@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/stages/postgen/specVersionCompat.js

@@ -27,6 +27,8 @@ import {
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../../inventory/bomUtils.js";
+import { CDX20_INTERNAL_SECTIONS_KEY } from "../../inventory/cyclonedx20.js";
+import { markInternalModel } from "../../inventory/cyclonedx20ReadContext.js";
 
 const COMPONENT_1_6_ONLY_FIELDS = new Set([
   "authors",
@@ -115,9 +117,17 @@ function normalizeMetadataForSpecVersion(subject, specVersion) {
 }
 
 function normalizeBomForSpecVersion(subject, specVersion) {
+  if (!subject) {
+    return;
+  }
   if (specVersion < 1.7) {
     deleteFields(subject, BOM_1_7_ONLY_FIELDS);
   }
+  if (specVersion < 2) {
+    // 2.0-only sections ride through the internal model under this key
+    // (see lib/inventory/cyclonedx20.js); a 1.x document never serializes it.
+    delete subject[CDX20_INTERNAL_SECTIONS_KEY];
+  }
 }
 
 function normalizeDependencyForSpecVersion(subject, specVersion) {
@@ -713,6 +723,9 @@ export function applySpecVersionCompatibility(bomJson, options) {
     downgradeSubjectForSpecVersion(bomJson, specVersion);
   } else if (isCycloneDx20SpecVersion(specVersion)) {
     upgradeSubjectForSpecVersion(bomJson, specVersion);
+    // The result is the 1.x-shaped model labelled 2.0, not a 2.0 document;
+    // the mark tells loadBomForAnalysis not to read it as one.
+    markInternalModel(bomJson);
   }
   return setCycloneDxFormat(bomJson, normalizedSpecVersion);
 }
@@ -763,3 +776,66 @@ export function diffRemovedFieldPaths(sourceBomJson, normalizedBomJson) {
     .filter((path) => !retainedPaths.has(path))
     .sort();
 }
+
+/**
+ * Count the leaf values of a JSON document as `path=value` strings, using
+ * the dotted, index-free paths of collectFieldPaths. Array order is ignored,
+ * so two documents that differ only in member order give the same counts,
+ * but a repeated entry counts once per occurrence. Empty arrays and objects
+ * count as leaves.
+ *
+ * @param {*} subject JSON value
+ * @param {string} [prefix] Path so far
+ * @param {Map<string, number>} [leaves] Accumulator
+ * @returns {Map<string, number>} Occurrences of each `path=value` string
+ */
+export function collectLeafValues(subject, prefix = "", leaves = new Map()) {
+  const add = (leaf) => {
+    leaves.set(leaf, (leaves.get(leaf) || 0) + 1);
+  };
+  if (Array.isArray(subject)) {
+    if (!subject.length) {
+      add(`${prefix}=[]`);
+    }
+    for (const entry of subject) {
+      collectLeafValues(entry, prefix, leaves);
+    }
+    return leaves;
+  }
+  if (isObjectRecord(subject)) {
+    const entries = Object.entries(subject);
+    if (!entries.length) {
+      add(`${prefix}={}`);
+    }
+    for (const [key, value] of entries) {
+      collectLeafValues(value, prefix ? `${prefix}.${key}` : key, leaves);
+    }
+    return leaves;
+  }
+  if (subject !== undefined) {
+    add(`${prefix}=${JSON.stringify(subject)}`);
+  }
+  return leaves;
+}
+
+/**
+ * Report the leaf values of `sourceBomJson` that `convertedBomJson` lacks,
+ * ignoring member order (see collectLeafValues). A value the source holds
+ * more often than the output is reported once for every missing occurrence,
+ * so dropping one of two identical entries counts.
+ *
+ * @param {Object} sourceBomJson BOM before conversion
+ * @param {Object} convertedBomJson BOM after conversion
+ * @returns {string[]} Sorted `path=value` strings missing from the output,
+ *   repeated per missing occurrence
+ */
+export function diffMissingLeafValues(sourceBomJson, convertedBomJson) {
+  const retained = collectLeafValues(convertedBomJson);
+  const missing = [];
+  for (const [leaf, count] of collectLeafValues(sourceBomJson)) {
+    for (let i = retained.get(leaf) || 0; i < count; i++) {
+      missing.push(leaf);
+    }
+  }
+  return missing.sort();
+}

package/lib/stages/pregen/envAudit.js

@@ -110,6 +110,7 @@ const JVM_PROJECT_TYPES = new Set([
   "java24",
   "java25",
   "java26",
+  "java27",
   "jvm",
   "kt",
   "kotlin",

package/lib/stages/pregen/pregen.js

@@ -29,6 +29,8 @@ import {
 } from "../../core/fs.js";
 import { isMac, isWin } from "../../core/paths.js";
 import { isProjectToolingAllowed } from "../../core/projectTooling.js";
+import { recordToolVersion } from "../../core/toolRegistry.js";
+import { collectProjectRubyDeclarations } from "../../ecosystems/rubyutils.js";
 import {
   dosaiDotnetRequirement,
   dosaiDotnetRequirementAdvice,
@@ -45,6 +47,7 @@ import {
   installSdkmanTool,
   isNvmAvailable,
   isRbenvAvailable,
+  isRubyVersionActive,
   isSdkmanAvailable,
   isSdkmanToolAvailable,
   performBundleInstall,
@@ -65,6 +68,7 @@ import {
   readSbtBuildPropertiesVersion,
   readToolVersionEnvHint,
   readToolVersionOverride,
+  resolveGradleVersionForJava,
   resolvePartialVersion,
 } from "../../inventory/jvmToolEnv.js";
 import { resolvePluginBinary } from "../../inventory/plugins.js";
@@ -316,6 +320,27 @@ const JVM_TOOL_DEFAULT_PREFIXES = {
   maven: "3.9",
 };
 
+/**
+ * JDK major a versioned java project type names, such as 27 for `java27`.
+ *
+ * @param {string} projectType Project type
+ * @returns {number|undefined} The major, or undefined for any other type
+ */
+export function javaMajorFromProjectType(projectType) {
+  if (typeof projectType !== "string" || !projectType.startsWith("java")) {
+    return undefined;
+  }
+  const major = Number.parseInt(projectType.slice(4), 10);
+  return Number.isInteger(major) && `java${major}` === projectType
+    ? major
+    : undefined;
+}
+
+/** Command each provisioned sdkman candidate is invoked as. */
+const JVM_TOOL_COMMANDS = {
+  maven: "mvn",
+};
+
 /** sdkman candidates cdxgen can provision for JVM builds. */
 const JVM_BUILD_TOOLS = ["maven", "gradle", "sbt", "scala"];
 
@@ -400,10 +425,26 @@ export function prepareJvmBuildEnv(filePath, options) {
     return;
   }
   // Resolve partial versions (e.g. maven3.9 -> 3.9.16) before touching the JDK
-  // so the compatibility matrix sees the real versions.
+  // so the compatibility matrix sees the real versions. The Gradle default
+  // install is constrained by the JDK the project declared or asked for, so a
+  // Java 27 project never gets a Gradle that cannot run on it.
+  // A versioned java type counts even without an sdkman alias: java27 has
+  // none until the broker serves a Java 27 build, but the project still asked
+  // for that JDK.
+  const explicitJavaMajor = Math.max(
+    0,
+    ...(options.projectType || []).map((pt) =>
+      SDKMAN_JAVA_TOOL_ALIASES[pt]
+        ? extractJavaMajor(SDKMAN_JAVA_TOOL_ALIASES[pt]) || 0
+        : javaMajorFromProjectType(pt) || 0,
+    ),
+  );
+  const gradleJavaMajor =
+    Math.max(detected.javaVersionHint || 0, explicitJavaMajor || 0) ||
+    undefined;
   const resolvedPins = [];
   for (const pin of installPins) {
-    const resolved = resolveJvmToolPinVersion(pin);
+    const resolved = resolveJvmToolPinVersion(pin, gradleJavaMajor);
     if (resolved) {
       resolvedPins.push(resolved);
     }
@@ -422,6 +463,11 @@ export function prepareJvmBuildEnv(filePath, options) {
     const installed = provisionJvmTool(pin, options);
     if (installed) {
       setJvmToolCommandEnv(pin);
+      if (pin.version) {
+        // The resolved version is already known, so metadata.tools can carry
+        // it without spawning another probe, once the tool runs (issue #598).
+        recordToolVersion(JVM_TOOL_COMMANDS[pin.tool] || pin.tool, pin.version);
+      }
       if (pin.source === "cli") {
         pinnedToolSelected = true;
       }
@@ -731,11 +777,14 @@ function recordDetectedJvmPins(installPins, wrapperVersions) {
  * and to pick defaults.
  *
  * @param {Object} pin `{ tool, version?, source }`
+ * @param {Number|undefined} javaMajor JDK major the project declared or
+ *   configured, when known. Constrains the default Gradle install so a
+ *   project on a new JDK never resolves a Gradle that cannot run on it.
  *
  * @returns {Object|undefined} Pin with an exact version, or undefined when no
  *   version could be determined.
  */
-export function resolveJvmToolPinVersion(pin) {
+export function resolveJvmToolPinVersion(pin, javaMajor) {
   if (pin.version && isSdkmanToolAvailable(pin.tool, pin.version)) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "java",
@@ -766,20 +815,30 @@ export function resolveJvmToolPinVersion(pin) {
     return undefined;
   }
   const prefix = pin.version || JVM_TOOL_DEFAULT_PREFIXES[pin.tool] || "";
-  const resolved = resolvePartialVersion(versionList, prefix);
+  const resolved =
+    pin.tool === "gradle" && !pin.version
+      ? resolveGradleVersionForJava(versionList, javaMajor)
+      : resolvePartialVersion(versionList, prefix);
   if (!resolved) {
     if (pin.version) {
       return pin;
     }
+    const gradleMinimum =
+      pin.tool === "gradle"
+        ? minimumGradleVersionForJava(javaMajor)
+        : undefined;
+    const missingDetail = gradleMinimum
+      ? `No stable gradle version at or above ${gradleMinimum}, the first that runs on Java ${javaMajor}, is listed by sdkman.`
+      : `No stable ${pin.tool} version matched the default prefix '${prefix}'.`;
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISSING, {
       ecosystem: "java",
       tool: pin.tool,
-      wanted: prefix,
+      wanted: gradleMinimum ? `>=${gradleMinimum}` : prefix,
       source: "sdkman",
-      detail: `No stable ${pin.tool} version matched the default prefix '${prefix}'.`,
+      detail: missingDetail,
     });
     console.log(
-      `No stable ${pin.tool} version matched the default prefix '${prefix}'. Pass an exact version identifier via -t ${pin.tool}<version>.`,
+      `${missingDetail} Pass an exact version identifier via -t ${pin.tool}<version>.`,
     );
     return undefined;
   }
@@ -1582,6 +1641,17 @@ export function prepareSwiftEnv(filePath, options) {
  * @param {String} filePath Path
  * @param {Object} options CLI Options
  */
+// The order pregen reads the Ruby to install in.
+const PREGEN_RUBY_SOURCE_ORDER = [
+  ".ruby-version",
+  ".tool-versions",
+  "mise.toml",
+  ".mise.toml",
+  ".config/mise.toml",
+  "Gemfile.lock",
+  "Gemfile",
+];
+
 export function prepareRubyEnv(filePath, options) {
   // Skip preparation early
   if (
@@ -1627,53 +1697,39 @@ export function prepareRubyEnv(filePath, options) {
     readEnvironmentVariable("GEM_HOME") ||
     safeMkdtempSync(join(getTmpDir(), "cdxgen-gem-home-"));
   process.env.CDXGEN_GEM_HOME = cdxgenGemHome;
-  // Is there a .ruby-version file in the project?
-  if (safeExistsSync(join(filePath, ".ruby-version"))) {
-    rubyVersionNeeded = readFileSync(join(filePath, ".ruby-version"), {
-      encoding: "utf-8",
-    })
-      .trim()
-      .replace("ruby-", "");
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: ".ruby-version",
-        path: join(filePath, ".ruby-version"),
-      });
-    }
-  } else if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
-    // Is there a lock file that can be used to identify the needed Ruby version?
+  // The Ruby to install is the one developers select: .ruby-version, then the
+  // asdf and mise pins, then the Ruby the lockfile was resolved with, then the
+  // Gemfile directive. Only an exact MRI version can be installed with rbenv.
+  const declarations = collectProjectRubyDeclarations(filePath);
+  for (const declaration of declarations) {
+    recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
+      ecosystem: "ruby",
+      tool: declaration.engine === "ruby" ? "ruby" : declaration.engine,
+      wanted: declaration.version || declaration.requirement,
+      source: declaration.source,
+      path: declaration.path,
+    });
+  }
+  const installable = PREGEN_RUBY_SOURCE_ORDER.map((source) =>
+    declarations.find(
+      (declaration) => declaration.source === source && declaration.version,
+    ),
+  ).find(Boolean);
+  if (installable && installable.engine !== "ruby") {
+    console.log(
+      `This project selects ${installable.engine} ${installable.version} (${installable.source}). cdxgen installs only MRI Ruby with rbenv; build the project with ${installable.engine} first and then invoke cdxgen with the arguments "--lifecycle pre-build".`,
+    );
+  } else if (installable?.prerelease) {
+    console.log(
+      `This project was locked with a pre-release of Ruby ${installable.version}, whose tag the lockfile does not record. Install it before invoking cdxgen.`,
+    );
+  } else if (installable) {
+    rubyVersionNeeded = installable.version;
+  }
+  if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
     const gemlockData = readFileSync(join(filePath, "Gemfile.lock"), {
       encoding: "utf-8",
     });
-    let rubyVersionMarker = false;
-    for (let l of gemlockData.split("\n")) {
-      l = l.replaceAll("\r", "").trim();
-      if (l.includes("RUBY VERSION")) {
-        rubyVersionMarker = true;
-      }
-      if (rubyVersionMarker && l.includes("ruby ")) {
-        const possibleVersion = l
-          .split("ruby ")
-          .pop()
-          .split("p")[0]
-          .split("d")[0];
-        if (/^\d+/.test(possibleVersion)) {
-          rubyVersionNeeded = possibleVersion;
-          break;
-        }
-      }
-    }
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: "Gemfile.lock",
-      });
-    }
     const bundlerVersion = parseGemfileLockBundlerVersion(gemlockData);
     if (bundlerVersion) {
       recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
@@ -1683,7 +1739,8 @@ export function prepareRubyEnv(filePath, options) {
         source: "Gemfile.lock",
       });
     }
-  } else {
+  }
+  if (!installable) {
     // Is the user invoking with a ruby with custom version type. Eg: -t ruby2.5.4
     let projectTypes = options.projectType;
     if (
@@ -1716,13 +1773,13 @@ export function prepareRubyEnv(filePath, options) {
   const existingRuby = collectRubyInfo(filePath);
   if (
     rubyVersionNeeded &&
-    existingRuby?.version?.startsWith(`ruby ${rubyVersionNeeded} `)
+    isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
       detail: `The active interpreter is the required Ruby ${rubyVersionNeeded}.`,
     });
@@ -1754,15 +1811,15 @@ export function prepareRubyEnv(filePath, options) {
     });
   } else if (
     rubyVersionNeeded &&
-    !existingRuby.version.startsWith(`ruby ${rubyVersionNeeded} `)
+    !isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISMATCH, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
-      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.version}.`,
+      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.description || existingRuby.version}.`,
     });
   }
   if (rubyVersionNeeded && !rbenvPresent) {

package/lib/validator/bomValidator.js

@@ -55,11 +55,18 @@ const compileSchemaValidator = (specVersion) => {
     const ajv = new Ajv2020(AJV_OPTIONS);
     useLinearUniqueItems(ajv);
     addCycloneDxFormats(ajv);
+    // The 2.0 draft pins its own cryptography definitions; the 1.7 schema
+    // keeps reading data/cryptography-defs.schema.json below.
     addDraft2020BundledSchema(
       ajv,
-      readJsonSchema("cryptography-defs.schema.json"),
+      readJsonSchema("cyclonedx-2.0-cryptography-defs.schema.json"),
       "https://cyclonedx.org/schema/cryptography-defs.schema.json",
     );
+    addDraft2020BundledSchema(
+      ajv,
+      readJsonSchema("behavior-taxonomy.schema.json"),
+      "https://cyclonedx.org/schema/behavior-taxonomy.schema.json",
+    );
     addDraft2020BundledSchema(
       ajv,
       readJsonSchema("jsf-0.82.schema.json"),
@@ -263,10 +270,12 @@ const getSpdxExportSchemaValidator = () => {
  * Validate the generated bom using jsonschema
  *
  * @param {object} bomJson content
+ * @param {object} [options] Validation options
+ * @param {boolean} [options.deep] Run the deep validators after the schema check. Defaults to true.
  *
  * @returns {Promise<Boolean>} true if the BOM is valid. false otherwise.
  */
-export const validateBom = async (bomJson) => {
+export const validateBom = async (bomJson, options = {}) => {
   if (!bomJson) {
     return true;
   }
@@ -292,6 +301,9 @@ export const validateBom = async (bomJson) => {
     console.log(validate.errors);
     return false;
   }
+  if (options.deep === false) {
+    return true;
+  }
   // Deep validation tests
   return (
     validateMetadata(bomJson) &&

package/lib/validator/complianceEngine.js

@@ -1,6 +1,6 @@
 /**
- * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA) and
- * aggregates results into per-benchmark scorecards.
+ * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA + CISA)
+ * and aggregates results into per-benchmark scorecards.
  *
  * This module is deliberately independent of the CycloneDX BOM audit engine
  * (lib/stages/postgen/auditBom.js). The two engines share similar *Finding*
@@ -9,6 +9,8 @@
 
 import {
   getAllComplianceRules,
+  getCisaAiRules,
+  getCisaRules,
   getCraRules,
   getScvsRules,
 } from "./complianceRules.js";
@@ -63,6 +65,25 @@ const BENCHMARKS = {
     filter: (rules) => rules.filter((r) => r.standard === "CRA"),
     levelPredicate: () => true,
   },
+  cisa: {
+    id: "cisa",
+    name: "CISA 2026 minimum elements for an SBOM",
+    standard: "CISA",
+    // The AI element rules share the CISA standard key but form their own
+    // benchmark, so both filters select by category.
+    filter: (rules) =>
+      rules.filter(
+        (r) => r.standard === "CISA" && r.category === "compliance-cisa",
+      ),
+    levelPredicate: () => true,
+  },
+  "cisa-ai": {
+    id: "cisa-ai",
+    name: "CISA and G7 minimum elements for an AI SBOM",
+    standard: "CISA",
+    filter: (rules) => rules.filter((r) => r.category === "compliance-cisa-ai"),
+    levelPredicate: () => true,
+  },
 };
 
 /**
@@ -238,4 +259,10 @@ export function buildBenchmarkReports(findings, requestedAliases) {
   return aliases.map((b) => scoreBenchmark(b, findings));
 }
 
-export { getAllComplianceRules, getCraRules, getScvsRules };
+export {
+  getAllComplianceRules,
+  getCisaAiRules,
+  getCisaRules,
+  getCraRules,
+  getScvsRules,
+};