for the whole file.
@@ -449,9 +465,10 @@ export function readJsonMember(filePath, name, options = {}) {
  * more than a bounded run of it in one string.
  *
  * `spec` narrows what is kept. `{ members: { name: spec } }` keeps only the
- * named members of an object, each narrowed by its own spec. `{ filter }`
- * keeps the elements of an array that `filter(element)` accepts. Anything else
- * keeps the whole value.
+ * named members of an object, each narrowed by its own spec. `{ map }`
+ * transforms each element of an array, an undefined result dropping it, and
+ * `{ filter }` keeps the mapped elements that `filter(element)` accepts.
+ * Anything else keeps the whole value.
  *
  * @param {string} filePath JSON file
  * @param {{start: number, end: number}} range Byte range of the value, such as one returned by indexJsonObject

package/lib/parsers/vscodeExtensionId.js

@@ -0,0 +1,183 @@
+// The one place that reads the identity of an installed VS Code-family
+// extension from the name of its folder.
+//
+// An editor installs an extension into `<publisher>.<name>-<version>`, and a
+// platform-specific build into `<publisher>.<name>-<version>-<platform>`, for
+// example `anthropic.claude-code-2.1.313-darwin-arm64`. The extension scan and
+// the osquery `vscode_extensions` rows both name the extension from this, so an
+// extension found by `cdxgen -t vscode-extension` and by `obom` is the same
+// component with the same purl.
+
+/**
+ * Target platforms a VS Code-family marketplace publishes an extension for.
+ * `universal` and `web` builds are the same artefact on every platform and are
+ * not part of the extension's identity.
+ */
+export const VSCODE_TARGET_PLATFORMS = new Set([
+  "win32-x64",
+  "win32-arm64",
+  "win32-ia32",
+  "linux-x64",
+  "linux-arm64",
+  "linux-armhf",
+  "alpine-x64",
+  "alpine-arm64",
+  "darwin-x64",
+  "darwin-arm64",
+]);
+
+// Folder suffixes for builds that run on every platform.
+const NEUTRAL_PLATFORMS = ["universal", "web"];
+
+/**
+ * Normalize a target platform value from a manifest, an `extensions.json`
+ * record, or a folder name. Values that do not name a specific platform, such
+ * as `universal`, `web`, `undefined`, or an empty string, return an empty
+ * string.
+ *
+ * @param {string} value Raw target platform
+ * @returns {string} A value from VSCODE_TARGET_PLATFORMS, or an empty string
+ */
+export function normalizeVscodeTargetPlatform(value) {
+  const platform = `${value || ""}`.trim().toLowerCase();
+  return VSCODE_TARGET_PLATFORMS.has(platform) ? platform : "";
+}
+
+/**
+ * Split an installed extension folder name into its publisher, name, version
+ * and target platform.
+ *
+ * @param {string} dirName Folder name, such as `ms-python.python-2025.4.0` or
+ *   `anthropic.claude-code-2.1.313-darwin-arm64`
+ * @returns {{publisher: string, name: string, version: string, platform: string}|undefined}
+ *   The parts, or undefined when the name does not follow the pattern
+ */
+export function parseVscodeExtensionDirName(dirName) {
+  let value = `${dirName || ""}`.trim();
+  while (value.endsWith("/") || value.endsWith("\\")) {
+    value = value.slice(0, -1);
+  }
+  const dotIdx = value.indexOf(".");
+  if (dotIdx < 1) {
+    return undefined;
+  }
+  const publisher = value.substring(0, dotIdx);
+  let rest = value.substring(dotIdx + 1);
+  let platform = "";
+  for (const candidate of [...VSCODE_TARGET_PLATFORMS, ...NEUTRAL_PLATFORMS]) {
+    if (rest.toLowerCase().endsWith(`-${candidate}`)) {
+      platform = normalizeVscodeTargetPlatform(candidate);
+      rest = rest.substring(0, rest.length - candidate.length - 1);
+      break;
+    }
+  }
+  // Marketplaces require semver versions, so the version starts at the first
+  // hyphen whose remainder is a whole semver: `python-3.11-tools-1.0.0` is the
+  // name `python-3.11-tools` at 1.0.0, and `1.0.0-beta-2` stays one version.
+  // A folder whose version is not semver falls back to the first hyphen
+  // followed by digits and a dot.
+  let versionStart = -1;
+  let fallbackStart = -1;
+  for (let i = 1; i < rest.length - 2; i++) {
+    if (rest[i] !== "-" || !isDigit(rest[i + 1])) {
+      continue;
+    }
+    if (isSemver(rest.substring(i + 1))) {
+      versionStart = i;
+      break;
+    }
+    let j = i + 1;
+    while (j < rest.length && isDigit(rest[j])) {
+      j++;
+    }
+    if (fallbackStart < 0 && rest[j] === ".") {
+      fallbackStart = i;
+    }
+  }
+  if (versionStart < 0) {
+    versionStart = fallbackStart;
+  }
+  if (versionStart < 1) {
+    return undefined;
+  }
+  const name = rest.substring(0, versionStart);
+  const version = rest.substring(versionStart + 1);
+  if (!name || !version) {
+    return undefined;
+  }
+  return { publisher, name, version, platform };
+}
+
+function isDigit(character) {
+  return character >= "0" && character <= "9";
+}
+
+function isIdentifierList(text, numericNoLeadingZero) {
+  if (!text) {
+    return false;
+  }
+  return text.split(".").every((part) => {
+    if (!part.length) {
+      return false;
+    }
+    for (const character of part) {
+      const ok =
+        isDigit(character) ||
+        character === "-" ||
+        (character >= "a" && character <= "z") ||
+        (character >= "A" && character <= "Z");
+      if (!ok) {
+        return false;
+      }
+    }
+    if (numericNoLeadingZero && [...part].every(isDigit)) {
+      return part === "0" || part[0] !== "0";
+    }
+    return true;
+  });
+}
+
+/**
+ * Check a string is a semantic version: three numeric parts, then an optional
+ * `-prerelease` and `+build`.
+ *
+ * @param {string} text Candidate version
+ * @returns {boolean} true for a semver
+ */
+export function isSemver(text) {
+  const plus = text.indexOf("+");
+  const core = plus >= 0 ? text.substring(0, plus) : text;
+  if (plus >= 0 && !isIdentifierList(text.substring(plus + 1), false)) {
+    return false;
+  }
+  const dash = core.indexOf("-");
+  const numbers = dash >= 0 ? core.substring(0, dash) : core;
+  if (dash >= 0 && !isIdentifierList(core.substring(dash + 1), true)) {
+    return false;
+  }
+  const parts = numbers.split(".");
+  return (
+    parts.length === 3 &&
+    parts.every(
+      (part) =>
+        part.length > 0 &&
+        [...part].every(isDigit) &&
+        (part === "0" || part[0] !== "0"),
+    )
+  );
+}
+
+/**
+ * Read the target platform from the path of an installed extension folder.
+ *
+ * @param {string} extensionPath Path to the extension folder, with either
+ *   separator
+ * @returns {string} The target platform, or an empty string
+ */
+export function vscodeExtensionPlatformFromPath(extensionPath) {
+  const segments = `${extensionPath || ""}`
+    .split(/[/\\]/u)
+    .filter((segment) => segment.length);
+  const dirName = segments[segments.length - 1];
+  return parseVscodeExtensionDirName(dirName)?.platform || "";
+}

package/lib/server/server.js

@@ -659,7 +659,18 @@ const start = (options) => {
             );
           }
         }
-        cloneDir = gitClone(sourcePath, gitRef);
+        try {
+          cloneDir = gitClone(sourcePath, gitRef);
+        } catch (_err) {
+          console.log("Unable to clone repository. See the server log.");
+          res.writeHead(500, { "Content-Type": "application/json" });
+          return res.end(
+            JSON.stringify({
+              error: "Unable to clone repository",
+              details: "Cloning the repository failed. See the server log.",
+            }),
+          );
+        }
         srcDir = cloneDir;
         if (purlResolution?.type === "npm") {
           const cloneRootDir = cloneDir;

package/lib/stages/postgen/ruleEngine.js

@@ -672,16 +672,21 @@ async function interpolateTemplate(template, context, options = {}) {
     return template;
   }
   const templateRegex = /\{\{\s*([^}]+)\s*}}/g;
-  let result = template;
-  const matches = [...template.matchAll(templateRegex)];
-  for (const match of matches) {
+  // The template is rebuilt from its own slices in one pass, so a value taken
+  // from the BOM is never scanned for {{ }} again and never read as a
+  // String.replace pattern such as `$&`.
+  let result = "";
+  let cursor = 0;
+  for (const match of template.matchAll(templateRegex)) {
     const [fullMatch, expr] = match;
+    let replacement = fullMatch;
     try {
       const expression = jsonata(expr.trim());
       registerCdxHelpers(expression, options);
       const value = await safeEvaluate(expression, context);
-      const replacement = value !== undefined ? String(value) : fullMatch;
-      result = result.replace(fullMatch, replacement);
+      if (value !== undefined) {
+        replacement = String(value);
+      }
     } catch (err) {
       if (DEBUG_MODE) {
         console.warn(
@@ -690,7 +695,10 @@ async function interpolateTemplate(template, context, options = {}) {
         );
       }
     }
+    result += template.slice(cursor, match.index) + replacement;
+    cursor = match.index + fullMatch.length;
   }
+  result += template.slice(cursor);
   return result;
 }
 

package/lib/stages/pregen/envAudit.js

@@ -110,6 +110,7 @@ const JVM_PROJECT_TYPES = new Set([
   "java24",
   "java25",
   "java26",
+  "java27",
   "jvm",
   "kt",
   "kotlin",

package/lib/stages/pregen/pregen.js

@@ -29,6 +29,8 @@ import {
 } from "../../core/fs.js";
 import { isMac, isWin } from "../../core/paths.js";
 import { isProjectToolingAllowed } from "../../core/projectTooling.js";
+import { recordToolVersion } from "../../core/toolRegistry.js";
+import { collectProjectRubyDeclarations } from "../../ecosystems/rubyutils.js";
 import {
   dosaiDotnetRequirement,
   dosaiDotnetRequirementAdvice,
@@ -45,6 +47,7 @@ import {
   installSdkmanTool,
   isNvmAvailable,
   isRbenvAvailable,
+  isRubyVersionActive,
   isSdkmanAvailable,
   isSdkmanToolAvailable,
   performBundleInstall,
@@ -65,6 +68,7 @@ import {
   readSbtBuildPropertiesVersion,
   readToolVersionEnvHint,
   readToolVersionOverride,
+  resolveGradleVersionForJava,
   resolvePartialVersion,
 } from "../../inventory/jvmToolEnv.js";
 import { resolvePluginBinary } from "../../inventory/plugins.js";
@@ -316,6 +320,27 @@ const JVM_TOOL_DEFAULT_PREFIXES = {
   maven: "3.9",
 };
 
+/**
+ * JDK major a versioned java project type names, such as 27 for `java27`.
+ *
+ * @param {string} projectType Project type
+ * @returns {number|undefined} The major, or undefined for any other type
+ */
+export function javaMajorFromProjectType(projectType) {
+  if (typeof projectType !== "string" || !projectType.startsWith("java")) {
+    return undefined;
+  }
+  const major = Number.parseInt(projectType.slice(4), 10);
+  return Number.isInteger(major) && `java${major}` === projectType
+    ? major
+    : undefined;
+}
+
+/** Command each provisioned sdkman candidate is invoked as. */
+const JVM_TOOL_COMMANDS = {
+  maven: "mvn",
+};
+
 /** sdkman candidates cdxgen can provision for JVM builds. */
 const JVM_BUILD_TOOLS = ["maven", "gradle", "sbt", "scala"];
 
@@ -400,10 +425,26 @@ export function prepareJvmBuildEnv(filePath, options) {
     return;
   }
   // Resolve partial versions (e.g. maven3.9 -> 3.9.16) before touching the JDK
-  // so the compatibility matrix sees the real versions.
+  // so the compatibility matrix sees the real versions. The Gradle default
+  // install is constrained by the JDK the project declared or asked for, so a
+  // Java 27 project never gets a Gradle that cannot run on it.
+  // A versioned java type counts even without an sdkman alias: java27 has
+  // none until the broker serves a Java 27 build, but the project still asked
+  // for that JDK.
+  const explicitJavaMajor = Math.max(
+    0,
+    ...(options.projectType || []).map((pt) =>
+      SDKMAN_JAVA_TOOL_ALIASES[pt]
+        ? extractJavaMajor(SDKMAN_JAVA_TOOL_ALIASES[pt]) || 0
+        : javaMajorFromProjectType(pt) || 0,
+    ),
+  );
+  const gradleJavaMajor =
+    Math.max(detected.javaVersionHint || 0, explicitJavaMajor || 0) ||
+    undefined;
   const resolvedPins = [];
   for (const pin of installPins) {
-    const resolved = resolveJvmToolPinVersion(pin);
+    const resolved = resolveJvmToolPinVersion(pin, gradleJavaMajor);
     if (resolved) {
       resolvedPins.push(resolved);
     }
@@ -422,6 +463,11 @@ export function prepareJvmBuildEnv(filePath, options) {
     const installed = provisionJvmTool(pin, options);
     if (installed) {
       setJvmToolCommandEnv(pin);
+      if (pin.version) {
+        // The resolved version is already known, so metadata.tools can carry
+        // it without spawning another probe, once the tool runs (issue #598).
+        recordToolVersion(JVM_TOOL_COMMANDS[pin.tool] || pin.tool, pin.version);
+      }
       if (pin.source === "cli") {
         pinnedToolSelected = true;
       }
@@ -731,11 +777,14 @@ function recordDetectedJvmPins(installPins, wrapperVersions) {
  * and to pick defaults.
  *
  * @param {Object} pin `{ tool, version?, source }`
+ * @param {Number|undefined} javaMajor JDK major the project declared or
+ *   configured, when known. Constrains the default Gradle install so a
+ *   project on a new JDK never resolves a Gradle that cannot run on it.
  *
  * @returns {Object|undefined} Pin with an exact version, or undefined when no
  *   version could be determined.
  */
-export function resolveJvmToolPinVersion(pin) {
+export function resolveJvmToolPinVersion(pin, javaMajor) {
   if (pin.version && isSdkmanToolAvailable(pin.tool, pin.version)) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "java",
@@ -766,20 +815,30 @@ export function resolveJvmToolPinVersion(pin) {
     return undefined;
   }
   const prefix = pin.version || JVM_TOOL_DEFAULT_PREFIXES[pin.tool] || "";
-  const resolved = resolvePartialVersion(versionList, prefix);
+  const resolved =
+    pin.tool === "gradle" && !pin.version
+      ? resolveGradleVersionForJava(versionList, javaMajor)
+      : resolvePartialVersion(versionList, prefix);
   if (!resolved) {
     if (pin.version) {
       return pin;
     }
+    const gradleMinimum =
+      pin.tool === "gradle"
+        ? minimumGradleVersionForJava(javaMajor)
+        : undefined;
+    const missingDetail = gradleMinimum
+      ? `No stable gradle version at or above ${gradleMinimum}, the first that runs on Java ${javaMajor}, is listed by sdkman.`
+      : `No stable ${pin.tool} version matched the default prefix '${prefix}'.`;
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISSING, {
       ecosystem: "java",
       tool: pin.tool,
-      wanted: prefix,
+      wanted: gradleMinimum ? `>=${gradleMinimum}` : prefix,
       source: "sdkman",
-      detail: `No stable ${pin.tool} version matched the default prefix '${prefix}'.`,
+      detail: missingDetail,
     });
     console.log(
-      `No stable ${pin.tool} version matched the default prefix '${prefix}'. Pass an exact version identifier via -t ${pin.tool}<version>.`,
+      `${missingDetail} Pass an exact version identifier via -t ${pin.tool}<version>.`,
     );
     return undefined;
   }
@@ -1582,6 +1641,17 @@ export function prepareSwiftEnv(filePath, options) {
  * @param {String} filePath Path
  * @param {Object} options CLI Options
  */
+// The order pregen reads the Ruby to install in.
+const PREGEN_RUBY_SOURCE_ORDER = [
+  ".ruby-version",
+  ".tool-versions",
+  "mise.toml",
+  ".mise.toml",
+  ".config/mise.toml",
+  "Gemfile.lock",
+  "Gemfile",
+];
+
 export function prepareRubyEnv(filePath, options) {
   // Skip preparation early
   if (
@@ -1627,53 +1697,39 @@ export function prepareRubyEnv(filePath, options) {
     readEnvironmentVariable("GEM_HOME") ||
     safeMkdtempSync(join(getTmpDir(), "cdxgen-gem-home-"));
   process.env.CDXGEN_GEM_HOME = cdxgenGemHome;
-  // Is there a .ruby-version file in the project?
-  if (safeExistsSync(join(filePath, ".ruby-version"))) {
-    rubyVersionNeeded = readFileSync(join(filePath, ".ruby-version"), {
-      encoding: "utf-8",
-    })
-      .trim()
-      .replace("ruby-", "");
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: ".ruby-version",
-        path: join(filePath, ".ruby-version"),
-      });
-    }
-  } else if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
-    // Is there a lock file that can be used to identify the needed Ruby version?
+  // The Ruby to install is the one developers select: .ruby-version, then the
+  // asdf and mise pins, then the Ruby the lockfile was resolved with, then the
+  // Gemfile directive. Only an exact MRI version can be installed with rbenv.
+  const declarations = collectProjectRubyDeclarations(filePath);
+  for (const declaration of declarations) {
+    recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
+      ecosystem: "ruby",
+      tool: declaration.engine === "ruby" ? "ruby" : declaration.engine,
+      wanted: declaration.version || declaration.requirement,
+      source: declaration.source,
+      path: declaration.path,
+    });
+  }
+  const installable = PREGEN_RUBY_SOURCE_ORDER.map((source) =>
+    declarations.find(
+      (declaration) => declaration.source === source && declaration.version,
+    ),
+  ).find(Boolean);
+  if (installable && installable.engine !== "ruby") {
+    console.log(
+      `This project selects ${installable.engine} ${installable.version} (${installable.source}). cdxgen installs only MRI Ruby with rbenv; build the project with ${installable.engine} first and then invoke cdxgen with the arguments "--lifecycle pre-build".`,
+    );
+  } else if (installable?.prerelease) {
+    console.log(
+      `This project was locked with a pre-release of Ruby ${installable.version}, whose tag the lockfile does not record. Install it before invoking cdxgen.`,
+    );
+  } else if (installable) {
+    rubyVersionNeeded = installable.version;
+  }
+  if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
     const gemlockData = readFileSync(join(filePath, "Gemfile.lock"), {
       encoding: "utf-8",
     });
-    let rubyVersionMarker = false;
-    for (let l of gemlockData.split("\n")) {
-      l = l.replaceAll("\r", "").trim();
-      if (l.includes("RUBY VERSION")) {
-        rubyVersionMarker = true;
-      }
-      if (rubyVersionMarker && l.includes("ruby ")) {
-        const possibleVersion = l
-          .split("ruby ")
-          .pop()
-          .split("p")[0]
-          .split("d")[0];
-        if (/^\d+/.test(possibleVersion)) {
-          rubyVersionNeeded = possibleVersion;
-          break;
-        }
-      }
-    }
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: "Gemfile.lock",
-      });
-    }
     const bundlerVersion = parseGemfileLockBundlerVersion(gemlockData);
     if (bundlerVersion) {
       recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
@@ -1683,7 +1739,8 @@ export function prepareRubyEnv(filePath, options) {
         source: "Gemfile.lock",
       });
     }
-  } else {
+  }
+  if (!installable) {
     // Is the user invoking with a ruby with custom version type. Eg: -t ruby2.5.4
     let projectTypes = options.projectType;
     if (
@@ -1716,13 +1773,13 @@ export function prepareRubyEnv(filePath, options) {
   const existingRuby = collectRubyInfo(filePath);
   if (
     rubyVersionNeeded &&
-    existingRuby?.version?.startsWith(`ruby ${rubyVersionNeeded} `)
+    isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
       detail: `The active interpreter is the required Ruby ${rubyVersionNeeded}.`,
     });
@@ -1754,15 +1811,15 @@ export function prepareRubyEnv(filePath, options) {
     });
   } else if (
     rubyVersionNeeded &&
-    !existingRuby.version.startsWith(`ruby ${rubyVersionNeeded} `)
+    !isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISMATCH, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
-      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.version}.`,
+      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.description || existingRuby.version}.`,
     });
   }
   if (rubyVersionNeeded && !rbenvPresent) {

package/lib/validator/bomValidator.js

@@ -263,10 +263,12 @@ const getSpdxExportSchemaValidator = () => {
  * Validate the generated bom using jsonschema
  *
  * @param {object} bomJson content
+ * @param {object} [options] Validation options
+ * @param {boolean} [options.deep] Run the deep validators after the schema check. Defaults to true.
  *
  * @returns {Promise<Boolean>} true if the BOM is valid. false otherwise.
  */
-export const validateBom = async (bomJson) => {
+export const validateBom = async (bomJson, options = {}) => {
   if (!bomJson) {
     return true;
   }
@@ -292,6 +294,9 @@ export const validateBom = async (bomJson) => {
     console.log(validate.errors);
     return false;
   }
+  if (options.deep === false) {
+    return true;
+  }
   // Deep validation tests
   return (
     validateMetadata(bomJson) &&