@cdxgen/cdxgen 13.5.0 → 13.7.0

package/README.md

@@ -121,7 +121,9 @@ Sections include:
 - [MCP Inventory](docs/MCP.md)
 - [REPL Guide](docs/REPL.md)
 - [Custom Properties](docs/CUSTOM_PROPERTIES.md)
-- [Claude Code Plugin](claude-plugin/README.md)
+- [Coding Agent Plugin](agent-plugin/README.md)
+- [Installing the plugin in coding agents](docs/AGENT_PLUGINS.md)
+- [Agent CI recipes](docs/AGENT_CI.md)
 - [Deprecations](docs/DEPRECATIONS.md)
 - [Security Policy](SECURITY.md)
 - [Threat Model](docs/THREAT_MODEL.md)
@@ -216,7 +218,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.5.0"
+VERSION="v13.7.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +232,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.5.0"
+VERSION="v13.7.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +246,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.5.0"
+$Version = "v13.7.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +271,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.5.0 \
+      gh release download v13.7.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -296,7 +298,7 @@ winget install cdxgen
 
 You can also use the cdxgen container image with node, deno, or bun runtime versions.
 
-The default version uses Node.js 24
+The default version uses Node.js 26
 
 ```bash
 docker run --rm -e CDXGEN_DEBUG_MODE=debug -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cdxgen/cdxgen:master -r /app -o /app/bom.json
@@ -337,7 +339,7 @@ npm install -g @cdxgen/cdxgen --ignore-scripts --min-release-age=2
 **pnpm**:
 
 ```shell
-pnpm add -g @cdxgen/cdxgen --omit=optional --ignore-scripts --minimum-release-age=2880
+pnpm add -g @cdxgen/cdxgen --ignore-scripts --config.minimum-release-age=2880
 ```
 
 **bun**:
@@ -621,16 +623,21 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 pnpm dlx @cdxgen/cdxgen-plugins-bin
 ```
 
-## Claude Code plugin
+## Coding agent plugin
 
-The cdxgen toolkit is also packaged as a [Claude Code](https://claude.com/claude-code) plugin, so agents drive the correct command and flags — including the dry-run-first and no-auto-install safety constraints — instead of guessing.
+The cdxgen toolkit is also packaged as a plugin for coding agents, so agents drive the correct command and flags, including the dry-run-first and no-auto-install safety constraints, instead of guessing. It is meant for Claude Code, OpenAI Codex, the GitHub Copilot CLI and app, Cursor, Gemini CLI, Kiro and opencode, and has been tried in Claude Code and Codex so far.
 
 ```shell
 claude plugin marketplace add cdxgen/cdxgen
 claude plugin install cdxgen@cdxgen-plugins
 ```
 
-It ships skills covering SBOM generation, container and rootfs scans, OBOM/HBOM, CBOM, AI-BOM and MCP inventory, BOM auditing, signing, validation, conversion, evidence enrichment, runtime tracing, and Dependency-Track publishing. See [claude-plugin/README.md](claude-plugin/README.md).
+```shell
+codex plugin marketplace add cdxgen/cdxgen
+codex plugin add cdxgen@cdxgen-plugins
+```
+
+It ships skills covering SBOM generation, container and rootfs scans, OBOM/HBOM, CBOM, AI-BOM and MCP inventory, BOM auditing, signing, validation, conversion, evidence enrichment, runtime tracing, and Dependency-Track publishing. See [agent-plugin/README.md](agent-plugin/README.md) and the [installation guide](docs/AGENT_PLUGINS.md) for each client. To run cdxgen through an agent in GitHub Actions, see the [agent CI recipes](docs/AGENT_CI.md).
 
 ## Rust accelerator (cdxrs)
 

package/bin/audit.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 
-import { writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import process from "node:process";
 
@@ -13,6 +12,7 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
   safeMkdirSync,
+  safeWriteSync,
 } from "../lib/ecosystems/utils.js";
 
 const args = yargs(hideBin(process.argv))
@@ -193,7 +193,7 @@ function writeOrPrint(output, outputPath) {
   if (!safeExistsSync(parentDir)) {
     safeMkdirSync(parentDir, { recursive: true });
   }
-  writeFileSync(outputPath, output);
+  safeWriteSync(outputPath, output);
 }
 
 (async () => {
@@ -235,10 +235,13 @@ function writeOrPrint(output, outputPath) {
       report: args.report,
     });
     writeOrPrint(finalized.output, reportFile);
-    process.exit(finalized.exitCode);
+    // exitCode instead of process.exit lets a piped stdout write drain before
+    // the process ends, and the finally block below still runs.
+    process.exitCode = finalized.exitCode;
   } catch (error) {
     console.error(error.message);
-    process.exit(1);
+    // exitCode instead of process.exit lets pending stderr output drain.
+    process.exitCode = 1;
   } finally {
     progressTracker.stop();
   }

package/bin/cdxgen.js

@@ -83,13 +83,24 @@ import {
   createOutputPlan,
   getOutputDirectory,
 } from "../lib/helpers/exportUtils.js";
+import {
+  generateJssKeyPair,
+  signJssBom,
+  verifyJssBom,
+} from "../lib/helpers/jssSigner.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
   getSupportedCycloneDxComponentTypes,
+  isCycloneDx20SpecVersion,
   isCycloneDxBom,
   normalizeCycloneDxComponentTypeFilter,
   toCycloneDxSpecVersionString,
 } from "../lib/inventory/bomUtils.js";
+import {
+  DEPENDENCY_TRACK_CDX20_ERROR,
+  getInternalBom,
+  refreshRenderedBom,
+} from "../lib/inventory/cyclonedx20.js";
 import {
   displaySelfThreatModel,
   printActivitySummary,
@@ -155,16 +166,37 @@ for (const configPattern of PROJECT_CONFIG_FILENAMES) {
     continue;
   }
   try {
-    if (configPath.endsWith(".yml") || configPath.endsWith(".yaml")) {
-      config = _load(fs.readFileSync(configPath, "utf-8"));
-    } else {
-      config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-    }
+    const parsedConfig =
+      configPath.endsWith(".yml") || configPath.endsWith(".yaml")
+        ? _load(fs.readFileSync(configPath, "utf-8"))
+        : JSON.parse(fs.readFileSync(configPath, "utf-8"));
     if (isSecureMode || DEBUG_MODE) {
       console.log(`Config file '${configPath}' loaded successfully.`);
     }
-    const sanitized = sanitizeProjectConfig(config, dirname(configPath));
+    const sanitized = sanitizeProjectConfig(parsedConfig, dirname(configPath));
     config = sanitized.config;
+    for (const key of sanitized.operatorOnly) {
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' sets '${key}', which only the command line or a CDXGEN_ environment variable may set. Ignoring it.\x1b[0m`,
+      );
+    }
+    for (const projectType of sanitized.hostScopeTypes) {
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' selects the project type '${projectType}', which inventories this host rather than the project. Ignoring it. Pass '-t ${projectType}' on the command line if this is intentional.\x1b[0m`,
+      );
+    }
+    for (const key of sanitized.ignored) {
+      console.warn(
+        `Config file '${configPath}' sets '${key}', which is not an option a config file can set. Ignoring it.`,
+      );
+    }
+    for (const { key, pattern, reason } of sanitized.refusedPatterns) {
+      const shownPattern =
+        pattern.length > 80 ? `${pattern.slice(0, 77)}...` : pattern;
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' sets the ${key} pattern '${shownPattern}', which ${reason}. Ignoring it. Pass the pattern on the command line if this is intentional.\x1b[0m`,
+      );
+    }
     for (const entry of sanitized.rejected) {
       console.warn(
         `\x1b[1;35mConfig file '${configPath}' sets '${entry}', which points outside the project directory. Ignoring it. Pass the option on the command line if this is intentional.\x1b[0m`,
@@ -425,7 +457,7 @@ const args = _yargs
   .option("generate-key-and-sign", {
     type: "boolean",
     description:
-      "Generate a public/private key pair for SBOM_SIGN_ALGORITHM (RS512 by default) and then sign the generated SBOM using the JSON Signature Format (JSF).",
+      "Generate a public/private key pair for SBOM_SIGN_ALGORITHM and then sign the generated SBOM: with the JSON Signature Format (JSF, RS512 by default) at 1.x, or the JSON Signature Scheme (JSS, ITU-T X.590; Ed25519 by default) at --spec-version 2.0.",
   })
   .option("server", {
     type: "boolean",
@@ -490,6 +522,10 @@ const args = _yargs
     description: "Path for the usages slices file created by atom.",
     hidden: true,
   })
+  .option("callsites-slices-file", {
+    description: "Path for the callsites slices file created by atom.",
+    hidden: true,
+  })
   .option("data-flow-slices-file", {
     description: "Path for the data-flow slices file created by atom.",
     hidden: true,
@@ -630,7 +666,7 @@ const args = _yargs
     type: "boolean",
     default: false,
     description:
-      "Generate formulation section with git metadata and build tools. Defaults to false.",
+      "Generate formulation section with git metadata, build tools and build inputs. On by default when CI=true, for BOM audits, the research and introspect profiles, OS project types and the cbom command; --no-include-formulation turns it off.",
   })
   .option("include-crypto", {
     type: "boolean",
@@ -693,6 +729,8 @@ const args = _yargs
       "suggest-build-tools",
       "ruby-docker-install",
       "resolve-gradle-distribution",
+      "gradle-prefer-lockfile",
+      "gradle-verification-fallback",
       "jvm-tool-setup",
     ],
   })
@@ -1204,6 +1242,21 @@ try {
   console.error(error.message);
   process.exit(1);
 }
+// Dependency-Track ingests CycloneDX 1.x only. Refuse an upload (server URL
+// plus API key, the same condition the submission below uses) before
+// generating, so a long scan does not end in an upload that cannot succeed.
+// Server mode checks each request instead, since a request may choose its own
+// version.
+if (
+  !options.server &&
+  typeof options.serverUrl === "string" &&
+  options.serverUrl.length > 0 &&
+  options.apiKey &&
+  isCycloneDx20SpecVersion(options.specVersion)
+) {
+  console.error(DEPENDENCY_TRACK_CDX20_ERROR);
+  process.exit(1);
+}
 if (!options.projectType) {
   thoughtLog(
     "Ok, the user wants me to identify all the project types and generate a consolidated BOM document.",
@@ -1276,6 +1329,7 @@ if (options.lifecycle) {
 const isHbomOnlyInvocation = isHbomOnlyProjectTypes(options.projectType);
 const advancedWarnings = applyAdvancedOptionsImpl(options, {
   isSecureMode: isSecureModeActive(),
+  invokedCommandName,
 });
 // The config file comes from the working directory, usually the scanned
 // project, so whether the project's own code may run stays the operator's
@@ -1640,6 +1694,99 @@ const signCycloneDxPayload = (jsonPayload, keyDir, target, options) => {
   return signedBom;
 };
 
+/**
+ * Signs a CycloneDX 2.0 payload with JSS (ITU-T X.590) using the configured
+ * or generated key: the root and the nested members the draft allows (see
+ * lib/helpers/jssSigner.js). A generated key is checked against the fresh
+ * signature, as the JSF path does.
+ *
+ * @param {string} jsonPayload Serialized CycloneDX 2.0 BOM
+ * @param {string|undefined} keyDir Directory for --generate-key-and-sign keys
+ * @param {string} target Output the signed BOM is written to (for the activity log)
+ * @param {Object} options CLI options
+ * @returns {Object} Signed BOM
+ * @throws {Error} When signing was requested but cannot be completed
+ */
+const signJssPayload = (jsonPayload, keyDir, target, options) => {
+  // Signing a supplied key needs SBOM_SIGN_ALGORITHM (see needsBomSigning);
+  // only --generate-key-and-sign reaches here without one.
+  const algorithm = readEnvironmentVariable("SBOM_SIGN_ALGORITHM") || "Ed25519";
+  const sbomSignPrivateKey = readEnvironmentVariable("SBOM_SIGN_PRIVATE_KEY", {
+    sensitive: true,
+  });
+  const sbomSignPrivateKeyBase64 = readEnvironmentVariable(
+    "SBOM_SIGN_PRIVATE_KEY_BASE64",
+    { sensitive: true },
+  );
+  let privateKey;
+  let publicKeyFile;
+  if (options.generateKeyAndSign) {
+    if (!keyDir) {
+      throw new Error(
+        "--generate-key-and-sign needs a file output (-o) to write the generated keys next to.",
+      );
+    }
+    publicKeyFile = join(keyDir, "public.key");
+    const privateKeyFile = join(keyDir, "private.key");
+    const generated = generateJssKeyPair(algorithm);
+    safeWriteSync(
+      publicKeyFile,
+      generated.publicKey.export({ type: "spki", format: "pem" }),
+    );
+    // The private key is readable by the owner only.
+    safeWriteSync(
+      privateKeyFile,
+      generated.privateKey.export({ type: "pkcs8", format: "pem" }),
+      { mode: 0o600 },
+    );
+    console.log(
+      "Created public/private key pairs for testing purposes",
+      publicKeyFile,
+      privateKeyFile,
+    );
+    privateKey = generated.privateKey;
+  } else if (sbomSignPrivateKey) {
+    if (!safeExistsSync(sbomSignPrivateKey)) {
+      throw new Error(
+        `The SBOM_SIGN_PRIVATE_KEY file '${sbomSignPrivateKey}' was not found.`,
+      );
+    }
+    recordSensitiveFileRead(sbomSignPrivateKey, {
+      label: "SBOM signing private key",
+    });
+    privateKey = fs.readFileSync(sbomSignPrivateKey);
+  } else if (sbomSignPrivateKeyBase64) {
+    privateKey = Buffer.from(sbomSignPrivateKeyBase64, "base64");
+  } else {
+    throw new Error(
+      `Signing a CycloneDX 2.0 document needs a private key: set SBOM_SIGN_PRIVATE_KEY (PEM), SBOM_SIGN_PRIVATE_KEY_BASE64, or pass --generate-key-and-sign. Algorithm in use: ${algorithm}.`,
+    );
+  }
+  thoughtLog(`Signing the BOM for "${target}" with JSS (${algorithm}).`);
+  const signedBom = signJssBom(JSON.parse(jsonPayload), {
+    algorithm,
+    privateKey,
+  });
+  if (publicKeyFile) {
+    const verdict = verifyJssBom(signedBom, {
+      publicKey: fs.readFileSync(publicKeyFile, "utf8"),
+      requireAll: true,
+    });
+    if (!verdict.valid) {
+      throw new Error(
+        `The new JSS signature does not verify with ${publicKeyFile}.`,
+      );
+    }
+    console.log(
+      "SBOM signature is verifiable natively with the public key and the algorithm",
+      publicKeyFile,
+      algorithm,
+    );
+  }
+  recordActivity({ kind: "sign", status: "completed", target });
+  return signedBom;
+};
+
 /**
  * Signs the BOM for an output when signing is configured. A failure is
  * recorded and returned so that the caller can stop with a non-zero exit
@@ -1660,6 +1807,24 @@ const signForOutput = (bomJson, jsonPayload, keyDir, target, options) => {
     });
     return { bomJson, jsonPayload };
   }
+  if (isCycloneDx20SpecVersion(bomJson?.specVersion || options?.specVersion)) {
+    // A CycloneDX 2.0 document signs with JSS (ITU-T X.590) instead of JSF.
+    try {
+      const signedBom = signJssPayload(jsonPayload, keyDir, target, options);
+      return {
+        bomJson: signedBom,
+        jsonPayload: stringifyJson(signedBom, options.jsonPretty),
+      };
+    } catch (err) {
+      recordActivity({
+        kind: "sign",
+        reason: err.message,
+        status: "failed",
+        target,
+      });
+      return { bomJson, jsonPayload, signingError: err };
+    }
+  }
   try {
     const signedBom = signCycloneDxPayload(
       jsonPayload,
@@ -1998,7 +2163,10 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       hasCriticalFindings,
     } = await import("../lib/stages/postgen/auditBom.js");
     thoughtLog("Let's run security audit...");
-    const postAuditFindings = await auditBom(bomNSData.bomJson, {
+    // The audit and its annotations read the 1.x-shaped model; at 2.0 the
+    // rendered document is refreshed once after the last mutation.
+    const auditInternalBom = getInternalBom(bomNSData);
+    const postAuditFindings = await auditBom(auditInternalBom, {
       ...options,
       getBomWithOras,
     });
@@ -2017,9 +2185,9 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       }
     }
     if (postAuditFindings.length && options.specVersion >= 1.4) {
-      bomNSData.bomJson.annotations = [
-        ...(bomNSData.bomJson.annotations || []),
-        ...formatAnnotations(postAuditFindings, bomNSData.bomJson),
+      auditInternalBom.annotations = [
+        ...(auditInternalBom.annotations || []),
+        ...formatAnnotations(postAuditFindings, auditInternalBom),
       ];
       thoughtLog(
         `Embedded ${postAuditFindings.length} audit findings as CycloneDX annotations`,
@@ -2053,7 +2221,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       const requiredAuditTargetCount = collectAuditTargets(
         [
           {
-            bomJson: bomNSData.bomJson,
+            bomJson: auditInternalBom,
             source: filePath,
           },
         ],
@@ -2074,7 +2242,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         predictiveReport = await runAuditFromBoms(
           [
             {
-              bomJson: bomNSData.bomJson,
+              bomJson: auditInternalBom,
               source: filePath,
             },
           ],
@@ -2111,14 +2279,14 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       }
       const predictiveAnnotations = formatPredictiveAnnotations(
         predictiveReport,
-        bomNSData.bomJson,
+        auditInternalBom,
         {
           minSeverity: options.bomAuditMinSeverity,
         },
       );
       if (predictiveAnnotations.length && options.specVersion >= 1.4) {
-        bomNSData.bomJson.annotations = [
-          ...(bomNSData.bomJson.annotations || []),
+        auditInternalBom.annotations = [
+          ...(auditInternalBom.annotations || []),
           ...predictiveAnnotations,
         ];
         thoughtLog(
@@ -2161,9 +2329,11 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         target: internalCycloneDxInputPath,
       });
     } else {
+      // Evinse reads and writes the 1.x shape, so the temp input is the
+      // internal model, not the rendered 2.0 document.
       safeWriteSync(
         internalCycloneDxInputPath,
-        stringifyJson(bomNSData.bomJson, options.jsonPretty),
+        stringifyJson(getInternalBom(bomNSData), options.jsonPretty),
       );
     }
   }
@@ -2193,7 +2363,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       if (!options.projectType) {
         const evidenceLanguage = evinserModule.defaultEvidenceLanguage(
           filePath,
-          bomNSData?.bomJson,
+          getInternalBom(bomNSData),
           options,
         );
         if (evidenceLanguage) {
@@ -2205,10 +2375,17 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
           "Skipping the evidence analysis since the BOM lists no package in a language it supports. Pass -t to choose the language.",
         );
         if (bomNSData) {
-          bomNSData.bomJson = applyEvidenceBasedFilter(
-            bomNSData.bomJson,
+          // The filter mutates the 1.x model; the rendered 2.0 document is
+          // refreshed below, once, after this last mutation.
+          const filteredBom = applyEvidenceBasedFilter(
+            getInternalBom(bomNSData),
             options,
           );
+          if (bomNSData.internalBomJson) {
+            bomNSData.internalBomJson = filteredBom;
+          } else {
+            bomNSData.bomJson = filteredBom;
+          }
         }
       } else {
         const evinseOptions = evinserModule.buildEvinseOptions(
@@ -2216,6 +2393,12 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
           args,
           internalCycloneDxInputPath || options.output,
         );
+        // The analysis reads the in-memory 1.x model. At 2.0 that model is
+        // labelled 2.0 but is not a 2.0 document, so it is handed over
+        // directly instead of being read back from the temporary file.
+        if (bomNSData?.internalBomJson) {
+          evinseOptions.inputBomJson = bomNSData.internalBomJson;
+        }
         try {
           const dbObjMap = await evinserModule.prepareDB(evinseOptions);
           if (dbObjMap) {
@@ -2225,16 +2408,31 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
             );
             const evinseJson = await evinserModule.createEvinseFile(
               sliceArtefacts,
-              evinseOptions,
+              { ...evinseOptions, returnInternalModel: true },
             );
             // The scope filter is deferred until here so the analyzers get to
-            // prove that an optional dependency is actually used.
-            bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
-            if (options.print && evinseJson) {
-              printOccurrences(evinseJson);
-              printCallStack(evinseJson);
+            // prove that an optional dependency is actually used. At 2.0
+            // createEvinseFile runs postProcess again and would return the
+            // rendered 2.0 document; `returnInternalModel` asks for the 1.x
+            // model instead, which becomes the internal model and is
+            // re-rendered below.
+            const evinseInternalBom = evinseJson;
+            if (bomNSData.internalBomJson) {
+              bomNSData.internalBomJson = applyEvidenceBasedFilter(
+                evinseInternalBom,
+                options,
+              );
+            } else {
+              bomNSData.bomJson = applyEvidenceBasedFilter(
+                evinseInternalBom,
+                options,
+              );
+            }
+            if (options.print && evinseInternalBom) {
+              printOccurrences(evinseInternalBom);
+              printCallStack(evinseInternalBom);
               printReachables(sliceArtefacts);
-              printServices(evinseJson);
+              printServices(evinseInternalBom);
             }
           }
         } catch (err) {
@@ -2249,6 +2447,10 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       }
     }
   }
+  // The last post-postProcess mutation is done; at 2.0 the rendered document
+  // is refreshed from the internal model once, before validation, signing
+  // and writing. At 1.x this is a no-op.
+  refreshRenderedBom(bomNSData, options);
   // Perform automatic validation
   if (options.validate && bomNSData?.bomJson) {
     thoughtLog("Wait, let's check the generated BOM file for any issues.");
@@ -2302,7 +2504,12 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         target: "spdx",
       });
     } else {
-      bomNSData.spdxJson = convertCycloneDxToSpdx(bomNSData.bomJson, options);
+      // The SPDX converter reads the 1.x shape; at 2.0 that is the internal
+      // model.
+      bomNSData.spdxJson = convertCycloneDxToSpdx(
+        getInternalBom(bomNSData),
+        options,
+      );
       recordActivity({
         kind: "convert",
         status: "completed",
@@ -2505,6 +2712,20 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         status: "blocked",
         target: options.serverUrl,
       });
+    } else if (isCycloneDx20SpecVersion(bomNSData.bomJson?.specVersion)) {
+      // Unreachable from the CLI, which refuses this before generating; kept
+      // so a 2.0 document can never reach Dependency-Track.
+      recordActivity({
+        kind: "submit",
+        reason: DEPENDENCY_TRACK_CDX20_ERROR,
+        status: "blocked",
+        target: options.serverUrl,
+      });
+      console.error(DEPENDENCY_TRACK_CDX20_ERROR);
+      if (cleanup) {
+        cleanupSourceDir(srcDir);
+      }
+      process.exit(1);
     } else {
       try {
         recordActivity({
@@ -2543,7 +2764,8 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       try {
         const { buildPublishCollectionPayload, publishTeaCollection } =
           await import("../lib/ecosystems/tea.js");
-        const parentComponent = bomNSData.bomJson.metadata?.component || {};
+        const parentComponent =
+          getInternalBom(bomNSData).metadata?.component || {};
         const projectName =
           options.teaCollectionName ||
           parentComponent.name ||
@@ -2619,17 +2841,18 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       thoughtLog("BOM file is also available in .proto format!");
     }
   }
-  if (options.print && bomNSData.bomJson?.components) {
-    printSummary(bomNSData.bomJson);
+  if (options.print && getInternalBom(bomNSData)?.components) {
+    const printBom = getInternalBom(bomNSData);
+    printSummary(printBom);
     if (options.includeFormulation) {
-      printFormulation(bomNSData.bomJson);
+      printFormulation(printBom);
     }
-    printDependencyTree(bomNSData.bomJson);
-    printTable(bomNSData.bomJson);
+    printDependencyTree(printBom);
+    printTable(printBom);
     // CBOM related print
     if (options.includeCrypto) {
-      printTable(bomNSData.bomJson, ["cryptographic-asset"]);
-      printDependencyTree(bomNSData.bomJson, "provides");
+      printTable(printBom, ["cryptographic-asset"]);
+      printDependencyTree(printBom, "provides");
     }
   }
   if (isDryRun || DEBUG_MODE) {