@cdxgen/cdxgen 13.5.0 → 13.7.0

package/data/license-aliases.json

@@ -18,8 +18,6 @@
   "httpsopensourceorglicenseapache20": "Apache-2.0",
   "httpwwwapacheorglicenseslicense20html": "Apache-2.0",
   "zeroclausebsd": "0BSD",
-  "newbsdlicense": "BSD-3-Clause",
-  "newbsd": "BSD-3-Clause",
   "bsd2clause": "BSD-2-Clause",
   "bsd2clauselicense": "BSD-2-Clause",
   "thebsd2clauselicense": "BSD-2-Clause",
@@ -30,11 +28,13 @@
   "thebsd3clauselicense": "BSD-3-Clause",
   "bsd3clauseneworrevisedlicensebsd3clause": "BSD-3-Clause",
   "eclipsedistributionlicensenewbsdlicense": "BSD-3-Clause",
+  "newbsdlicense": "BSD-3-Clause",
   "modifiedbsdlicense": "BSD-3-Clause",
   "revisedbsd": "BSD-3-Clause",
   "revisedbsdlicense": "BSD-3-Clause",
   "thenewbsdlicense": "BSD-3-Clause",
   "3clausebsdlicense": "BSD-3-Clause",
+  "newbsd": "BSD-3-Clause",
   "bsd4clause": "BSD-4-Clause",
   "bsd4clauselicense": "BSD-4-Clause",
   "thebsd4clauselicense": "BSD-4-Clause",
@@ -258,6 +258,8 @@
   "aswfdigitalassetslicenseversion10": "ASWF-Digital-Assets-1.0",
   "aswfdigitalassets11": "ASWF-Digital-Assets-1.1",
   "aswfdigitalassetslicense11": "ASWF-Digital-Assets-1.1",
+  "atcgame": "atc-game",
+  "atcgamelicense": "atc-game",
   "baekmuk": "Baekmuk",
   "baekmuklicense": "Baekmuk",
   "bahyph": "Bahyph",
@@ -309,6 +311,8 @@
   "bsd2clausepluspatentlicense": "BSD-2-Clause-Patent",
   "bsd2clausepkgconfdisclaimer": "BSD-2-Clause-pkgconf-disclaimer",
   "bsd2clausepkgconfdisclaimervariant": "BSD-2-Clause-pkgconf-disclaimer",
+  "bsd2clauseposunchanged": "BSD-2-Clause-pos-unchanged",
+  "bsd2clausepositionunchangedvariant": "BSD-2-Clause-pos-unchanged",
   "bsd2clauseviews": "BSD-2-Clause-Views",
   "bsd2clausewithviewssentence": "BSD-2-Clause-Views",
   "bsd3clauseneworrevisedlicense": "BSD-3-Clause",
@@ -331,6 +335,8 @@
   "bsd3clausenonuclearwarranty": "BSD-3-Clause-No-Nuclear-Warranty",
   "bsd3clauseopenmpi": "BSD-3-Clause-Open-MPI",
   "bsd3clauseopenmpivariant": "BSD-3-Clause-Open-MPI",
+  "bsd3clauseopenwebui": "BSD-3-Clause-OpenWebUI",
+  "bsd3clauseopenwebuivariant": "BSD-3-Clause-OpenWebUI",
   "bsd3clausesun": "BSD-3-Clause-Sun",
   "bsd3clausesunmicrosystems": "BSD-3-Clause-Sun",
   "bsd3clausetso": "BSD-3-Clause-Tso",
@@ -345,6 +351,7 @@
   "bsd43tahoelicense": "BSD-4.3TAHOE",
   "bsdadvertisingacknowledgement": "BSD-Advertising-Acknowledgement",
   "bsdadvertisingacknowledgementlicense": "BSD-Advertising-Acknowledgement",
+  "bsdasktoendorse": "BSD-ask-to-endorse",
   "bsdattributionhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdwithattributionandhpnddisclaimer": "BSD-Attribution-HPND-disclaimer",
   "bsdinfernonettverk": "BSD-Inferno-Nettverk",
@@ -352,10 +359,14 @@
   "bsdmarkmodificationslicense": "BSD-Mark-Modifications",
   "bsdprotection": "BSD-Protection",
   "bsdprotectionlicense": "BSD-Protection",
+  "bsdsourcealtgpl": "BSD-Source-alt-GPL",
+  "bsdsourcecodeattributiongplalternative": "BSD-Source-alt-GPL",
   "bsdsourcebeginningfile": "BSD-Source-beginning-file",
   "bsdsourcecodeattributionbeginningoffilevariant": "BSD-Source-beginning-file",
   "bsdsourcecode": "BSD-Source-Code",
   "bsdsourcecodeattribution": "BSD-Source-Code",
+  "bsdsourcecodenodisclaimer": "BSD-Source-Code-no-disclaimer",
+  "bsdsourcecodeattributionnodisclaimer": "BSD-Source-Code-no-disclaimer",
   "bsdsystemics": "BSD-Systemics",
   "systemicsbsdvariantlicense": "BSD-Systemics",
   "bsdsystemicsw3works": "BSD-Systemics-W3Works",
@@ -364,6 +375,8 @@
   "boostsoftwarelicense10": "BSL-1.0",
   "buddy": "Buddy",
   "buddylicense": "Buddy",
+  "bugroff": "Bugroff",
+  "bugrofflicense": "Bugroff",
   "busl11": "BUSL-1.1",
   "businesssourcelicense11": "BUSL-1.1",
   "bzip2105": "bzip2-1.0.6",
@@ -420,6 +433,8 @@
   "creativecommonsattributionnoncommercial30unported": "CC-BY-NC-3.0",
   "ccbync30de": "CC-BY-NC-3.0-DE",
   "creativecommonsattributionnoncommercial30germany": "CC-BY-NC-3.0-DE",
+  "ccbync30igo": "CC-BY-NC-3.0-IGO",
+  "creativecommonsattributionnoncommercial30igo": "CC-BY-NC-3.0-IGO",
   "ccbync40": "CC-BY-NC-4.0",
   "creativecommonsattributionnoncommercial40international": "CC-BY-NC-4.0",
   "ccbyncnd10": "CC-BY-NC-ND-1.0",
@@ -657,6 +672,8 @@
   "fuzzybitmaplicense": "FBM",
   "fdkaac": "FDK-AAC",
   "fraunhoferfdkaaccodeclibrary": "FDK-AAC",
+  "fdkmpegh": "FDK-MPEG-H",
+  "fraunhoferfdkmpeghsoftware": "FDK-MPEG-H",
   "fergusontwofish": "Ferguson-Twofish",
   "fergusontwofishlicense": "Ferguson-Twofish",
   "frameworx10": "Frameworx-1.0",
@@ -795,6 +812,8 @@
   "hidapilicense": "HIDAPI",
   "hippocratic21": "Hippocratic-2.1",
   "hippocraticlicense21": "Hippocratic-2.1",
+  "hippocratic30core": "Hippocratic-3.0-core",
+  "hippocraticlicense30": "Hippocratic-3.0-core",
   "hp1986": "HP-1986",
   "hewlettpackard1986license": "HP-1986",
   "hp1989": "HP-1989",
@@ -873,6 +892,8 @@
   "imlib2license": "Imlib2",
   "infozip": "Info-ZIP",
   "infoziplicense": "Info-ZIP",
+  "informatica": "Informatica",
+  "informaticalicense": "Informatica",
   "innernet20": "Inner-Net-2.0",
   "innernetlicensev20": "Inner-Net-2.0",
   "innosetup": "InnoSetup",
@@ -1660,6 +1681,7 @@
   "shl21": "SHL-2.1",
   "solderpadhardwarelicensev21": "SHL-2.1",
   "simplelibraryusageexception": "Simple-Library-Usage-exception",
+  "spellingproviderlgplexception": "Spelling-Provider-LGPL-exception",
   "sqlitestudioopensslexception": "sqlitestudio-OpenSSL-exception",
   "stunnelexception": "stunnel-exception",
   "swiexception": "SWI-exception",

package/data/pqc-migration.json

@@ -0,0 +1,239 @@
+{
+  "$comment": "Post-quantum migration facts for cryptographic assets (cdxgen/cdxgen#4592). Each class cites the table or section its dates and members come from: NIST IR 8547 (final, October 2026), https://csrc.nist.gov/pubs/ir/8547/final, and, for DSA, FIPS 186-5. lib/inventory/pqcMigration.js classifies an asset by algorithmFamily, then OID, then normalised name (lower case, letters and digits only), and turns the class into a risks.risks[] entry. The likelihood and impact levels are cdxgen's fixed rating per class, not values from the IR; docs/CDX_CONVERT.md (CycloneDX 2.0, post-quantum migration risks) documents them, and docs/CUSTOM_PROPERTIES.md the cdx:crypto:pqc:* properties.",
+  "source": {
+    "document": "NIST IR 8547 (final, October 2026)",
+    "url": "https://csrc.nist.gov/pubs/ir/8547/final"
+  },
+  "$excludedNote": "Not classified, because IR 8547 Tables 2 and 4 do not list them: RSAES-PKCS1 (SP 800-56B specifies RSA key transport with OAEP and KTS, not PKCS #1 v1.5 encryption) and X3DH (a Signal protocol, not an SP 800-56A scheme). Quantum-safe per IR 8547 Tables 3 and 5-8, so no risk: ML-DSA, SLH-DSA, LMS/HSS, XMSS, ML-KEM, AES, Ascon, and SHA-2/SHA-3 members with at least 128 bits of collision strength.",
+  "unclassifiedPrimitives": [
+    "combiner"
+  ],
+  "$unclassifiedPrimitivesNote": "NIST IR 8547 Section 3.2.1: a hybrid (composite) key-establishment scheme combines the shared secrets of its component schemes and is approved when one input comes from an approved scheme, so a combiner is not classified by the OID of one of its inputs.",
+  "quantumSafeFamilies": [
+    "ML-DSA",
+    "SLH-DSA",
+    "LMS",
+    "XMSS",
+    "ML-KEM",
+    "AES",
+    "Ascon",
+    "SHA-2",
+    "SHA-3",
+    "HMAC",
+    "HKDF",
+    "KMAC"
+  ],
+  "minimumKeySizes": {
+    "$comment": "Smallest key size per key family with the 112 bits of classical security strength that IR 8547 Table 2 (ECDSA, RSA) and Table 4 (finite-field and elliptic-curve DH and MQV, RSA) list as the approved parameters. Key sizes for 112 bits: SP 800-57 Part 1 Rev. 5 Table 2 (RSA k = 2048, FFC L = 2048, ECC f = 224).",
+    "rsa": 2048,
+    "ff": 2048,
+    "ec": 224
+  },
+  "namedGroupKeySizes": {
+    "$comment": "Finite-field groups whose name carries no separate key size: the ffdhe groups of RFC 7919, whose modulus size is the number in the name.",
+    "ffdhe2048": 2048,
+    "ffdhe3072": 3072,
+    "ffdhe4096": 4096,
+    "ffdhe6144": 6144,
+    "ffdhe8192": 8192
+  },
+  "classes": {
+    "quantum-vulnerable-signature": {
+      "source": "NIST IR 8547 Table 2 (quantum-vulnerable digital signature algorithms): ECDSA and RSA at >= 112 bits, EdDSA at >= 128 bits of classical security strength [FIPS186]",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This digital signature algorithm is quantum-vulnerable; NIST IR 8547 Table 2 deprecates it after 2030 and disallows it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable digital signature algorithm listed in NIST IR 8547 Table 2: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {
+        "ECDSA": "ec",
+        "EdDSA": null,
+        "RSASSA-PKCS1": "rsa",
+        "RSASSA-PSS": "rsa",
+        "RSA-X931": "rsa"
+      },
+      "oids": {
+        "1.2.840.10045.4.1": "ec",
+        "1.2.840.10045.4.3.1": "ec",
+        "1.2.840.10045.4.3.2": "ec",
+        "1.2.840.10045.4.3.3": "ec",
+        "1.2.840.10045.4.3.4": "ec",
+        "1.3.101.112": null,
+        "1.3.101.113": null,
+        "1.2.840.113549.1.1.2": "rsa",
+        "1.2.840.113549.1.1.3": "rsa",
+        "1.2.840.113549.1.1.4": "rsa",
+        "1.2.840.113549.1.1.5": "rsa",
+        "1.2.840.113549.1.1.10": "rsa",
+        "1.2.840.113549.1.1.11": "rsa",
+        "1.2.840.113549.1.1.12": "rsa",
+        "1.2.840.113549.1.1.13": "rsa",
+        "1.2.840.113549.1.1.14": "rsa",
+        "1.2.840.113549.1.1.15": "rsa",
+        "1.2.840.113549.1.1.16": "rsa",
+        "2.16.840.1.101.3.4.3.9": "ec",
+        "2.16.840.1.101.3.4.3.10": "ec",
+        "2.16.840.1.101.3.4.3.11": "ec",
+        "2.16.840.1.101.3.4.3.12": "ec",
+        "2.16.840.1.101.3.4.3.13": "rsa",
+        "2.16.840.1.101.3.4.3.14": "rsa",
+        "2.16.840.1.101.3.4.3.15": "rsa",
+        "2.16.840.1.101.3.4.3.16": "rsa"
+      },
+      "names": {
+        "ecdsa": "ec",
+        "eddsa": null,
+        "ed25519": null,
+        "ed448": null,
+        "rsapss": "rsa",
+        "rsassapss": "rsa",
+        "rsassapkcs1": "rsa"
+      }
+    },
+    "quantum-vulnerable-key-establishment": {
+      "source": "NIST IR 8547 Table 4 (quantum-vulnerable key-establishment schemes): finite-field DH and MQV, elliptic-curve DH and MQV [SP80056A] and RSA [SP80056B], at >= 112 bits of classical security strength",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This key-establishment scheme is quantum-vulnerable; NIST IR 8547 Table 4 deprecates it after 2030 and disallows it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable key-establishment scheme listed in NIST IR 8547 Table 4: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {
+        "FFDH": "ff",
+        "MQV": "ff",
+        "ECDH": "ec",
+        "RSAES-OAEP": "rsa"
+      },
+      "oids": {
+        "1.2.840.10046.2.1": "ff",
+        "1.2.840.113549.1.3.1": "ff",
+        "1.3.132.1.12": "ec",
+        "1.3.132.1.13": "ec",
+        "1.3.101.110": null,
+        "1.3.101.111": null,
+        "1.2.840.113549.1.1.7": "rsa"
+      },
+      "names": {
+        "dh": "ff",
+        "ffdh": "ff",
+        "mqv": "ff",
+        "ecdh": "ec",
+        "ecmqv": "ec",
+        "x25519": null,
+        "x448": null,
+        "rsaoaep": "rsa",
+        "rsaesoaep": "rsa",
+        "ffdhe2048": "ff",
+        "ffdhe3072": "ff",
+        "ffdhe4096": "ff",
+        "ffdhe6144": "ff",
+        "ffdhe8192": "ff"
+      }
+    },
+    "quantum-vulnerable-public-key": {
+      "source": "NIST IR 8547 Table 2 (ECDSA, RSA [FIPS186]) and Table 4 (elliptic-curve DH and MQV [SP80056A], RSA [SP80056B]): the key algorithm alone does not say which use applies, and both tables give the same transition",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This public-key algorithm is quantum-vulnerable whether it signs (NIST IR 8547 Table 2) or establishes keys (Table 4); both tables deprecate it after 2030 and disallow it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable public-key algorithm listed in NIST IR 8547 Table 2 and Table 4: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {},
+      "oids": {
+        "1.2.840.113549.1.1.1": "rsa",
+        "1.2.840.10045.2.1": "ec"
+      },
+      "names": {
+        "rsa": "rsa",
+        "rsaencryption": "rsa",
+        "ec": "ec",
+        "ecpublickey": "ec",
+        "idecpublickey": "ec"
+      }
+    },
+    "below-minimum-strength": {
+      "source": "NIST IR 8547 Table 2 and Table 4 list only parameters with >= 112 bits of classical security strength; key sizes per SP 800-57 Part 1 Rev. 5 Table 2",
+      "transition": "Below the minimum strength of the currently approved parameters in NIST IR 8547 Table 2 and Table 4",
+      "riskName": "Key below the approved strength",
+      "statement": "This key is below the 112 bits of classical security strength that NIST IR 8547 Tables 2 and 4 list for the currently approved quantum-vulnerable public-key algorithms.",
+      "rationale": "{algorithm} uses a {size}-bit key, below the {minimum}-bit minimum (112 bits of classical security strength) of the parameters NIST IR 8547 Table 2 and Table 4 list.",
+      "likelihood": "very-high",
+      "impact": "major"
+    },
+    "hash-sha1": {
+      "source": "NIST IR 8547 Table 8 (hash functions and XOFs), footnote 4",
+      "transition": "Currently deprecated for all remaining technical applications; disallowed for use in FIPS-validated cryptographic modules after 2030",
+      "disallowedAfter": "2030",
+      "riskName": "Deprecated hash function",
+      "statement": "SHA-1 is currently deprecated for all remaining technical applications and will be disallowed for use in FIPS-validated cryptographic modules after 2030 (NIST IR 8547 Table 8, footnote 4).",
+      "rationale": "{algorithm} is SHA-1, whose collision security strength is below 80 bits (NIST IR 8547 Table 8); it is currently deprecated and disallowed in FIPS-validated modules after 2030.",
+      "likelihood": "high",
+      "impact": "moderate",
+      "families": {
+        "SHA-1": null
+      },
+      "oids": {
+        "1.3.14.3.2.26": null
+      },
+      "names": {
+        "sha1": null
+      }
+    },
+    "symmetric-112-bit": {
+      "source": "NIST IR 8547 Section 4.1.3 and Table 8: SHA-224, SHA-512/224 and SHA3-224 have 112 bits of collision security strength",
+      "transition": "Disallowed in 2030",
+      "disallowedIn": "2030",
+      "riskName": "112-bit security strength",
+      "statement": "This algorithm provides 112 bits of security; NIST IR 8547 section 4.1.3 says NIST's symmetric standards at the 112-bit security level will be disallowed in 2030.",
+      "rationale": "{algorithm} has 112 bits of collision security strength (NIST IR 8547 Table 8); section 4.1.3 says the 112-bit symmetric standards will be disallowed in 2030.",
+      "likelihood": "medium",
+      "impact": "moderate",
+      "families": {},
+      "oids": {
+        "2.16.840.1.101.3.4.2.4": null,
+        "2.16.840.1.101.3.4.2.5": null,
+        "2.16.840.1.101.3.4.2.7": null
+      },
+      "names": {
+        "sha224": null,
+        "sha512224": null,
+        "sha3224": null
+      }
+    },
+    "dsa-generation-not-approved": {
+      "source": "FIPS 186-5 (February 2023), section 4 (The Digital Signature Algorithm) and Appendix E: DSA is no longer approved for digital signature generation and may be used to verify signatures generated prior to the implementation date of FIPS 186-5; NIST IR 8547 Table 2 does not list it",
+      "url": "https://csrc.nist.gov/pubs/fips/186-5/final",
+      "transition": "No longer approved for digital signature generation; may be used only to verify signatures generated prior to the implementation date of FIPS 186-5",
+      "riskName": "Signature algorithm no longer approved",
+      "statement": "FIPS 186-5 no longer approves DSA for digital signature generation; DSA may be used only to verify signatures generated prior to the implementation date of FIPS 186-5 (section 4).",
+      "rationale": "{algorithm} is DSA, which FIPS 186-5 (section 4) no longer approves for digital signature generation; it may be used only to verify signatures generated prior to the implementation date of FIPS 186-5.",
+      "likelihood": "high",
+      "impact": "moderate",
+      "families": {
+        "DSA": null
+      },
+      "oids": {
+        "1.2.840.10040.4.1": null,
+        "1.2.840.10040.4.3": null,
+        "2.16.840.1.101.3.4.3.1": null,
+        "2.16.840.1.101.3.4.3.2": null,
+        "2.16.840.1.101.3.4.3.3": null,
+        "2.16.840.1.101.3.4.3.4": null,
+        "2.16.840.1.101.3.4.3.5": null,
+        "2.16.840.1.101.3.4.3.6": null,
+        "2.16.840.1.101.3.4.3.7": null,
+        "2.16.840.1.101.3.4.3.8": null
+      },
+      "names": {
+        "dsa": null
+      }
+    }
+  }
+}

package/data/remediations.json

@@ -167,6 +167,58 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "jvm.gradle.lockfile-only": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "The components came from Gradle dependency lockfiles, which record no dependency graph between them",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Let Gradle run to read the resolved dependency graph: drop --no-install-deps, and drop the gradle-prefer-lockfile flag or the GRADLE_PREFER_LOCKFILE variable if either is set."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.gradle.lockfile-only"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.gradle.verification-metadata-only": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "The components came from gradle/verification-metadata.xml, which records no dependency graph between them",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Let Gradle run to read the resolved dependency graph: drop --no-install-deps, and drop the gradle-prefer-lockfile flag or the GRADLE_PREFER_LOCKFILE variable if either is set."
+      },
+      {
+        "kind": "config",
+        "command": "Commit Gradle dependency lockfiles for a flat but resolved inventory: enable dependencyLocking and run 'gradle dependencies --write-locks'."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.gradle.verification-metadata-only"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
   "jvm.gradle.invocation-failed": {
     "ecosystem": "java",
     "kind": "command.failed",
@@ -431,6 +483,34 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "js.lockfile-unsafe-path": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "Secure mode omitted package-lock.json entries whose paths point outside the project",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Review the file: and link entries the warning names; remove any you did not add, and regenerate the lockfile with npm install --package-lock-only"
+      },
+      {
+        "kind": "config",
+        "command": "For trusted sibling file: or npm link dependencies, rerun outside secure mode on a trusted checkout to keep them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.lockfile-unsafe-path"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "js.pnpm-lock-unparseable": {
     "ecosystem": "npm",
     "kind": "evidence.degraded",
@@ -935,6 +1015,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
   },
+  "dosai.method-calls-capped": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The dosai report holds more distinct method calls than cdxgen keeps, so some occurrence evidence was dropped",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Raise the cap with CDXGEN_DOSAI_MAX_METHOD_CALLS, or write the report with dosai's --sections so it holds less."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.method-calls-capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -1282,6 +1386,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
   },
+  "ruby.host-probe.package-db-unreadable": {
+    "ecosystem": "ruby",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Ruby no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so Ruby files can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "ruby.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=ruby"
+  },
+  "npm.host-probe.package-db-unreadable": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the Node.js no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so node binaries can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "npm.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/OBOM_LESSONS"
+  },
   "php.composer.platform-unattributed": {
     "ecosystem": "php",
     "kind": "evidence.degraded",
@@ -1401,6 +1553,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "binary.brotli-probe.capped": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The Brotli decoder probe reached its file or byte cap, so some native files were not read for an embedded decoder",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Scan the image or root filesystem in smaller parts (for example one application directory at a time with -t rootfs), so every native file is read for an embedded Brotli decoder"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "binary.brotli-probe.capped"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/BOM_AUDIT?id=brotli-security"
+  },
   "os.apk-installed-db.unreadable": {
     "ecosystem": "generic",
     "kind": "evidence.degraded",

package/data/rules/ai-bom.yaml

@@ -330,7 +330,7 @@
     components[
       type = 'machine-learning-model'
       and $prop($, 'cdx:ai:artifactFormat') = 'onnx'
-      and not $hasProp($, 'cdx:onnx:producer')
+      and $not($hasProp($, 'cdx:onnx:producer'))
     ]
   location: |
     {