@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/ecosystems/parsers-rust.js

@@ -506,27 +506,55 @@ function resolveCargoWorkspaceDependencyTarget(
   ) {
     return workspaceMemberMap.get(resolvedDependencyName);
   }
-  const dependencyPath =
-    dependencyNode &&
-    typeof dependencyNode === "object" &&
-    typeof dependencyNode.path === "string" &&
-    dependencyNode.path
-      ? resolve(dirname(cargoTomlFile), dependencyNode.path, "Cargo.toml")
-      : undefined;
-  if (!dependencyPath || !safeExistsSync(dependencyPath)) {
+  if (
+    !dependencyNode ||
+    typeof dependencyNode !== "object" ||
+    typeof dependencyNode.path !== "string" ||
+    !dependencyNode.path
+  ) {
+    return undefined;
+  }
+  // A member cannot combine `workspace = true` with its own `path`, so a path
+  // on such an entry came from [workspace.dependencies], and Cargo reads it
+  // relative to the workspace root rather than to the member.
+  const pathBaseFile =
+    dependencyNode.workspace === true && workspaceContext?.workspaceRootFile
+      ? workspaceContext.workspaceRootFile
+      : cargoTomlFile;
+  const dependencyPath = resolve(
+    dirname(pathBaseFile),
+    dependencyNode.path,
+    "Cargo.toml",
+  );
+  if (!safeExistsSync(dependencyPath)) {
     return undefined;
   }
   const dependencyCargoData = readCargoTomlData(dependencyPath);
-  if (!dependencyCargoData) {
+  // A path dependency names a package; a virtual workspace root has none.
+  if (!dependencyCargoData?.package) {
     return undefined;
   }
+  // A path crate outside the current workspace inherits `*.workspace = true`
+  // fields from its own workspace, which resolveCargoWorkspaceContext finds by
+  // walking up from the crate. Handing it the current workspace would give
+  // the crate this workspace's version.
+  const workspaceRootDir = workspaceContext?.workspaceRootFile
+    ? resolve(dirname(workspaceContext.workspaceRootFile))
+    : undefined;
+  const dependencyDir = dirname(dependencyPath);
+  const isInsideWorkspace =
+    workspaceRootDir &&
+    (dependencyDir === workspaceRootDir ||
+      dependencyDir.startsWith(`${workspaceRootDir}${_sep}`));
   const dependencyIdentity = resolveCargoManifestPackageIdentity(
     dependencyPath,
     dependencyCargoData,
-    {
-      workspaceRootData: workspaceContext?.workspaceRootData,
-      workspaceRootFile: workspaceContext?.workspaceRootFile,
-    },
+    isInsideWorkspace
+      ? {
+          workspaceRootData: workspaceContext.workspaceRootData,
+          workspaceRootFile: workspaceContext.workspaceRootFile,
+        }
+      : {},
   );
   if (!dependencyIdentity?.name || !dependencyIdentity?.version) {
     return undefined;
@@ -656,6 +684,68 @@ function applyCargoDependencySpecMetadata(
   );
 }
 
+/**
+ * Version to record for a Cargo.toml dependency whose requirement is the only
+ * thing known about it.
+ *
+ * A Cargo requirement is not a version: `serde = "1.0"` means `^1.0`, and even
+ * `"1.0.94"` means `^1.0.94`. The component version is therefore left out
+ * unless the whole requirement is an exact `=X.Y.Z` pin (with an optional
+ * prerelease and build label), which is the one requirement Cargo resolves to
+ * a single version. `=1.0` is not exact, because Cargo reads it as
+ * `>=1.0.0,<1.1.0`.
+ *
+ * When the requirement is not the node's `version` key, it is a `git+`, `path+`
+ * or `workspace` fallback from normalizeCargoDependencyVersion, and it is kept
+ * as it stands so the dependency stays traceable to its source.
+ *
+ * @param {Object|String} dependencyNode Dependency entry from the manifest
+ * @param {String} requirement Requirement string from normalizeCargoDependencyVersion
+ * @returns {String|undefined} The pinned version, or undefined
+ */
+function cargoManifestComponentVersion(dependencyNode, requirement) {
+  if (
+    typeof dependencyNode === "object" &&
+    dependencyNode?.version !== requirement
+  ) {
+    return requirement;
+  }
+  const pin = requirement
+    .trim()
+    .match(/^=\s*(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/);
+  return pin ? pin[1] : undefined;
+}
+
+/**
+ * Version to record for a Cargo.toml dependency component once the dependency
+ * has been resolved to a crate on disk.
+ *
+ * A path dependency or a workspace dependency always builds against the
+ * version in the target crate's own `[package]` section; the requirement next
+ * to it (`local = { path = "local", version = "0.2" }`) matters only when the
+ * crate is published to a registry. Recording the resolved version keeps one
+ * component per crate: the manifest entry and the target's own manifest, which
+ * a recursive scan parses as well, then describe the same cargo purl and
+ * merge, instead of listing the crate once version-less and once resolved
+ * (issue #4719). The `cdx:cargo:path` property keeps the dependency
+ * traceable to its source.
+ *
+ * @param {Object|String} dependencyNode Dependency entry from the manifest
+ * @param {String} requirement Requirement string from normalizeCargoDependencyVersion
+ * @param {Object|undefined} resolvedTarget Identity of the resolved local crate
+ * @returns {String|undefined} The resolved version, or cargoManifestComponentVersion's answer
+ */
+function cargoManifestDependencyComponentVersion(
+  dependencyNode,
+  requirement,
+  resolvedTarget,
+) {
+  if (resolvedTarget?.version) {
+    return resolvedTarget.version;
+  }
+  return cargoManifestComponentVersion(dependencyNode, requirement);
+}
+
 function collectCargoManifestDependencyComponents(
   dependencyEntries,
   addPackageToList,
@@ -689,9 +779,21 @@ function collectCargoManifestDependencyComponents(
       continue;
     }
     const pkg = {
-      name: dependencyName,
-      version,
+      // A renamed local dependency (`alias = { path = "…", package = "real" }`)
+      // is the crate `real`; the alias only names it inside this manifest and
+      // stays on cdx:cargo:package. Keeping the alias with the resolved version
+      // would describe a crate that does not exist, or a different one on
+      // crates.io.
+      name: resolvedWorkspaceTarget?.name || dependencyName,
+      version: cargoManifestDependencyComponentVersion(
+        dependencyNode,
+        version,
+        resolvedWorkspaceTarget,
+      ),
     };
+    if (resolvedWorkspaceTarget?.group) {
+      pkg.group = resolvedWorkspaceTarget.group;
+    }
     applyCargoDependencySpecMetadata(
       pkg,
       dependencyNode,

package/lib/ecosystems/pythonutils.js

@@ -11,6 +11,7 @@ import {
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
+import { coerce, gte } from "semver";
 
 import {
   DEBUG_MODE,
@@ -25,6 +26,7 @@ import {
   PYPI_MODULE_PACKAGE_MAPPING,
   PYTHON_STD_MODULES,
 } from "../core/state.js";
+import { parseToml } from "../core/toml.js";
 import { findAppModules } from "../inventory/atomUtils.js";
 import { flattenDeps } from "../inventory/deps.js";
 import { pypiBomRef } from "../inventory/purl.js";
@@ -612,6 +614,128 @@ export function createUVLock(basePath, options) {
   }
 }
 
+const CONSTRAINT_OPERATORS = [">=", "<=", "==", "!=", "~=", ">", "<", "^", "="];
+const LOWER_BOUND_OPERATORS = new Set([">=", ">", "==", "~=", "^", "="]);
+
+/**
+ * Check whether a single version constraint puts the lower bound at version 2
+ * or higher.
+ *
+ * @param {string} constraint Constraint such as ">=2.0.0" or "<3.0.0"
+ * @returns {boolean} true when the constraint requires version 2 or newer
+ */
+function requiresVersion2(constraint) {
+  let operator = "";
+  let version = constraint.trim();
+  for (const candidate of CONSTRAINT_OPERATORS) {
+    if (version.startsWith(candidate)) {
+      operator = candidate;
+      version = version.slice(candidate.length).trim();
+      break;
+    }
+  }
+  if (!operator || !LOWER_BOUND_OPERATORS.has(operator)) {
+    return false;
+  }
+  const coerced = coerce(version);
+  return coerced !== null && gte(coerced, "2.0.0");
+}
+
+/**
+ * Check whether a build requirement names poetry-core with a lower bound of
+ * version 2 or higher.
+ *
+ * @param {string} requirement Build requirement such as "poetry-core>=2.0.0"
+ * @returns {boolean} true when poetry-core 2 or newer is required
+ */
+function requiresPoetryCore2(requirement) {
+  if (typeof requirement !== "string") {
+    return false;
+  }
+  const entry = requirement.trim().toLowerCase();
+  if (!entry.startsWith("poetry-core")) {
+    return false;
+  }
+  let spec = entry.slice("poetry-core".length);
+  if (spec.startsWith("[")) {
+    const extrasEnd = spec.indexOf("]");
+    if (extrasEnd === -1) {
+      return false;
+    }
+    spec = spec.slice(extrasEnd + 1);
+  }
+  const next = spec.charAt(0);
+  if (next && next !== " " && next !== "\t" && !"><=!~^".includes(next)) {
+    return false;
+  }
+  return spec
+    .trim()
+    .split(",")
+    .some((constraint) => requiresVersion2(constraint));
+}
+
+/**
+ * Check whether a pyproject.toml requires poetry-core 2 or newer to build.
+ *
+ * @param {string} pyprojectFile Path to pyproject.toml
+ * @returns {boolean} true when the project needs Poetry 2 or newer
+ */
+export function isPoetry2Project(pyprojectFile) {
+  if (!pyprojectFile || !safeExistsSync(pyprojectFile)) {
+    return false;
+  }
+  let config;
+  try {
+    config = parseToml(readFileSync(pyprojectFile, "utf-8"));
+  } catch (_err) {
+    return false;
+  }
+  const requires = config?.["build-system"]?.requires;
+  if (!Array.isArray(requires)) {
+    return false;
+  }
+  return requires.some((requirement) => requiresPoetryCore2(requirement));
+}
+
+/**
+ * Find the pyproject.toml belonging to a poetry trigger file.
+ *
+ * @param {string} triggerFile pyproject.toml or poetry.lock path
+ * @returns {string|null} Path to pyproject.toml, or null when there is none
+ */
+function findPoetryPyprojectFile(triggerFile) {
+  if (!triggerFile) {
+    return null;
+  }
+  if (triggerFile.endsWith("pyproject.toml")) {
+    return triggerFile;
+  }
+  if (triggerFile.endsWith("poetry.lock")) {
+    const sibling = join(dirname(triggerFile), "pyproject.toml");
+    return safeExistsSync(sibling) ? sibling : null;
+  }
+  return null;
+}
+
+/**
+ * Build the poetry install arguments for a poetry project.
+ *
+ * Poetry 2 installs only the main dependency group and no extras by default,
+ * so projects requiring poetry-core 2 or newer also get --all-groups and
+ * --all-extras. Callers prepend the python invocation such as -m poetry.
+ *
+ * @param {string} pyprojectFile pyproject.toml or poetry.lock path of the project
+ * @returns {string[]} poetry install arguments
+ */
+export function getPoetryInstallArgs(pyprojectFile) {
+  const args = ["install", "-n", "--no-root"];
+  const resolvedFile = findPoetryPyprojectFile(pyprojectFile);
+  if (resolvedFile && isPoetry2Project(resolvedFile)) {
+    args.push("--all-groups", "--all-extras");
+  }
+  return args;
+}
+
 /**
  * Execute pip freeze by creating a virtual env in a temp directory and construct the dependency tree
  *
@@ -742,7 +866,9 @@ export async function getPipFrozenTree(
         shell: isWin,
       });
       thoughtLog("Performing poetry install");
-      let poetryInstallArgs = ["-m", "poetry", "install", "-n", "--no-root"];
+      let poetryInstallArgs = ["-m", "poetry"].concat(
+        getPoetryInstallArgs(reqOrSetupFile),
+      );
       if (isSecureMode) {
         poetryInstallArgs.unshift("-S");
       }
@@ -756,7 +882,7 @@ export async function getPipFrozenTree(
           thoughtLog(
             "Hmm, poetry doesn't seem to be available as a module. Perhaps it was installed directly 🤔?",
           );
-          poetryInstallArgs = ["install", "-n", "--no-root"];
+          poetryInstallArgs = getPoetryInstallArgs(reqOrSetupFile);
           // Attempt to perform poetry install
           result = safeSpawnSync("poetry", poetryInstallArgs, {
             cwd: basePath,

package/lib/ecosystems/remote/huggingface.js

@@ -10,6 +10,10 @@ import {
   detectAiModelVariants,
   normalizeDetectedVariants,
 } from "../../inventory/aiModelVariants.js";
+import {
+  modelCreatorEntity,
+  modelCreatorFromOrganization,
+} from "../../inventory/aiProviders.js";
 import { getLicenses } from "../../inventory/spdx.js";
 import {
   createHuggingFaceComponentReference,
@@ -26,6 +30,7 @@ import {
   toHuggingFaceAssetPath,
   toHuggingFaceAssetUrl,
   toHuggingFacePurl,
+  toHuggingFaceSupplier,
 } from "../../parsers/huggingfaceUtils.js";
 
 const CACHE_MISS = Symbol("huggingface-cache-miss");
@@ -1191,6 +1196,23 @@ export async function fetchHuggingFaceAssetInventory(
         payload?.sha ||
         (revision !== "HEAD" ? revision : payload?.lastModified),
       purl,
+      // The repository namespace published the asset, so it is the
+      // supplier. Its url is the organisation or user page, not the
+      // repository. A model is credited to a creator as manufacturer only
+      // when the namespace is that creator's own organisation, since
+      // re-packagers publish models other organisations made.
+      supplier:
+        slashIndex > 0
+          ? toHuggingFaceSupplier(normalizedRepoId.slice(0, slashIndex))
+          : undefined,
+      manufacturer:
+        normalizedAssetType === "model" && slashIndex > 0
+          ? modelCreatorEntity(
+              modelCreatorFromOrganization(
+                normalizedRepoId.slice(0, slashIndex),
+              ),
+            )
+          : undefined,
       description:
         normalizedAssetType === "dataset"
           ? datasetDescriptionFromStats(payload)