@cyclonedx/cdxgen 10.5.2 → 10.6.1

package/README.md

@@ -10,12 +10,16 @@
 
 ![cdxgen logo](./docs/_media/cdxgen.png)
 
-cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create a valid and compliant [CycloneDX][cyclonedx-homepage] Bill of Materials (BOM) containing an aggregate of all project dependencies for C/C++, Node.js, PHP, Python, Ruby, Rust, Java, .Net, Dart, Haskell, Elixir, and Go projects in JSON format. CycloneDX is a full-stack BOM specification that is easily created, human and machine-readable, and simple to parse. The tool supports CycloneDX specification versions from 1.4 - 1.6.
+cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create a valid and compliant [CycloneDX][cyclonedx-homepage] Bill of Materials (BOM) containing an aggregate of all project dependencies in JSON format. CycloneDX is a full-stack BOM specification that is easily created, human and machine-readable, and simple to parse. The tool supports CycloneDX specification versions from 1.4 - 1.6.
 
-When used with plugins:
+Supported BOM formats:
 
-- cdxgen could generate an OBOM for Linux docker images and even VMs running Linux or Windows operating systems
-- cdxgen also includes an evinse tool to generate component evidence, CBOM, and SaaSBOM for some languages
+- Software (SBOM) - For many languages and container images.
+- Cryptography (CBOM) - For Java and Python projects.
+- Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.
+- Software-as-a-Service (SaaSBOM) - For Java, Python, JavaScript, TypeScript, and PHP projects.
+- Attestations (CDXA) - Generate SBOM with templates for multiple standards. Sign the BOM document at a granular level to improve authenticity.
+- Vulnerability Disclosure Report (VDR) - Use cdxgen with [OWASP depscan](https://github.com/owasp-dep-scan/dep-scan) to automate the generation of VDR at scale.
 
 ## Why cdxgen?
 
@@ -23,11 +27,19 @@ Most SBOM tools are like simple barcode scanners. For easy applications, they ca
 
 <img src="./docs/_media/why-cdxgen.jpg" alt="why cdxgen" width="256">
 
+Our philosophy:
+
+- Explainability: Don't list, but explain with evidence.
+- Precision: Try using multiple techniques to improve precision, even if it takes extra time.
+- Personas: Cater to the needs of a range of personas such as security researchers, compliance auditors, developers, and SOC.
+- Lifecycle: Support BOM generation for various product lifecycles.
+
 ## Documentation
 
-Please visit our [documentation site][docs-homepage] for detailed usage, tutorials and support documentation.
+Please visit our [documentation site][docs-homepage] for detailed usage, tutorials, and support documentation.
 
 Sections include:
+
 - [Getting Started][docs-homepage]
 - [CLI Usage][docs-cli]
 - [Server Usage][docs-server]
@@ -37,7 +49,6 @@ Sections include:
 - [Permissions][docs-permissions]
 - [Support (Enterprise & Community)][docs-support]
 
-
 ### Automatic usage detection
 
 For node.js projects, lock files are parsed initially, so the SBOM would include all dependencies, including dev ones. An AST parser powered by babel-parser is then used to detect packages that are imported and used by non-test code. Such imported packages would automatically set their scope property to `required` in the resulting SBOM. You can turn off this analysis by passing the argument `--no-babel`. Scope property would then be set based on the `dev` attribute in the lock file.
@@ -472,8 +483,6 @@ Use the [CycloneDX CLI][cyclonedx-cli-github] tool for advanced use cases such a
 
 Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE][github-license] file for the full license.
 
-
-
 ## Integration as library
 
 cdxgen is [ESM only](https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c) and could be imported and used with both deno and Node.js >= 20
@@ -498,21 +507,22 @@ const dbody = await submitBom(args, bomNSData.bomJson);
 
 Please check out our [contribute to CycloneDX/cdxgen documentation][github-contribute] if you are interested in helping.
 
-
 Before raising a PR, please run the following commands.
 
 ```bash
+corepack enable
+corepack pnpm install
 # Generate types using jsdoc syntax
-npm run gen-types
+corepack pnpm run gen-types
 # Run biomejs formatter and linter with auto fix
-npm run lint
+corepack pnpm run lint
 # Run jest tests
-npm test
+corepack pnpm test
 ```
 
-
 <!-- LINK LABELS -->
 <!-- Badges -->
+
 [badge-github-contributors]: https://img.shields.io/github/contributors/cyclonedx/cdxgen
 [badge-github-license]: https://img.shields.io/github/license/cyclonedx/cdxgen
 [badge-github-releases]: https://img.shields.io/github/v/release/cyclonedx/cdxgen
@@ -522,6 +532,7 @@ npm test
 [badge-swh]: https://archive.softwareheritage.org/badge/origin/https://github.com/CycloneDX/cdxgen/
 
 <!-- cdxgen github project -->
+
 [github-contribute]: https://github.com/CycloneDX/cdxgen/contribute
 [github-contributors]: https://github.com/CycloneDX/cdxgen/graphs/contributors
 [github-issues]: https://github.com/CycloneDX/cdxgen/issues
@@ -529,6 +540,7 @@ npm test
 [github-releases]: https://github.com/CycloneDX/cdxgen/releases
 
 <!-- cdxgen documentation site -->
+
 [docs-homepage]: https://cyclonedx.github.io/cdxgen
 [docs-advanced-usage]: https://cyclonedx.github.io/cdxgen/#/ADVANCED
 [docs-cli]: https://cyclonedx.github.io/cdxgen/#/CLI
@@ -539,6 +551,7 @@ npm test
 [docs-support]: https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES
 
 <!-- web links-->
+
 [appthreat-homepage]: https://www.appthreat.com
 [cyclonedx-homepage]: https://cyclonedx.org
 [cyclonedx-cli-github]: https://github.com/CycloneDX/cyclonedx-cli
@@ -552,4 +565,4 @@ npm test
 [npmjs-cdxgen]: https://www.npmjs.com/package/@cyclonedx/cdxgen
 [podman-github-rootless]: https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md
 [podman-github-remote]: https://github.com/containers/podman/blob/master/docs/tutorials/mac_win_client.md
-[swh-cdxgen]: https://archive.softwareheritage.org/browse/origin/?origin_url=https://github.com/CycloneDX/cdxgen
+[swh-cdxgen]: https://archive.softwareheritage.org/browse/origin/?origin_url=https://github.com/CycloneDX/cdxgen

package/analyzer.js

@@ -292,7 +292,7 @@ export const findJSImportsExports = async (src, deep) => {
   const errFiles = [];
   try {
     const promiseMap = await getAllSrcJSAndTSFiles(src, deep);
-    const srcFiles = promiseMap.flatMap((d) => d);
+    const srcFiles = promiseMap.flat();
     for (const file of srcFiles) {
       try {
         parseFileASTTree(src, file, allImports, allExports);

package/index.js

@@ -35,6 +35,7 @@ import {
   FETCH_LICENSE,
   LEIN_CMD,
   MAX_BUFFER,
+  PREFER_MAVEN_DEPS_TREE,
   SWIFT_CMD,
   TIMEOUT_MS,
   addEvidenceForDotnet,
@@ -66,6 +67,7 @@ import {
   getSwiftPackageMetadata,
   getTimestamp,
   includeMavenTestScope,
+  isValidIriReference,
   parseBazelActionGraph,
   parseBazelSkyframe,
   parseBdistMetadata,
@@ -726,7 +728,9 @@ function addExternalReferences(opkg) {
       }
     }
   }
-  return externalReferences;
+  return externalReferences
+    .map((reference) => ({ ...reference, url: reference.url.trim() }))
+    .filter((reference) => isValidIriReference(reference.url));
 }
 
 /**
@@ -1185,6 +1189,7 @@ export async function createJavaBom(path, options) {
   // Support for tracking all the tools that created the BOM
   // For java, this would correctly include the cyclonedx maven plugin.
   let tools = undefined;
+  let possible_misses = false;
   // war/ear mode
   if (path.endsWith(".war") || path.endsWith(".jar")) {
     // Check if the file exists
@@ -1225,11 +1230,16 @@ export async function createJavaBom(path, options) {
     pomFiles?.length &&
     !["scala", "sbt", "gradle"].includes(options.projectType)
   ) {
+    let result = undefined;
     const cdxMavenPlugin =
       process.env.CDX_MAVEN_PLUGIN ||
       "org.cyclonedx:cyclonedx-maven-plugin:2.8.0";
     const cdxMavenGoal = process.env.CDX_MAVEN_GOAL || "makeAggregateBom";
-    let mvnArgs = [`${cdxMavenPlugin}:${cdxMavenGoal}`, "-DoutputName=bom"];
+    let mvnArgs = [
+      "-fn",
+      `${cdxMavenPlugin}:${cdxMavenGoal}`,
+      "-DoutputName=bom",
+    ];
     if (includeMavenTestScope) {
       mvnArgs.push("-DincludeTestScope=true");
     }
@@ -1247,6 +1257,7 @@ export async function createJavaBom(path, options) {
     if (options.specVersion === 1.4) {
       mvnArgs = mvnArgs.concat("-DschemaVersion=1.4");
     }
+    const firstPom = pomFiles.length ? pomFiles[0] : undefined;
     for (const f of pomFiles) {
       const basePath = dirname(f);
       const settingsXml = join(basePath, "settings.xml");
@@ -1268,44 +1279,97 @@ export async function createJavaBom(path, options) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
       }
-      console.log(`Executing '${mavenCmd} ${mvnArgs.join(" ")}' in`, basePath);
-      let result = spawnSync(mavenCmd, mvnArgs, {
-        cwd: basePath,
-        shell: true,
-        encoding: "utf-8",
-        timeout: TIMEOUT_MS,
-        maxBuffer: MAX_BUFFER,
-      });
-      // Check if the cyclonedx plugin created the required bom.json file
-      // Sometimes the plugin fails silently for complex maven projects
-      bomJsonFiles = getAllFiles(path, "**/target/*.json", options);
-      // Check if the bom json files got created in a directory other than target
-      if (!bomJsonFiles.length) {
-        bomJsonFiles = getAllFiles(path, "**/bom*.json", options);
-      }
-      const bomGenerated = bomJsonFiles.length;
-      if (!bomGenerated || result.status !== 0 || result.error) {
-        const tempDir = mkdtempSync(join(tmpdir(), "cdxmvn-"));
-        const tempMvnTree = join(tempDir, "mvn-tree.txt");
-        let mvnTreeArgs = ["dependency:tree", `-DoutputFile=${tempMvnTree}`];
-        if (process.env.MVN_ARGS) {
-          const addArgs = process.env.MVN_ARGS.split(" ");
-          mvnTreeArgs = mvnTreeArgs.concat(addArgs);
-        }
+      // Use the cyclonedx maven plugin if there is no preference for maven deps tree
+      if (!PREFER_MAVEN_DEPS_TREE) {
         console.log(
-          `Fallback to executing ${mavenCmd} ${mvnTreeArgs.join(" ")}`,
+          `Executing '${mavenCmd} ${mvnArgs.join(" ")}' in`,
+          basePath,
         );
-        result = spawnSync(mavenCmd, mvnTreeArgs, {
+        result = spawnSync(mavenCmd, mvnArgs, {
           cwd: basePath,
           shell: true,
           encoding: "utf-8",
           timeout: TIMEOUT_MS,
           maxBuffer: MAX_BUFFER,
         });
+        // Check if the cyclonedx plugin created the required bom.json file
+        // Sometimes the plugin fails silently for complex maven projects
+        bomJsonFiles = getAllFiles(path, "**/target/*.json", options);
+        // Check if the bom json files got created in a directory other than target
+        if (!bomJsonFiles.length) {
+          bomJsonFiles = getAllFiles(
+            path,
+            "target/**/*{cdx,bom}*.json",
+            options,
+          );
+        }
+      }
+      // Also check if the user has a preference for maven deps tree command
+      if (
+        PREFER_MAVEN_DEPS_TREE ||
+        !bomJsonFiles.length ||
+        result?.status !== 0 ||
+        result?.error
+      ) {
+        const tempDir = mkdtempSync(join(tmpdir(), "cdxmvn-"));
+        const tempMvnTree = join(tempDir, "mvn-tree.txt");
+        const tempMvnParentTree = join(tempDir, "mvn-parent-tree.txt");
+        let mvnTreeArgs = ["dependency:tree", `-DoutputFile=${tempMvnTree}`];
+        if (process.env.MVN_ARGS) {
+          const addArgs = process.env.MVN_ARGS.split(" ");
+          mvnTreeArgs = mvnTreeArgs.concat(addArgs);
+        }
+        // Automatically use settings.xml to improve the success for fallback
+        if (existsSync(settingsXml)) {
+          mvnTreeArgs.push("-s");
+          mvnTreeArgs.push(settingsXml);
+        }
+        // For the first pom alone, we need to execute first in non-recursive mode to capture
+        // the parent component. Then, we execute all of them in recursive mode
+        if (f === firstPom) {
+          result = spawnSync(
+            "mvn",
+            ["dependency:tree", "-N", `-DoutputFile=${tempMvnParentTree}`],
+            {
+              cwd: basePath,
+              shell: true,
+              encoding: "utf-8",
+              timeout: TIMEOUT_MS,
+              maxBuffer: MAX_BUFFER,
+            },
+          );
+          if (result.status === 0) {
+            if (existsSync(tempMvnParentTree)) {
+              const mvnTreeString = readFileSync(tempMvnParentTree, {
+                encoding: "utf-8",
+              });
+              const parsedList = parseMavenTree(mvnTreeString, f);
+              const dlist = parsedList.pkgList;
+              const tmpParentComponent = dlist.splice(0, 1)[0];
+              tmpParentComponent.type = "application";
+              parentComponent = tmpParentComponent;
+              parentComponent.components = [];
+            }
+          }
+        }
+        console.log(`Executing 'mvn ${mvnTreeArgs.join(" ")}' in ${basePath}`);
+        // Prefer the built-in maven
+        result = spawnSync(
+          PREFER_MAVEN_DEPS_TREE ? "mvn" : mavenCmd,
+          mvnTreeArgs,
+          {
+            cwd: basePath,
+            shell: true,
+            encoding: "utf-8",
+            timeout: TIMEOUT_MS,
+            maxBuffer: MAX_BUFFER,
+          },
+        );
         if (result.status !== 0 || result.error) {
+          possible_misses = true;
           // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
           // These could be due to a range of reasons that are covered below.
-          if (pomFiles.length === 1 || DEBUG_MODE) {
+          if (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE) {
             console.error(result.stdout, result.stderr);
             console.log("The above build errors could be due to:\n");
             if (
@@ -1319,7 +1383,10 @@ export async function createJavaBom(path, options) {
             } else if (
               result.stdout &&
               (result.stdout.includes("Could not resolve dependencies") ||
-                result.stdout.includes("no dependency information available"))
+                result.stdout.includes("no dependency information available") ||
+                result.stdout.includes(
+                  "The following artifacts could not be resolved",
+                ))
             ) {
               console.log(
                 "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
@@ -1358,95 +1425,120 @@ export async function createJavaBom(path, options) {
             const mvnTreeString = readFileSync(tempMvnTree, {
               encoding: "utf-8",
             });
-            const parsedList = parseMavenTree(mvnTreeString);
+            const parsedList = parseMavenTree(mvnTreeString, f);
             const dlist = parsedList.pkgList;
-            parentComponent = dlist.splice(0, 1)[0];
-            parentComponent.type = "application";
+            const tmpParentComponent = dlist.splice(0, 1)[0];
+            tmpParentComponent.type = "application";
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
             }
+            // Retain the parent hierarchy
+            if (!Object.keys(parentComponent).length) {
+              parentComponent = tmpParentComponent;
+              parentComponent.components = [];
+            } else {
+              parentComponent.components.push(tmpParentComponent);
+            }
             if (parsedList.dependenciesList && parsedList.dependenciesList) {
-              dependencies = dependencies.concat(parsedList.dependenciesList);
+              dependencies = mergeDependencies(
+                dependencies,
+                parsedList.dependenciesList,
+                tmpParentComponent,
+              );
             }
             unlinkSync(tempMvnTree);
           }
         }
       }
     } // for
-    for (const abjson of bomJsonFiles) {
-      let bomJsonObj = undefined;
-      try {
-        if (DEBUG_MODE) {
-          console.log(`Extracting data from generated bom file ${abjson}`);
-        }
-        bomJsonObj = JSON.parse(
-          readFileSync(abjson, {
-            encoding: "utf-8",
-          }),
-        );
-        if (bomJsonObj) {
-          if (
-            !tools &&
-            bomJsonObj.metadata &&
-            bomJsonObj.metadata.tools &&
-            Array.isArray(bomJsonObj.metadata.tools)
-          ) {
-            tools = bomJsonObj.metadata.tools;
-          }
-          if (
-            bomJsonObj.metadata?.component &&
-            !Object.keys(parentComponent).length
-          ) {
-            parentComponent = bomJsonObj.metadata.component;
-            options.parentComponent = parentComponent;
-            pkgList = [];
+    // Locate and parse all bom.json files from the maven plugin
+    if (!PREFER_MAVEN_DEPS_TREE) {
+      for (const abjson of bomJsonFiles) {
+        let bomJsonObj = undefined;
+        try {
+          if (DEBUG_MODE) {
+            console.log(`Extracting data from generated bom file ${abjson}`);
           }
-          if (bomJsonObj.components) {
-            // Inject evidence into the components. #994
-            if (options.specVersion >= 1.5) {
-              // maven would usually generate a target directory closest to the pom.xml
-              // I am sure there would be cases where this assumption is not true :)
-              const srcPomFile = join(dirname(abjson), "..", "pom.xml");
-              for (const acomp of bomJsonObj.components) {
-                if (!acomp.evidence) {
-                  acomp.evidence = {
-                    identity: {
-                      field: "purl",
-                      confidence: 0.8,
-                      methods: [
-                        {
-                          technique: "manifest-analysis",
-                          confidence: 0.8,
-                          value: srcPomFile,
-                        },
-                      ],
-                    },
-                  };
-                }
-                if (!acomp.properties) {
-                  acomp.properties = [];
+          bomJsonObj = JSON.parse(
+            readFileSync(abjson, {
+              encoding: "utf-8",
+            }),
+          );
+          if (bomJsonObj) {
+            if (
+              !tools &&
+              bomJsonObj.metadata &&
+              bomJsonObj.metadata.tools &&
+              Array.isArray(bomJsonObj.metadata.tools)
+            ) {
+              tools = bomJsonObj.metadata.tools;
+            }
+            if (
+              bomJsonObj.metadata?.component &&
+              !Object.keys(parentComponent).length
+            ) {
+              parentComponent = bomJsonObj.metadata.component;
+              options.parentComponent = parentComponent;
+              pkgList = [];
+            }
+            if (bomJsonObj.components) {
+              // Inject evidence into the components. #994
+              if (options.specVersion >= 1.5) {
+                // maven would usually generate a target directory closest to the pom.xml
+                // I am sure there would be cases where this assumption is not true :)
+                const srcPomFile = join(dirname(abjson), "..", "pom.xml");
+                for (const acomp of bomJsonObj.components) {
+                  if (!acomp.evidence) {
+                    acomp.evidence = {
+                      identity: {
+                        field: "purl",
+                        confidence: 0.8,
+                        methods: [
+                          {
+                            technique: "manifest-analysis",
+                            confidence: 0.8,
+                            value: srcPomFile,
+                          },
+                        ],
+                      },
+                    };
+                  }
+                  if (!acomp.properties) {
+                    acomp.properties = [];
+                  }
+                  acomp.properties.push({
+                    name: "SrcFile",
+                    value: srcPomFile,
+                  });
                 }
-                acomp.properties.push({
-                  name: "SrcFile",
-                  value: srcPomFile,
-                });
               }
+              pkgList = pkgList.concat(bomJsonObj.components);
+            }
+            if (bomJsonObj.dependencies) {
+              dependencies = mergeDependencies(
+                dependencies,
+                bomJsonObj.dependencies,
+                parentComponent,
+              );
             }
-            pkgList = pkgList.concat(bomJsonObj.components);
           }
-          if (bomJsonObj.dependencies) {
-            dependencies = mergeDependencies(
-              dependencies,
-              bomJsonObj.dependencies,
-              parentComponent,
-            );
+        } catch (err) {
+          if (options.failOnError || DEBUG_MODE) {
+            console.log(err);
+            options.failOnError && process.exit(1);
           }
         }
-      } catch (err) {
-        if (options.failOnError || DEBUG_MODE) {
-          console.log(err);
-          options.failOnError && process.exit(1);
-        }
+      }
+    }
+    if (possible_misses) {
+      if (!DEBUG_MODE) {
+        console.warn(
+          "Multiple errors occurred while building this project with maven. The SBOM is therefore incomplete!",
+        );
+      } else if (!PREFER_MAVEN_DEPS_TREE) {
+        console.log(
+          "Try generating an SBOM with the maven dependency tree plugin. Set the environment variable PREFER_MAVEN_DEPS_TREE to true to enable this.",
+        );
       }
     }
     if (pkgList) {
@@ -4708,12 +4800,7 @@ export async function createCsharpBom(path, options) {
     for (const f of filesToRestore) {
       const buildCmd =
         options.projectType === "dotnet-framework" ? "nuget" : "dotnet";
-      if (DEBUG_MODE) {
-        const basePath = dirname(f);
-        console.log(`Executing '${buildCmd} restore' in ${basePath}`);
-      }
-      const result = spawnSync(
-        buildCmd,
+      const buildArgs =
         options.projectType === "dotnet-framework"
           ? [
               "restore",
@@ -4724,23 +4811,38 @@ export async function createCsharpBom(path, options) {
               "-Verbosity",
               "quiet",
             ]
-          : ["restore", "--force", "--ignore-failed-sources", f],
-        {
-          cwd: path,
-          encoding: "utf-8",
-        },
-      );
-      if (DEBUG_MODE && (result.status !== 0 || result.error)) {
-        console.error(
-          `Restore has failed. Check if ${buildCmd} is installed and available in PATH.`,
-        );
-        console.log(
-          "Authenticate with any private registries such as Azure Artifacts feed before running cdxgen.",
-        );
+          : ["restore", "--force", "--ignore-failed-sources", f];
+      if (DEBUG_MODE) {
+        const basePath = dirname(f);
         console.log(
-          "Alternatively, try using the unofficial `ghcr.io/appthreat/cdxgen-dotnet6:v10` container image, which bundles nuget (mono) and a range of dotnet SDKs.",
+          `Executing '${buildCmd} ${buildArgs.join(" ")}' in ${basePath}`,
         );
-        console.log(result.stderr);
+      }
+      const result = spawnSync(buildCmd, buildArgs, {
+        cwd: path,
+        encoding: "utf-8",
+        env: { ...process.env, DOTNET_ROLL_FORWARD: "Major" },
+      });
+      if (DEBUG_MODE && (result.status !== 0 || result.error)) {
+        if (result?.stderr?.includes("To install missing framework")) {
+          console.log(
+            "This project requires a specific version of dotnet sdk to be installed. The cdxgen container image bundles dotnet SDK 8.0, which might be incompatible.",
+          );
+          console.log(
+            "Try using the unofficial `ghcr.io/appthreat/cdxgen-dotnet6:v10` or `ghcr.io/appthreat/cdxgen-dotnet7:v10` container images.",
+          );
+        } else {
+          console.error(
+            `Restore has failed. Check if ${buildCmd} is installed and available in PATH.`,
+          );
+          console.log(
+            "Authenticate with any private registries such as Azure Artifacts feed before running cdxgen.",
+          );
+          console.log(
+            "Alternatively, try using the unofficial `ghcr.io/appthreat/cdxgen-dotnet6:v10` container image, which bundles nuget (mono) and a range of dotnet SDKs.",
+          );
+        }
+        console.log(result.stdout, result.stderr);
         options.failOnError && process.exit(1);
       }
     }
@@ -4932,7 +5034,7 @@ export async function createCsharpBom(path, options) {
           parentComponent = retMap.parentComponent;
         }
       }
-      if (retMap?.pkgList.length) {
+      if (retMap?.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (retMap.dependencies?.length) {
@@ -5062,10 +5164,11 @@ export function mergeDependencies(
     }
     if (adep["dependsOn"]) {
       for (const eachDepends of adep["dependsOn"]) {
-        if (
-          parentRef &&
-          eachDepends.toLowerCase() !== parentRef.toLowerCase()
-        ) {
+        if (parentRef) {
+          if (eachDepends.toLowerCase() !== parentRef.toLowerCase()) {
+            deps_map[adep.ref].add(eachDepends);
+          }
+        } else {
           deps_map[adep.ref].add(eachDepends);
         }
       }
@@ -5132,6 +5235,14 @@ export function trimComponents(components) {
           }
         }
       }
+      // If the component is required in any of the child projects, then make it required
+      if (
+        existingComponent?.scope !== "required" &&
+        comp?.scope === "required"
+      ) {
+        existingComponent.scope = "required";
+        keyCache[key] = existingComponent;
+      }
       if (compProps.length) {
         existingComponent.properties = compProps;
         keyCache[key] = existingComponent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.5.2",
+  "version": "10.6.1",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -47,14 +47,6 @@
     "evinse": "bin/evinse.js",
     "cdx-verify": "bin/verify.js"
   },
-  "scripts": {
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --inject-globals false docker.test.js utils.test.js display.test.js postgen.test.js",
-    "watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch --inject-globals false",
-    "lint:check": "biome check *",
-    "lint": "biome check --apply *",
-    "lint:errors": "biome check * --diagnostic-level=error",
-    "gen-types": "npx -p typescript tsc"
-  },
   "engines": {
     "node": ">=20"
   },
@@ -90,7 +82,8 @@
     "tar": "^6.2.1",
     "uuid": "^9.0.1",
     "xml-js": "^1.6.11",
-    "yargs": "^17.7.2"
+    "yargs": "^17.7.2",
+    "validate-iri": "^1.0.1"
   },
   "optionalDependencies": {
     "@appthreat/atom": "2.0.12",
@@ -109,10 +102,23 @@
     "sequelize": "^6.37.3",
     "sqlite3": "^5.1.7"
   },
-  "files": ["*.js", "bin/", "data/", "types/"],
+  "files": [
+    "*.js",
+    "bin/",
+    "data/",
+    "types/"
+  ],
   "devDependencies": {
-    "@biomejs/biome": "1.7.3",
+    "@biomejs/biome": "1.8.0",
     "jest": "^29.7.0",
     "typescript": "^5.4.5"
+  },
+  "scripts": {
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --inject-globals false docker.test.js utils.test.js display.test.js postgen.test.js",
+    "watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch --inject-globals false",
+    "lint:check": "biome check",
+    "lint": "biome check --fix",
+    "lint:errors": "biome check --diagnostic-level=error",
+    "gen-types": "npx -p typescript tsc"
   }
-}
+}

package/types/evinser.d.ts

@@ -104,8 +104,8 @@ export function prepareDB(options: any): Promise<{
             count: number;
         }>;
         findAndCountAll<M_17 extends import("sequelize").Model<any, any>>(this: import("sequelize").ModelStatic<M_17>, options: {
-            type?: string;
             attributes?: import("sequelize").FindAttributeOptions;
+            type?: string;
             plain?: boolean;
             logging?: boolean | ((sql: string, timing?: number) => void);
             where?: import("sequelize").WhereOptions<import("sequelize").Attributes<M_17>>;
@@ -127,7 +127,7 @@ export function prepareDB(options: any): Promise<{
             bind?: import("sequelize").BindOrReplacements;
             instance?: import("sequelize").Model<any, any>;
             mapToModel?: boolean;
-            retry?: import("retry-as-promised").Options;
+            retry?: import(".pnpm/retry-as-promised@7.0.4/node_modules/retry-as-promised").Options;
             fieldMap?: import("sequelize").FieldMap;
             benchmark?: boolean;
             transaction?: import("sequelize").Transaction;
@@ -333,8 +333,8 @@ export function prepareDB(options: any): Promise<{
             count: number;
         }>;
         findAndCountAll<M_17 extends import("sequelize").Model<any, any>>(this: import("sequelize").ModelStatic<M_17>, options: {
-            type?: string;
             attributes?: import("sequelize").FindAttributeOptions;
+            type?: string;
             plain?: boolean;
             logging?: boolean | ((sql: string, timing?: number) => void);
             where?: import("sequelize").WhereOptions<import("sequelize").Attributes<M_17>>;
@@ -356,7 +356,7 @@ export function prepareDB(options: any): Promise<{
             bind?: import("sequelize").BindOrReplacements;
             instance?: import("sequelize").Model<any, any>;
             mapToModel?: boolean;
-            retry?: import("retry-as-promised").Options;
+            retry?: import(".pnpm/retry-as-promised@7.0.4/node_modules/retry-as-promised").Options;
             fieldMap?: import("sequelize").FieldMap;
             benchmark?: boolean;
             transaction?: import("sequelize").Transaction;
@@ -562,8 +562,8 @@ export function prepareDB(options: any): Promise<{
             count: number;
         }>;
         findAndCountAll<M_17 extends import("sequelize").Model<any, any>>(this: import("sequelize").ModelStatic<M_17>, options: {
-            type?: string;
             attributes?: import("sequelize").FindAttributeOptions;
+            type?: string;
             plain?: boolean;
             logging?: boolean | ((sql: string, timing?: number) => void);
             where?: import("sequelize").WhereOptions<import("sequelize").Attributes<M_17>>;
@@ -585,7 +585,7 @@ export function prepareDB(options: any): Promise<{
             bind?: import("sequelize").BindOrReplacements;
             instance?: import("sequelize").Model<any, any>;
             mapToModel?: boolean;
-            retry?: import("retry-as-promised").Options;
+            retry?: import(".pnpm/retry-as-promised@7.0.4/node_modules/retry-as-promised").Options;
             fieldMap?: import("sequelize").FieldMap;
             benchmark?: boolean;
             transaction?: import("sequelize").Transaction;

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AA2tBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AA4TD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BA64BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAochB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAgWhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BA8ThB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBA8ThB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA+VhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA8DC;AAED;;;;;;GAMG;AACH,yDAmCC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,8BAoZhB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAkUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAuQhB;AAED;;;;;GAKG;AACH,qEAyFC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AA+tBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AA4TD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAq+BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAochB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAgWhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BA8ThB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBA8ThB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAyWhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDA2CC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,8BAoZhB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAkUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAuQhB;AAED;;;;;GAKG;AACH,qEAyFC"}

package/types/utils.d.ts

@@ -172,17 +172,11 @@ export function parsePom(pomFile: any): {
 /**
  * Parse maven tree output
  * @param {string} rawOutput Raw string output
+ * @param {string} pomFile .pom file for evidence
+ *
+ * @returns {Object} Object containing packages and dependencies
  */
-export function parseMavenTree(rawOutput: string): {
-    pkgList?: undefined;
-    dependenciesList?: undefined;
-} | {
-    pkgList: any[];
-    dependenciesList: {
-        ref: string;
-        dependsOn: any;
-    }[];
-};
+export function parseMavenTree(rawOutput: string, pomFile: string): any;
 /**
  * Parse gradle dependencies output
  * @param {string} rawOutput Raw string output
@@ -1119,6 +1113,18 @@ export function addEvidenceForDotnet(pkgList: any, slicesFile: any): any;
  * @returns {Object} pkgFilesMap Object with package name and list of files
  */
 export function parseMakeDFile(dfile: string): any;
+/**
+ * Function to validate an externalReference URL for conforming to the JSON schema or bomLink
+ * https://github.com/CycloneDX/cyclonedx-core-java/blob/75575318b268dda9e2a290761d7db11b4f414255/src/main/resources/bom-1.5.schema.json#L1140
+ * https://datatracker.ietf.org/doc/html/rfc3987#section-2.2
+ * https://cyclonedx.org/capabilities/bomlink/
+ *
+ * @param {String} iri IRI to validate
+ *
+ * @returns {Boolean} Flag indicating whether the supplied URL is valid or not
+ *
+ */
+export function isValidIriReference(iri: string): boolean;
 export const dirNameStr: string;
 export const isWin: boolean;
 export const isMac: boolean;
@@ -1129,6 +1135,7 @@ export const TIMEOUT_MS: number;
 export const MAX_BUFFER: number;
 export let metadata_cache: {};
 export const includeMavenTestScope: boolean;
+export const PREFER_MAVEN_DEPS_TREE: boolean;
 export const FETCH_LICENSE: boolean;
 export const SEARCH_MAVEN_ORG: boolean;
 export let JAVA_CMD: string;

package/types/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../utils.js"],"names":[],"mappings":"AA8NA;;;;;GAKG;AACH,qCAHW,MAAM,WACN,MAAM,0BAqBhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BAoBhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAiBnB;AAED;;;;;;;;GAQG;AACH,iEAoBC;AAED;;;;;GAKG;AACH,6CAmDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBAkFjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqVhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MAwDhB;AAwBD;;;;GAIG;AACH,4CAFW,MAAM;;;GAsMhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,oBACN,MAAM;;;;;;;;;GA8KhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;IAqDC;AAED;;;GAGG;AACH,0CAFW,MAAM;;;;;;;;;EAwFhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,qBACN,MAAM,oBACN,MAAM,uBACN,MAAM;;;;;;;;;;;;;;;;EAkNhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EA6ChB;AAED;;;;GAIG;AACH,iDAFW,MAAM;;;;;;;;EAsChB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,YACN,MAAM,0BAGJ,MAAM,CAgElB;AAED;;;;;;GAMG;AACH,6CAJW,MAAM,YACN,MAAM,cACN,MAAM,MAsEhB;AAED;;;GAGG;AACH,iDAFW,MAAM,SA4ChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,kDAUC;AAED;;;;;GAKG;AACH,mFAiGC;AAED;;;;;;;;;GASG;AACH,sFAMC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CAwB3B;AAED;;;;;;;;;GASG;AACH,0EAFY,eAAe,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,eAAe,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,2FAkBC;AAED;;;;;GAKG;AACH,sFAgNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;GAIG;AACH,6CAFW,MAAM,MA+ChB;AAED;;;;;GAKG;AACH,6DAFW,MAAM;;;;;;;GAqHhB;AAED;;;;;GAKG;AACH,mFA+IC;AAED;;;;;;GAMG;AACH,kCAJW,MAAM;;;;;;;;GA2EhB;AAED;;;;GAIG;AACH,mEAqBC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CASnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,eAAe,CA8D1B;AAED;;;;GAIG;AACH,iEAgDC;AAED,+FA4BC;AAED,8EA2EC;AAED;;;;;GAKG;AACH,0CAHW,MAAM;;;GA0DhB;AA0BD;;;;;;;;;GASG;AACH,2CAPW,MAAM,aACN,MAAM;;;;;;GA6FhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAuChB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBAgChB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;;;;;;;;GAuPhB;AAED;;;;GAIG;AACH,kEAoEC;AAED;;;;GAIG;AACH,gEA0DC;AA0BD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAiLjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BAsIjB;AAED;;;IAwIC;AAED,wEA0BC;AAED,mEAqCC;AAED,0DAkBC;AAED,wDA+DC;AAED,0FAkEC;AAED;;IAqCC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAED,8DAsCC;AAED,sDAqDC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EA4EC;AAED,kEAgDC;AAED;;;;;;;;GAQG;AACH,kGAqMC;AAED;;;EAiNC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2IhB;AAED;;;;;;EA+HC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;IA2IC;AA2CD;;;;GAIG;AACH,0FAHW,MAAM,WACN,MAAM,UAuDhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;EAqBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,oIAgCC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA6JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;;EA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,eAAe,CAU3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBAmThB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA4EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,UAiChB;AACD;;;;;GAKG;AAEH,uDAJW,MAAM,OAmChB;AACD;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0DAyEC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OAgDhB;AA0DD;;;;;;;GAOG;AACH,2CALW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyShB;AAGD;;;;;EAmBC;AAED;;;;;;GAMG;AACH,kEAHW,MAAM,cACN,MAAM,6BA0IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EA6PC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAgQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AAkHD;;;;GAIG;AACH;;;GAkHC;AAED,yEA+FC;AAED;;;;;;GAMG;AACH,mDAkBC;AAtvUD,gCAAgF;AAChF,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AAsBnE,iCAEE;AAiBF,iCAIyC;AAGzC,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAK/B,4CAEmE;AAGnE,oCAEoD;AAGpD,uCAEuD;AAYvD,4BAA6B;AAU7B,8BAAiC;AAMjC,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,6BAA+B;AAS/B,8BAQG;AA24HH,8CAUE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../utils.js"],"names":[],"mappings":"AAoOA;;;;;GAKG;AACH,qCAHW,MAAM,WACN,MAAM,0BAqBhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BAoBhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAiBnB;AAED;;;;;;;;GAQG;AACH,iEAoBC;AAED;;;;;GAKG;AACH,6CAmDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBAkFjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqVhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MAwDhB;AAwBD;;;;GAIG;AACH,4CAFW,MAAM;;;GAsMhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,oBACN,MAAM;;;;;;;;;GAqOhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;IAqDC;AAED;;;;;;GAMG;AACH,0CALW,MAAM,WACN,MAAM,OAgJhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,qBACN,MAAM,oBACN,MAAM,uBACN,MAAM;;;;;;;;;;;;;;;;EAkNhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EA6ChB;AAED;;;;GAIG;AACH,iDAFW,MAAM;;;;;;;;EAsChB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,YACN,MAAM,0BAGJ,MAAM,CAgElB;AAED;;;;;;GAMG;AACH,6CAJW,MAAM,YACN,MAAM,cACN,MAAM,MAsEhB;AAED;;;GAGG;AACH,iDAFW,MAAM,SA4ChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,kDAUC;AAED;;;;;GAKG;AACH,mFAiGC;AAED;;;;;;;;;GASG;AACH,sFAMC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CAwB3B;AAED;;;;;;;;;GASG;AACH,0EAFY,eAAe,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,eAAe,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,2FAkBC;AAED;;;;;GAKG;AACH,sFAgNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;GAIG;AACH,6CAFW,MAAM,MA+ChB;AAED;;;;;GAKG;AACH,6DAFW,MAAM;;;;;;;GAqHhB;AAED;;;;;GAKG;AACH,mFA+IC;AAED;;;;;;GAMG;AACH,kCAJW,MAAM;;;;;;;;GA2EhB;AAED;;;;GAIG;AACH,mEAqBC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CASnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,eAAe,CA8D1B;AAED;;;;GAIG;AACH,iEAgDC;AAED,+FA4BC;AAED,8EA2EC;AAED;;;;;GAKG;AACH,0CAHW,MAAM;;;GA0DhB;AA0BD;;;;;;;;;GASG;AACH,2CAPW,MAAM,aACN,MAAM;;;;;;GA6FhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAuChB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBAgChB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;;;;;;;;GAuPhB;AAED;;;;GAIG;AACH,kEAoEC;AAED;;;;GAIG;AACH,gEA0DC;AA0BD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAiLjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BAsIjB;AAED;;;IAwIC;AAED,wEA0BC;AAED,mEAqCC;AAED,0DAkBC;AAED,wDA+DC;AAED,0FAkEC;AAED;;IAqCC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAED,8DAsCC;AAED,sDAqDC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EA4EC;AAED,kEAgDC;AAED;;;;;;;;GAQG;AACH,kGA0MC;AAED;;;EAiNC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2IhB;AAED;;;;;;EA+HC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;IA2IC;AA2CD;;;;GAIG;AACH,0FAHW,MAAM,WACN,MAAM,UAuDhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;EAqBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,oIAgCC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA6JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;;EA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,eAAe,CAU3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBAmThB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA4EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,UAiChB;AACD;;;;;GAKG;AAEH,uDAJW,MAAM,OAmChB;AACD;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0DAyEC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OAgDhB;AA0DD;;;;;;;GAOG;AACH,2CALW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyShB;AAGD;;;;;EAmBC;AAED;;;;;;GAMG;AACH,kEAHW,MAAM,cACN,MAAM,6BA0IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EA6PC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAgQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AAgHD;;;;GAIG;AACH;;;GAkHC;AAED,yEA+FC;AAED;;;;;;GAMG;AACH,mDAkBC;AAED;;;;;;;;;;GAUG;AACH,0DAWC;AAt4UD,gCAAgF;AAChF,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AAsBnE,iCAEE;AAiBF,iCAIyC;AAGzC,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAK/B,4CAEmE;AAGnE,6CAE6D;AAG7D,oCAEoD;AAGpD,uCAEuD;AAYvD,4BAA6B;AAU7B,8BAAiC;AAMjC,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,6BAA+B;AAS/B,8BAQG;AA2/HH,8CAUE"}

package/utils.js

@@ -46,6 +46,7 @@ import {
   satisfies,
   valid,
 } from "semver";
+import { IriValidationStrategy, validateIri } from "validate-iri";
 import { xml2js } from "xml-js";
 import { getTreeWithPlugin } from "./piptree.js";
 
@@ -121,6 +122,11 @@ export const includeMavenTestScope =
   !process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE ||
   ["true", "1"].includes(process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE);
 
+// Whether to use the native maven dependency tree command
+export const PREFER_MAVEN_DEPS_TREE =
+  process.env.PREFER_MAVEN_DEPS_TREE &&
+  ["true", "1"].includes(process.env.PREFER_MAVEN_DEPS_TREE);
+
 // Whether license information should be fetched
 export const FETCH_LICENSE =
   process.env.FETCH_LICENSE &&
@@ -1435,15 +1441,29 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
     if (!yamlObj) {
       return {};
     }
+    let lockfileVersion = yamlObj.lockfileVersion;
+    try {
+      lockfileVersion = Number.parseFloat(lockfileVersion, 10);
+    } catch (e) {
+      // ignore parse errors
+    }
     // This logic matches the pnpm list command to include only direct dependencies
     if (ppurl !== "") {
-      const ddeps = yamlObj.dependencies || {};
+      // In lock file version 9, direct dependencies is under importers
+      const ddeps =
+        lockfileVersion >= 9
+          ? yamlObj.importers["."]?.dependencies || {}
+          : yamlObj.dependencies || {};
       const ddeplist = [];
       for (const dk of Object.keys(ddeps)) {
         let version = ddeps[dk];
         if (typeof version === "object" && version.version) {
           version = version.version;
         }
+        // version: 3.0.1(ajv@8.14.0)
+        if (version?.includes("(")) {
+          version = version.split("(")[0];
+        }
         const dpurl = new PackageURL(
           "npm",
           "",
@@ -1459,13 +1479,9 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
         dependsOn: ddeplist,
       });
     }
-    let lockfileVersion = yamlObj.lockfileVersion;
-    try {
-      lockfileVersion = Number.parseInt(lockfileVersion, 10);
-    } catch (e) {
-      // ignore parse errors
-    }
     const packages = yamlObj.packages || {};
+    // snapshots is a new key under lockfile version 9
+    const snapshots = yamlObj.snapshots || {};
     const pkgKeys = Object.keys(packages);
     for (const k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
@@ -1477,20 +1493,40 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
       }
       const parts = fullName.split("/");
       const integrity = packages[pkgKeys[k]].resolution.integrity;
-      const deps = packages[pkgKeys[k]].dependencies || [];
+      // In lock file version 9, dependencies is under snapshots
+      const deps =
+        packages[pkgKeys[k]].dependencies ||
+        snapshots[pkgKeys[k]]?.dependencies ||
+        [];
       const scope = packages[pkgKeys[k]].dev === true ? "optional" : undefined;
       if (parts?.length) {
         let name = "";
         let version = "";
         let group = "";
-        if (lockfileVersion >= 6 && fullName.includes("@")) {
+        const hasBin = packages[pkgKeys[k]]?.hasBin;
+        const deprecatedMessage = packages[pkgKeys[k]]?.deprecated;
+        if (lockfileVersion >= 9 && fullName.includes("@")) {
+          group = parts.length > 1 ? parts[0] : "";
+          const tmpA = parts[parts.length - 1].split("@");
+          if (tmpA.length > 1) {
+            name = tmpA[0];
+            version = tmpA[1];
+          }
+          if (version?.includes("(")) {
+            version = version.split("(")[0];
+          }
+        } else if (
+          lockfileVersion >= 6 &&
+          lockfileVersion < 9 &&
+          fullName.includes("@")
+        ) {
           const tmpA = parts[parts.length - 1].split("@");
           group = parts[0];
           if (parts.length === 2 && tmpA.length > 1) {
             name = tmpA[0];
             version = tmpA[1];
           } else {
-            console.log(parts, fullName);
+            console.log("Missed", parts, fullName);
           }
         } else {
           if (parts.length === 2) {
@@ -1519,12 +1555,24 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
             null,
           ).toString();
           const deplist = [];
-          for (const dpkgName of Object.keys(deps)) {
+          for (let dpkgName of Object.keys(deps)) {
+            let vers = deps[dpkgName];
+            if (vers?.includes("(")) {
+              vers = vers.split("(")[0];
+            }
+            // string-width-cjs: string-width@4.2.3
+            if (dpkgName.endsWith("-cjs")) {
+              const tmpB = vers.split("@");
+              if (tmpB.length > 1) {
+                dpkgName = tmpB[0];
+                vers = tmpB[1];
+              }
+            }
             const dpurlString = new PackageURL(
               "npm",
               "",
               dpkgName,
-              deps[dpkgName],
+              vers,
               null,
               null,
             ).toString();
@@ -1534,6 +1582,24 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
             ref: decodeURIComponent(purlString),
             dependsOn: deplist,
           });
+          const properties = [
+            {
+              name: "SrcFile",
+              value: pnpmLock,
+            },
+          ];
+          if (hasBin) {
+            properties.push({
+              name: "cdx:npm:has_binary",
+              value: `${hasBin}`,
+            });
+          }
+          if (deprecatedMessage) {
+            properties.push({
+              name: "cdx:npm:deprecation_notice",
+              value: deprecatedMessage,
+            });
+          }
           pkgList.push({
             group: group,
             name: name,
@@ -1542,12 +1608,7 @@ export async function parsePnpmLock(pnpmLock, parentComponent = null) {
             "bom-ref": decodeURIComponent(purlString),
             scope,
             _integrity: integrity,
-            properties: [
-              {
-                name: "SrcFile",
-                value: pnpmLock,
-              },
-            ],
+            properties,
             evidence: {
               identity: {
                 field: "purl",
@@ -1784,8 +1845,11 @@ export function parsePom(pomFile) {
 /**
  * Parse maven tree output
  * @param {string} rawOutput Raw string output
+ * @param {string} pomFile .pom file for evidence
+ *
+ * @returns {Object} Object containing packages and dependencies
  */
-export function parseMavenTree(rawOutput) {
+export function parseMavenTree(rawOutput, pomFile) {
   if (!rawOutput) {
     return {};
   }
@@ -1810,29 +1874,83 @@ export function parseMavenTree(rawOutput) {
       }
       l = tmpline[tmpline.length - 1];
       const pkgArr = l.split(":");
+      // Support for classifiers
+      // com.github.jnr:jffi:jar:1.3.11:compile
+      // com.github.jnr:jffi:jar:native:1.3.11:runtime
+      let classifier = undefined;
       if (pkgArr && pkgArr.length > 2) {
         let versionStr = pkgArr[pkgArr.length - 2];
+        const componentScope = pkgArr[pkgArr.length - 1];
+        if (pkgArr.length >= 6 && pkgArr[3] !== versionStr) {
+          classifier = pkgArr[3];
+        }
+        // Ignore test scope
+        if (!includeMavenTestScope && componentScope === "test") {
+          return;
+        }
+        let scope = undefined;
+        if (["compile", "runtime"].includes(componentScope)) {
+          scope = "required";
+        } else if (componentScope === "test") {
+          scope = "optional";
+        } else if (componentScope === "provided") {
+          scope = "excluded";
+        }
         if (pkgArr.length === 4) {
           versionStr = pkgArr[pkgArr.length - 1];
         }
-        const key = `${pkgArr[0]}-${pkgArr[1]}-${versionStr}`;
+        const qualifiers = { type: pkgArr[2] };
+        if (classifier) {
+          qualifiers.classifier = classifier;
+        }
+        const purlString = new PackageURL(
+          "maven",
+          pkgArr[0],
+          pkgArr[1],
+          versionStr,
+          qualifiers,
+          null,
+        ).toString();
+        const key = purlString;
         if (!keys_cache[key]) {
           keys_cache[key] = key;
-          let purlString = new PackageURL(
-            "maven",
-            pkgArr[0],
-            pkgArr[1],
-            versionStr,
-            { type: pkgArr[2] },
-            null,
-          ).toString();
-          purlString = decodeURIComponent(purlString);
-          deps.push({
+          const properties = [];
+          if (scope) {
+            properties.push({
+              name: "cdx:maven:component_scope",
+              value: componentScope,
+            });
+          }
+          const apkg = {
             group: pkgArr[0],
             name: pkgArr[1],
             version: versionStr,
-            qualifiers: { type: pkgArr[2] },
-          });
+            qualifiers,
+            scope,
+            properties,
+            purl: purlString,
+            "bom-ref": decodeURIComponent(purlString),
+          };
+          if (pomFile) {
+            properties.push({
+              name: "SrcFile",
+              value: pomFile,
+            });
+            apkg.evidence = {
+              identity: {
+                field: "purl",
+                confidence: 0.5,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 0.5,
+                    value: pomFile,
+                  },
+                ],
+              },
+            };
+          }
+          deps.push(apkg);
           if (!level_trees[purlString]) {
             level_trees[purlString] = [];
           }
@@ -6282,14 +6400,19 @@ export function parseCsProjData(csProjData, projFile, pkgNameVersions = {}) {
   if (!csProjData) {
     return pkgList;
   }
-  const projects = xml2js(csProjData, {
-    compact: true,
-    alwaysArray: true,
-    spaces: 4,
-    textKey: "_",
-    attributesKey: "$",
-    commentKey: "value",
-  }).Project;
+  let projects = undefined;
+  try {
+    projects = xml2js(csProjData, {
+      compact: true,
+      alwaysArray: true,
+      spaces: 4,
+      textKey: "_",
+      attributesKey: "$",
+      commentKey: "value",
+    }).Project;
+  } catch (e) {
+    console.log(`Unable to parse ${projFile} with utf-8 encoding!`);
+  }
   if (!projects || projects.length === 0) {
     return pkgList;
   }
@@ -10222,9 +10345,7 @@ async function queryNuget(p, NUGET_URL) {
     let version = `${tmpVersion.major}.${tmpVersion.minor}.${tmpVersion.patch}`;
     if (compare(version, upper) === 1) {
       if (tmpVersion.patch > 0) {
-        version = `${tmpVersion.major}.${tmpVersion.minor}.${(
-          tmpVersion.patch - 1
-        ).toString()}`;
+        version = `${tmpVersion.major}.${tmpVersion.minor}.${(tmpVersion.patch - 1).toString()}`;
       }
     }
     return version;
@@ -10540,3 +10661,27 @@ export function parseMakeDFile(dfile) {
   pkgFilesMap[pkgName] = Array.from(filesList);
   return pkgFilesMap;
 }
+
+/**
+ * Function to validate an externalReference URL for conforming to the JSON schema or bomLink
+ * https://github.com/CycloneDX/cyclonedx-core-java/blob/75575318b268dda9e2a290761d7db11b4f414255/src/main/resources/bom-1.5.schema.json#L1140
+ * https://datatracker.ietf.org/doc/html/rfc3987#section-2.2
+ * https://cyclonedx.org/capabilities/bomlink/
+ *
+ * @param {String} iri IRI to validate
+ *
+ * @returns {Boolean} Flag indicating whether the supplied URL is valid or not
+ *
+ */
+export function isValidIriReference(iri) {
+  const result = validateIri(iri, IriValidationStrategy.Strict);
+
+  if (result instanceof Error) {
+    if (DEBUG_MODE) {
+      console.log(`IRI failed validation ${iri}`);
+    }
+    return false;
+  }
+
+  return true;
+}

package/utils.test.js

@@ -13,6 +13,7 @@ import {
   getNugetMetadata,
   getPyMetadata,
   guessPypiMatchingVersion,
+  isValidIriReference,
   parseBazelActionGraph,
   parseBazelBuild,
   parseBazelSkyframe,
@@ -525,10 +526,14 @@ test("parse maven tree", () => {
   expect(parsedList.pkgList.length).toEqual(61);
   expect(parsedList.dependenciesList.length).toEqual(61);
   expect(parsedList.pkgList[0]).toEqual({
+    "bom-ref": "pkg:maven/com.pogeyan.cmis/copper-server@1.15.2?type=war",
     group: "com.pogeyan.cmis",
     name: "copper-server",
     version: "1.15.2",
     qualifiers: { type: "war" },
+    properties: [],
+    purl: "pkg:maven/com.pogeyan.cmis/copper-server@1.15.2?type=war",
+    scope: undefined,
   });
   expect(parsedList.dependenciesList[0]).toEqual({
     ref: "pkg:maven/com.pogeyan.cmis/copper-server@1.15.2?type=war",
@@ -559,17 +564,24 @@ test("parse maven tree", () => {
       encoding: "utf-8",
     }),
   );
-  expect(parsedList.pkgList.length).toEqual(37);
-  expect(parsedList.dependenciesList.length).toEqual(37);
+  expect(parsedList.pkgList.length).toEqual(39);
+  expect(parsedList.dependenciesList.length).toEqual(39);
   expect(parsedList.pkgList[0]).toEqual({
+    "bom-ref":
+      "pkg:maven/com.gitlab.security_products.tests/java-maven@1.0-SNAPSHOT?type=jar",
+    purl: "pkg:maven/com.gitlab.security_products.tests/java-maven@1.0-SNAPSHOT?type=jar",
     group: "com.gitlab.security_products.tests",
     name: "java-maven",
     version: "1.0-SNAPSHOT",
     qualifiers: { type: "jar" },
+    properties: [],
+    scope: undefined,
   });
   expect(parsedList.dependenciesList[0]).toEqual({
     ref: "pkg:maven/com.gitlab.security_products.tests/java-maven@1.0-SNAPSHOT?type=jar",
     dependsOn: [
+      "pkg:maven/com.github.jnr/jffi@1.3.11?type=jar",
+      "pkg:maven/com.github.jnr/jffi@1.3.11?classifier=native&type=jar",
       "pkg:maven/org.powermock/powermock-api-mockito@1.7.3?type=jar",
       "pkg:maven/io.netty/netty@3.9.1.Final?type=jar",
       "pkg:maven/junit/junit@3.8.1?type=jar",
@@ -586,16 +598,26 @@ test("parse maven tree", () => {
   );
   expect(parsedList.pkgList.length).toEqual(79);
   expect(parsedList.pkgList[0]).toEqual({
+    "bom-ref":
+      "pkg:maven/example.group/eclipse-repository@1.0.0-SNAPSHOT?type=eclipse-repository",
+    purl: "pkg:maven/example.group/eclipse-repository@1.0.0-SNAPSHOT?type=eclipse-repository",
     group: "example.group",
     name: "eclipse-repository",
     version: "1.0.0-SNAPSHOT",
     qualifiers: { type: "eclipse-repository" },
+    scope: undefined,
+    properties: [],
   });
   expect(parsedList.pkgList[4]).toEqual({
+    "bom-ref":
+      "pkg:maven/p2.eclipse.plugin/com.ibm.icu@67.1.0.v20200706-1749?type=eclipse-plugin",
+    purl: "pkg:maven/p2.eclipse.plugin/com.ibm.icu@67.1.0.v20200706-1749?type=eclipse-plugin",
     group: "p2.eclipse.plugin",
     name: "com.ibm.icu",
     version: "67.1.0.v20200706-1749",
     qualifiers: { type: "eclipse-plugin" },
+    scope: undefined,
+    properties: [],
   });
   expect(parsedList.dependenciesList.length).toEqual(79);
   expect(parsedList.dependenciesList[0]).toEqual({
@@ -2369,14 +2391,14 @@ test("parsePkgLock v2 workspace", async () => {
 });
 
 test("parsePkgLock v3", async () => {
-  let parsedList = await parsePkgLock(
+  const parsedList = await parsePkgLock(
     "./test/data/package-json/v3/package-lock.json",
     {
       projectVersion: "latest",
       projectName: "cdxgen",
     },
   );
-  let deps = parsedList.pkgList;
+  const deps = parsedList.pkgList;
   expect(deps.length).toEqual(161);
   expect(deps[1]._integrity).toEqual(
     "sha512-s93jiP6GkRApn5duComx6RLwtP23YrulPxShz+8peX7svd6Q+MS8nKLhKCCazbP92C13eTVaIOxgeLt0ezIiCg==",
@@ -2393,13 +2415,6 @@ test("parsePkgLock v3", async () => {
   });
   expect(deps[deps.length - 1].name).toEqual("uid2");
   expect(parsedList.dependenciesList.length).toEqual(161);
-  parsedList = await parsePkgLock("./package-lock.json", {
-    projectVersion: "latest",
-    projectName: "cdxgen",
-  });
-  deps = parsedList.pkgList;
-  expect(deps.length).toEqual(848);
-  expect(parsedList.dependenciesList.length).toEqual(848);
 });
 
 test("parseBowerJson", async () => {
@@ -2664,6 +2679,39 @@ test("parsePnpmLock", async () => {
       },
     },
   });
+  parsedList = await parsePnpmLock("./pnpm-lock.yaml");
+  expect(parsedList.pkgList.length).toEqual(644);
+  expect(parsedList.dependenciesList.length).toEqual(644);
+  expect(parsedList.pkgList[0]).toEqual({
+    group: "@ampproject",
+    name: "remapping",
+    version: "2.3.0",
+    purl: "pkg:npm/%40ampproject/remapping@2.3.0",
+    "bom-ref": "pkg:npm/@ampproject/remapping@2.3.0",
+    _integrity:
+      "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
+    properties: [{ name: "SrcFile", value: "./pnpm-lock.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./pnpm-lock.yaml",
+          },
+        ],
+      },
+    },
+  });
+  expect(parsedList.dependenciesList[0]).toEqual({
+    ref: "pkg:npm/@ampproject/remapping@2.3.0",
+    dependsOn: [
+      "pkg:npm/@jridgewell/gen-mapping@0.3.5",
+      "pkg:npm/@jridgewell/trace-mapping@0.3.25",
+    ],
+  });
 });
 
 test("parseYarnLock", async () => {
@@ -4040,3 +4088,20 @@ test("parseMakeDFile tests", () => {
     ],
   });
 });
+
+test.each([
+  ["", false],
+  ["git@gitlab.com:behat-chrome/chrome-mink-driver.git", false],
+  ["     git@gitlab.com:behat-chrome/chrome-mink-driver.git      ", false],
+  ["${repository.url}", false],
+  // bomLink - https://cyclonedx.org/capabilities/bomlink/]
+  ["urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#componentA", true],
+  // http uri - https://www.ietf.org/rfc/rfc7230.txt]
+  ["https://gitlab.com/behat-chrome/chrome-mink-driver.git", true],
+  ["     https://gitlab.com/behat-chrome/chrome-mink-driver.git     ", false],
+  ["http://gitlab.com/behat-chrome/chrome-mink-driver.git", true],
+  ["git+https://github.com/Alex-D/check-disk-space.git", true],
+  ["UNKNOWN", false],
+])("isValidIriReference tests: %s", (url, isValid) => {
+  expect(isValidIriReference(url)).toBe(isValid);
+});