@cyclonedx/cdxgen 10.2.4 → 10.2.5

package/index.js

@@ -4412,7 +4412,7 @@ export async function createCsharpBom(path, options) {
     }
   } else if (pkgLockFiles.length) {
     manifestFiles = manifestFiles.concat(pkgLockFiles);
-    let parentDependsOn = [];
+    const parentDependsOn = new Set();
     // packages.lock.json from nuget
     for (const af of pkgLockFiles) {
       if (DEBUG_MODE) {
@@ -4432,13 +4432,15 @@ export async function createCsharpBom(path, options) {
       // Keep track of the direct dependencies so that we can construct one complete
       // list after processing all lock files
       if (rootList && rootList.length) {
-        parentDependsOn = parentDependsOn.concat(rootList);
+        for (const p of rootList) {
+          parentDependsOn.add(p["bom-ref"]);
+        }
       }
     }
-    if (parentDependsOn.length) {
+    if (parentDependsOn.size) {
       dependencies.splice(0, 0, {
         ref: parentComponent["bom-ref"],
-        dependsOn: parentDependsOn.map((p) => p["bom-ref"])
+        dependsOn: Array.from(parentDependsOn)
       });
     }
   } else if (pkgConfigFiles.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.2.4",
+  "version": "10.2.5",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -825,19 +825,25 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
       // which isn't installed
       // Bug #795. At times, npm loses the integrity node completely and such packages are getting missed out
       // To keep things safe, we include these packages.
-      const edgeToIntegrity = edge.to ? edge.to.integrity : undefined;
-      if (!edgeToIntegrity) {
+      let edgeToIntegrityOrLocation = edge.to ? edge.to.integrity : undefined;
+      // Fallback to location based lookups when integrity is missing
+      if (!edgeToIntegrityOrLocation && edge.to && edge.to.location) {
+        edgeToIntegrityOrLocation = edge.to.location;
+      }
+      if (!edgeToIntegrityOrLocation) {
         // This hack is required to fix the package name
-        targetName = node.name.replace(/-cjs$/, "");
-        targetVersion = node.version;
-        foundMatch = true;
+        targetName = edge.name.replace(/-cjs$/, "");
+        foundMatch = false;
       } else {
         // the edges don't actually contain a version, so we need to search the root node
         // children to find the correct version. we check the node children first, then
         // we check the root node children
         for (const child of node.children) {
-          if (edgeToIntegrity) {
-            if (child[1].integrity == edgeToIntegrity) {
+          if (edgeToIntegrityOrLocation) {
+            if (
+              child[1].integrity === edgeToIntegrityOrLocation ||
+              child[1].location === edgeToIntegrityOrLocation
+            ) {
               targetName = child[0].replace(/node_modules\//g, "");
               // The package name could be different from the targetName retrieved
               // Eg: "string-width-cjs": "npm:string-width@^4.2.0",
@@ -853,7 +859,11 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
       }
       if (!foundMatch) {
         for (const child of rootNode.children) {
-          if (child[1].integrity == edgeToIntegrity) {
+          if (
+            edgeToIntegrityOrLocation &&
+            (child[1].integrity == edgeToIntegrityOrLocation ||
+              child[1].location == edgeToIntegrityOrLocation)
+          ) {
             targetName = child[0].replace(/node_modules\//g, "");
             targetVersion = child[1].version;
             // The package name could be different from the targetName retrieved
@@ -897,7 +907,6 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
       pkgList = pkgList.concat(childPkgList);
       dependenciesList = dependenciesList.concat(childDependenciesList);
     }
-
     dependenciesList.push({
       ref: decodeURIComponent(purlString),
       dependsOn: workspaceDependsOn
@@ -6024,11 +6033,15 @@ export function parseCsPkgLockData(csLockData, pkgLockFile) {
       const dependsOn = [];
       if (libData.dependencies) {
         for (const adep of Object.keys(libData.dependencies)) {
+          // get the resolved version of the dependency
+          const adepResolvedVersion =
+            assetData.dependencies[aversion][adep].resolved;
+
           const adpurl = new PackageURL(
             "nuget",
             "",
             adep,
-            libData.dependencies[adep],
+            adepResolvedVersion,
             null,
             null
           ).toString();