@cyclonedx/cdxgen 10.4.2 → 10.4.3

package/README.md

@@ -80,7 +80,7 @@ For node.js projects, lock files are parsed initially, so the SBOM would include
 
 This attribute can be later used for various purposes. For example, [dep-scan](https://github.com/cyclonedx/dep-scan) uses this attribute to prioritize vulnerabilities. Unfortunately, tools such as dependency track, do not include this feature and might over-report the CVEs.
 
-By passing the argument `--required-only`, you can limit the SBOM only to include packages with the scope "required", commonly called production or non-dev dependencies. Combine with `--no-babel` to limit this list to only non-dev dependencies based on the `dev` attribute being false in the lock files.
+With the argument `--required-only`, you can limit the SBOM only to include packages with the scope "required", commonly called production or non-dev dependencies. Combine with `--no-babel` to limit this list to only non-dev dependencies based on the `dev` attribute being false in the lock files.
 
 For go, `go mod why` command is used to identify required packages. For php, composer lock file is parsed to distinguish required (packages) from optional (packages-dev).
 
@@ -98,18 +98,18 @@ If you are a [Homebrew](https://brew.sh/) user, you can also install [cdxgen](ht
 $ brew install cdxgen
 ```
 
-Deno install is also supported.
+Deno and bun runtime can be used with limited support.
 
 ```shell
 deno install --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid --allow-write --allow-net -n cdxgen "npm:@cyclonedx/cdxgen/cdxgen"
 ```
 
-You can also use the cdxgen container image
+You can also use the cdxgen container image with node, deno, or bun runtime versions.
+
+The default version uses Node.js 20
 
 ```bash
 docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /app/bom.json
-
-docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen:v8.6.0 -r /app -o /app/bom.json
 ```
 
 To use the deno version, use `ghcr.io/cyclonedx/cdxgen-deno` as the image name.
@@ -118,6 +118,12 @@ To use the deno version, use `ghcr.io/cyclonedx/cdxgen-deno` as the image name.
 docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen-deno -r /app -o /app/bom.json
 ```
 
+For the bun version, use `ghcr.io/cyclonedx/cdxgen-bun` as the image name.
+
+```bash
+docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen-bun -r /app -o /app/bom.json
+```
+
 In deno applications, cdxgen could be directly imported without any conversion. Please see the section on [integration as library](#integration-as-library)
 
 ```ts

package/analyzer.js

@@ -26,7 +26,6 @@ const IGNORE_DIRS = process.env.ASTGEN_IGNORE_DIRS
       "codemods",
       "flow-typed",
       "i18n",
-      "__tests__",
     ];
 
 const IGNORE_FILE_PATTERN = new RegExp(
@@ -54,6 +53,7 @@ const getAllFiles = (deep, dir, extn, files, result, regex) => {
       const dirName = basename(file);
       if (
         dirName.startsWith(".") ||
+        dirName.startsWith("__") ||
         IGNORE_DIRS.includes(dirName.toLowerCase())
       ) {
         continue;

package/bin/cdxgen.js

@@ -371,10 +371,13 @@ const applyAdvancedOptions = (options) => {
           "aab",
           "go",
           "golang",
+          "rust",
+          "rust-lang",
+          "cargo",
         ].includes(options.projectType)
       ) {
         console.log(
-          "PREVIEW: post-build lifecycle SBOM generation is supported only for android, dotnet, and go projects. Please specify the type using the -t argument.",
+          "PREVIEW: post-build lifecycle SBOM generation is supported only for android, dotnet, go, and Rust projects. Please specify the type using the -t argument.",
         );
         process.exit(1);
       }

package/binary.js

@@ -71,7 +71,7 @@ let CDXGEN_PLUGINS_DIR = process.env.CDXGEN_PLUGINS_DIR;
 if (
   !CDXGEN_PLUGINS_DIR &&
   existsSync(join(dirName, "plugins")) &&
-  existsSync(join(dirName, "plugins", "goversion"))
+  existsSync(join(dirName, "plugins", "trivy"))
 ) {
   CDXGEN_PLUGINS_DIR = join(dirName, "plugins");
 }
@@ -94,7 +94,7 @@ if (
       "@cyclonedx",
       `cdxgen-plugins-bin${pluginsBinSuffix}`,
       "plugins",
-      "goversion",
+      "trivy",
     ),
   )
 ) {

package/index.js

@@ -1030,13 +1030,12 @@ const buildBomNSData = (options, pkgInfo, ptype, context) => {
       components,
       dependencies,
     };
-    const formulationData = addFormulationSection(options);
-    const formulation =
+    const formulationData =
       options.includeFormulation && options.specVersion >= 1.5
-        ? formulationData.formulation
+        ? addFormulationSection(options)
         : undefined;
-    if (formulation) {
-      jsonTpl.formulation = formulation;
+    if (formulationData) {
+      jsonTpl.formulation = formulationData.formulation;
     }
     bomNSData.bomJson = jsonTpl;
     bomNSData.nsMapping = nsMapping;
@@ -3017,23 +3016,8 @@ export async function createRustBom(path, options) {
   } catch (err) {
     maybeBinary = false;
   }
-  if (maybeBinary) {
-    const cargoData = getCargoAuditableInfo(path);
-    const dlist = await parseCargoAuditableData(cargoData);
-    if (dlist?.length) {
-      pkgList = pkgList.concat(dlist);
-    }
-    // Since this pkg list is derived from the binary mark them as used.
-    const allImports = {};
-    for (const mpkg of pkgList) {
-      const pkgFullName = `${mpkg.group}/${mpkg.name}`;
-      allImports[pkgFullName] = true;
-    }
-    return buildBomNSData(options, pkgList, "cargo", {
-      allImports,
-      src: path,
-      filename: path,
-    });
+  if (maybeBinary || options.lifecycle === "post-build") {
+    return createBinaryBom(path, options);
   }
   let cargoLockFiles = getAllFiles(
     path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.4.2",
+  "version": "10.4.3",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -40,7 +40,6 @@
     "cdx-verify": "bin/verify.js"
   },
   "scripts": {
-    "docs": "docsify serve docs",
     "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --inject-globals false docker.test.js utils.test.js display.test.js postgen.test.js",
     "watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch --inject-globals false",
     "lint:check": "biome check *",
@@ -87,13 +86,13 @@
   "optionalDependencies": {
     "@appthreat/atom": "2.0.9",
     "@appthreat/cdx-proto": "1.0.1",
-    "@cyclonedx/cdxgen-plugins-bin": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-darwin-amd64": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-darwin-arm64": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-ppc64": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-windows-amd64": "^1.5.8",
-    "@cyclonedx/cdxgen-plugins-bin-windows-arm64": "^1.5.8",
+    "@cyclonedx/cdxgen-plugins-bin": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-arm64": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-darwin-amd64": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-darwin-arm64": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-ppc64": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-windows-amd64": "1.6.0",
+    "@cyclonedx/cdxgen-plugins-bin-windows-arm64": "1.6.0",
     "body-parser": "^1.20.2",
     "compression": "^1.7.4",
     "connect": "^3.7.0",
@@ -104,7 +103,6 @@
   "files": ["*.js", "bin/", "data/", "types/"],
   "devDependencies": {
     "@biomejs/biome": "1.7.0",
-    "docsify-cli": "^4.4.4",
     "jest": "^29.7.0",
     "typescript": "^5.4.5"
   }

package/utils.test.js

@@ -1534,7 +1534,7 @@ test("parse github actions workflow data", () => {
   dep_list = parseGitHubWorkflowData(
     readFileSync("./.github/workflows/repotests.yml", { encoding: "utf-8" }),
   );
-  expect(dep_list.length).toEqual(9);
+  expect(dep_list.length).toEqual(10);
   expect(dep_list[0]).toEqual({
     group: "actions",
     name: "checkout",
@@ -2220,8 +2220,8 @@ test("parsePkgLock v3", async () => {
     projectName: "cdxgen",
   });
   deps = parsedList.pkgList;
-  expect(deps.length).toEqual(1005);
-  expect(parsedList.dependenciesList.length).toEqual(1005);
+  expect(deps.length).toEqual(845);
+  expect(parsedList.dependenciesList.length).toEqual(845);
 });
 
 test("parseBowerJson", async () => {