@cyclonedx/cdxgen 11.1.5 → 11.1.7

package/bin/cdxgen.js

@@ -28,6 +28,7 @@ import {
   isMac,
   isSecureMode,
   isWin,
+  safeExistsSync,
 } from "../lib/helpers/utils.js";
 import { validateBom } from "../lib/helpers/validator.js";
 import { postProcess } from "../lib/stages/postgen/postgen.js";
@@ -579,7 +580,9 @@ const checkPermissions = (filePath, options) => {
       console.log(
         "\x1b[1;35mSecure mode requires permission-related arguments. These can be passed as CLI arguments directly to the node runtime or set the NODE_OPTIONS environment variable as shown below.\x1b[0m",
       );
-      const nodeOptionsVal = `--permission --allow-fs-read="${getTmpDir()}/*" --allow-fs-write="${getTmpDir()}/*" --allow-fs-read="${fullFilePath}/*" --allow-fs-write="${options.output}" --allow-child-process`;
+      const childProcessArgs =
+        options?.lifecycle !== "pre-build" ? " --allow-child-process" : "";
+      const nodeOptionsVal = `--permission --allow-fs-read="${getTmpDir()}/*" --allow-fs-write="${getTmpDir()}/*" --allow-fs-read="${fullFilePath}/*" --allow-fs-write="${options.output}"${childProcessArgs}`;
       console.log(
         `${isWin ? "$env:" : "export "}NODE_OPTIONS='${nodeOptionsVal}'`,
       );
@@ -680,11 +683,11 @@ const checkPermissions = (filePath, options) => {
   }
   if (!process.permission.has("fs.write", getTmpDir())) {
     console.log(
-      `FileSystemWrite permission may be required to the TEMP directory. Please invoke cdxgen with the argument --allow-fs-write="${join(getTmpDir(), "*")}"`,
+      `FileSystemWrite permission may be required for the TEMP directory. Please invoke cdxgen with the argument --allow-fs-write="${join(getTmpDir(), "*")}" in case of any crashes.`,
     );
     if (isMac) {
       console.log(
-        "TIP: macOS doesn't use `/tmp` prefix for TEMP directories. Use the argument shown above.",
+        "TIP: macOS doesn't use the `/tmp` prefix for TEMP directories. Use the argument shown above.",
       );
     }
   }
@@ -752,7 +755,7 @@ const checkPermissions = (filePath, options) => {
           (process.env.SBOM_SIGN_ALGORITHM &&
             process.env.SBOM_SIGN_ALGORITHM !== "none" &&
             process.env.SBOM_SIGN_PRIVATE_KEY &&
-            fs.existsSync(process.env.SBOM_SIGN_PRIVATE_KEY)))
+            safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY)))
       ) {
         let alg = process.env.SBOM_SIGN_ALGORITHM || "RS512";
         if (alg.includes("none")) {
@@ -794,7 +797,7 @@ const checkPermissions = (filePath, options) => {
           );
           if (
             process.env.SBOM_SIGN_PUBLIC_KEY &&
-            fs.existsSync(process.env.SBOM_SIGN_PUBLIC_KEY)
+            safeExistsSync(process.env.SBOM_SIGN_PUBLIC_KEY)
           ) {
             jwkPublicKey = crypto
               .createPublicKey(

package/lib/cli/index.js

@@ -3,9 +3,7 @@ import { spawnSync } from "node:child_process";
 import {
   constants,
   accessSync,
-  existsSync,
   lstatSync,
-  mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -152,6 +150,8 @@ import {
   parseYarnLock,
   readZipEntry,
   recomputeScope,
+  safeExistsSync,
+  safeMkdirSync,
   shouldFetchLicense,
   splitOutputByGradleProjects,
 } from "../helpers/utils.js";
@@ -242,7 +242,7 @@ const createDefaultParentComponent = (
   path = resolve(path);
   // Create a parent component based on the directory name
   let dirNameStr =
-    existsSync(path) && lstatSync(path).isDirectory()
+    safeExistsSync(path) && lstatSync(path).isDirectory()
       ? basename(path)
       : dirname(path);
   const tmpA = dirNameStr.split(sep);
@@ -1274,7 +1274,7 @@ export function createBinaryBom(path, options) {
   const tempDir = mkdtempSync(join(getTmpDir(), "blint-tmp-"));
   const binaryBomFile = join(tempDir, "bom.json");
   getBinaryBom(path, binaryBomFile, options.deep);
-  if (existsSync(binaryBomFile)) {
+  if (safeExistsSync(binaryBomFile)) {
     const binaryBom = JSON.parse(
       readFileSync(binaryBomFile, { encoding: "utf-8" }),
     );
@@ -1307,7 +1307,7 @@ export async function createJavaBom(path, options) {
   // war/ear mode
   if (path.endsWith(".war") || path.endsWith(".jar")) {
     // Check if the file exists
-    if (existsSync(path)) {
+    if (safeExistsSync(path)) {
       if (DEBUG_MODE) {
         console.log(`Retrieving packages from ${path}`);
       }
@@ -1416,7 +1416,7 @@ export async function createJavaBom(path, options) {
         continue;
       }
       const settingsXml = join(basePath, "settings.xml");
-      if (existsSync(settingsXml)) {
+      if (safeExistsSync(settingsXml)) {
         console.log(
           `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`,
         );
@@ -1481,7 +1481,7 @@ export async function createJavaBom(path, options) {
           mvnTreeArgs = mvnTreeArgs.concat(addArgs);
         }
         // Automatically use settings.xml to improve the success for fallback
-        if (existsSync(settingsXml)) {
+        if (safeExistsSync(settingsXml)) {
           mvnTreeArgs.push("-s");
           mvnTreeArgs.push(settingsXml);
         }
@@ -1500,7 +1500,7 @@ export async function createJavaBom(path, options) {
             },
           );
           if (result.status === 0) {
-            if (existsSync(tempMvnParentTree)) {
+            if (safeExistsSync(tempMvnParentTree)) {
               const mvnTreeString = readFileSync(tempMvnParentTree, {
                 encoding: "utf-8",
               });
@@ -1582,7 +1582,7 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         } else {
-          if (existsSync(tempMvnTree)) {
+          if (safeExistsSync(tempMvnTree)) {
             const mvnTreeString = readFileSync(tempMvnTree, {
               encoding: "utf-8",
             });
@@ -1715,10 +1715,10 @@ export async function createJavaBom(path, options) {
   let gradleRootPath = path;
   if (
     gradleFiles?.length &&
-    !existsSync(join(path, "settings.gradle")) &&
-    !existsSync(join(path, "settings.gradle.kts")) &&
-    !existsSync(join(path, "build.gradle")) &&
-    !existsSync(join(path, "build.gradle.kts"))
+    !safeExistsSync(join(path, "settings.gradle")) &&
+    !safeExistsSync(join(path, "settings.gradle.kts")) &&
+    !safeExistsSync(join(path, "build.gradle")) &&
+    !safeExistsSync(join(path, "build.gradle.kts"))
   ) {
     gradleRootPath = dirname(gradleFiles[0]);
   }
@@ -1964,7 +1964,10 @@ export async function createJavaBom(path, options) {
         bazelTarget,
       ];
       // Automatically load any bazelrc file
-      if (!process.env.BAZEL_ARGS && existsSync(join(basePath, ".bazelrc"))) {
+      if (
+        !process.env.BAZEL_ARGS &&
+        safeExistsSync(join(basePath, ".bazelrc"))
+      ) {
         bArgs = ["--bazelrc=.bazelrc", "build", bazelTarget];
       }
       console.log("Executing", BAZEL_CMD, bArgs.join(" "), "in", basePath);
@@ -1988,7 +1991,10 @@ export async function createJavaBom(path, options) {
         let query = [...(process.env?.BAZEL_ARGS?.split(" ") || [])];
         let bazelParser;
         // Automatically load any bazelrc file
-        if (!process.env.BAZEL_ARGS && existsSync(join(basePath, ".bazelrc"))) {
+        if (
+          !process.env.BAZEL_ARGS &&
+          safeExistsSync(join(basePath, ".bazelrc"))
+        ) {
           query = ["--bazelrc=.bazelrc"];
         }
         if (["true", "1"].includes(process.env.BAZEL_USE_ACTION_GRAPH)) {
@@ -2121,7 +2127,7 @@ export async function createJavaBom(path, options) {
         sbtVersion != null && gte(sbtVersion, "1.4.0");
       const tempDir = mkdtempSync(join(getTmpDir(), "cdxsbt-"));
       const tempSbtgDir = mkdtempSync(join(getTmpDir(), "cdxsbtg-"));
-      mkdirSync(tempSbtgDir, { recursive: true });
+      safeMkdirSync(tempSbtgDir, { recursive: true });
       // Create temporary plugins file
       const tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
 
@@ -2191,7 +2197,7 @@ export async function createJavaBom(path, options) {
         if (!standalonePluginFile) {
           cleanupPlugin(basePath, pluginFile);
         }
-        if (existsSync(dlFile)) {
+        if (safeExistsSync(dlFile)) {
           const retMap = parseSbtTree(dlFile);
           if (retMap.pkgList?.length) {
             const tmpParentComponent = retMap.pkgList.splice(0, 1)[0];
@@ -2410,7 +2416,7 @@ export async function createNodejsBom(path, options) {
       // Projects such as juice-shop prevent lockfile creations using .npmrc files
       // Plus, they might require specific npm install args such as --legacy-peer-deps that could lead to strange node_modules structure
       // To keep life simple, let's look for any .npmrc file that has package-lock=false to toggle before npm install
-      if (pkgMgr === "npm" && existsSync(join(basePath, ".npmrc"))) {
+      if (pkgMgr === "npm" && safeExistsSync(join(basePath, ".npmrc"))) {
         const npmrcData = readFileSync(join(basePath, ".npmrc"));
         if (
           npmrcData?.includes("package-lock=false") &&
@@ -2606,7 +2612,7 @@ export async function createNodejsBom(path, options) {
       // Determine the parent component
       const packageJsonF = join(basePath, "package.json");
       if (!Object.keys(parentComponent).length) {
-        if (existsSync(packageJsonF)) {
+        if (safeExistsSync(packageJsonF)) {
           const pcs = await parsePkgJson(packageJsonF, true);
           if (pcs.length && Object.keys(pcs[0]).length) {
             parentComponent = { ...pcs[0] };
@@ -2687,7 +2693,7 @@ export async function createNodejsBom(path, options) {
       if (!Object.keys(parentComponent).length) {
         const basePath = dirname(f);
         const packageJsonF = join(basePath, "package.json");
-        if (existsSync(packageJsonF)) {
+        if (safeExistsSync(packageJsonF)) {
           const pcs = await parsePkgJson(packageJsonF, true);
           if (pcs.length && Object.keys(pcs[0]).length) {
             tmpParentComponent = { ...pcs[0] };
@@ -2727,13 +2733,13 @@ export async function createNodejsBom(path, options) {
     }
   }
   if (
-    existsSync(join(path, "rush.json")) &&
+    safeExistsSync(join(path, "rush.json")) &&
     isPackageManagerAllowed("rush", ["npm", "yarn", "pnpm"], options)
   ) {
     // Rush.js creates node_modules inside common/temp directory
     const nmDir = join(path, "common", "temp", "node_modules");
     // Do rush install if we don't have node_modules directory
-    if (!existsSync(nmDir)) {
+    if (!safeExistsSync(nmDir)) {
       console.log("Executing 'rush install --no-link'", path);
       const result = spawnSync(
         "rush",
@@ -2758,7 +2764,7 @@ export async function createNodejsBom(path, options) {
       "shrinkwrap-deps.json",
     );
     const pnpmLock = join(path, "common", "config", "rush", "pnpm-lock.yaml");
-    if (existsSync(swFile)) {
+    if (safeExistsSync(swFile)) {
       let pkgList = await parseNodeShrinkwrap(swFile);
       if (allImports && Object.keys(allImports).length) {
         pkgList = await addEvidenceForImports(
@@ -2774,7 +2780,7 @@ export async function createNodejsBom(path, options) {
         filename: "shrinkwrap-deps.json",
       });
     }
-    if (existsSync(pnpmLock)) {
+    if (safeExistsSync(pnpmLock)) {
       let pkgList = await parsePnpmLock(pnpmLock);
       if (allImports && Object.keys(allImports).length) {
         pkgList = await addEvidenceForImports(
@@ -2812,7 +2818,7 @@ export async function createNodejsBom(path, options) {
       const basePath = dirname(f);
       // Determine the parent component
       const packageJsonF = join(basePath, "package.json");
-      if (existsSync(packageJsonF)) {
+      if (safeExistsSync(packageJsonF)) {
         const pcs = await parsePkgJson(packageJsonF, true);
         if (pcs.length && Object.keys(pcs[0]).length) {
           const tmpParentComponent = { ...pcs[0] };
@@ -2899,7 +2905,7 @@ export async function createNodejsBom(path, options) {
   }
   // We might reach here if the project has no lock files
   // Eg: juice-shop
-  if (!pkgList.length && existsSync(join(path, "node_modules"))) {
+  if (!pkgList.length && safeExistsSync(join(path, "node_modules"))) {
     // Collect all package.json files from all node_modules directory
     const pkgJsonFiles = getAllFiles(
       path,
@@ -2914,7 +2920,7 @@ export async function createNodejsBom(path, options) {
       }
     }
     if (!parentComponent || !Object.keys(parentComponent).length) {
-      if (existsSync(join(path, "package.json"))) {
+      if (safeExistsSync(join(path, "package.json"))) {
         const pcs = await parsePkgJson(join(path, "package.json"), true);
         if (pcs.length && Object.keys(pcs[0]).length) {
           parentComponent = { ...pcs[0] };
@@ -2982,7 +2988,7 @@ export function createPixiBom(path, options) {
 
   // if pixi.toml file found then we
   // Add parentComponent Details
-  const pixiTomlMode = existsSync(pixiToml);
+  const pixiTomlMode = safeExistsSync(pixiToml);
   if (pixiTomlMode) {
     parentComponent = parsePixiTomlFile(pixiToml);
     parentComponent.type = "application";
@@ -2999,7 +3005,7 @@ export function createPixiBom(path, options) {
   }
 
   const pixiLockFile = join(path, "pixi.lock");
-  const pixiFilesMode = existsSync(pixiLockFile);
+  const pixiFilesMode = safeExistsSync(pixiLockFile);
   if (pixiFilesMode) {
     // Instead of what we do in createPythonBOM
     // where we install packages and run `getPipFrozenTree`
@@ -3012,7 +3018,7 @@ export function createPixiBom(path, options) {
       generatePixiLockFile(path);
 
       const pixiLockFile = join(path, "pixi.lock");
-      if (!existsSync(pixiLockFile) && DEBUG_MODE) {
+      if (!safeExistsSync(pixiLockFile) && DEBUG_MODE) {
         console.log(
           "Unexpected Error tried to generate pixi.lock file but failed.",
         );
@@ -3056,13 +3062,13 @@ export async function createPythonBom(path, options) {
   const tempDir = mkdtempSync(join(getTmpDir(), "cdxgen-venv-"));
   let parentComponent = createDefaultParentComponent(path, "pypi", options);
   // We are checking only the root here for pipenv
-  const pipenvMode = existsSync(join(path, "Pipfile"));
+  const pipenvMode = safeExistsSync(join(path, "Pipfile"));
 
   // If pixi is used then just return that as output instead
   const pixiLockFile = join(path, "pixi.lock");
-  const pixiFilesMode = existsSync(pixiLockFile);
+  const pixiFilesMode = safeExistsSync(pixiLockFile);
   const pixiToml = join(path, "pixi.toml");
-  const pixiTomlMode = existsSync(pixiToml);
+  const pixiTomlMode = safeExistsSync(pixiToml);
   if (pixiTomlMode || pixiFilesMode) {
     const BomNSData = createPixiBom(path, options);
     if (BomNSData) {
@@ -3123,7 +3129,7 @@ export async function createPythonBom(path, options) {
   // Is this a pyproject based project.
   // TODO: Support nested directories
   const pyProjectFile = join(path, "pyproject.toml");
-  const pyProjectMode = existsSync(pyProjectFile);
+  const pyProjectMode = safeExistsSync(pyProjectFile);
   if (pyProjectMode) {
     const pyProjMap = parsePyProjectTomlFile(pyProjectFile);
     const tmpParentComponent = pyProjMap.parentComponent;
@@ -3156,7 +3162,7 @@ export async function createPythonBom(path, options) {
 
   // TODO: Support for nested directories
   const setupPy = join(path, "setup.py");
-  const setupPyMode = existsSync(setupPy);
+  const setupPyMode = safeExistsSync(setupPy);
   // Poetry sets up its own virtual env containing site-packages so
   // we give preference to poetry lock file. Issue# 129
   if (poetryMode) {
@@ -3262,7 +3268,7 @@ export async function createPythonBom(path, options) {
       // TODO: Support for nested directories
       spawnSync("pipenv", ["install"], { cwd: path, encoding: "utf-8" });
       const piplockFile = join(path, "Pipfile.lock");
-      if (existsSync(piplockFile)) {
+      if (safeExistsSync(piplockFile)) {
         const lockData = JSON.parse(readFileSync(piplockFile));
         const dlist = await parsePiplockData(lockData);
         if (dlist?.length) {
@@ -3967,7 +3973,7 @@ export async function createRustBom(path, options) {
     if (
       options.deep === true ||
       (options.installDeps &&
-        !existsSync(f.replace(".toml", ".lock")) &&
+        !safeExistsSync(f.replace(".toml", ".lock")) &&
         ["build", "post-build"].includes(options.lifecycle))
     ) {
       const basePath = dirname(f);
@@ -5213,7 +5219,7 @@ export function createPHPBom(path, options) {
   );
   if (composerLockFiles.length) {
     // Look for any root composer.json to capture the parentComponent
-    if (existsSync(join(path, "composer.json"))) {
+    if (safeExistsSync(join(path, "composer.json"))) {
       const { moduleParent } = parseComposerJson(join(path, "composer.json"));
       parentComponent = moduleParent;
     }
@@ -5225,7 +5231,7 @@ export function createPHPBom(path, options) {
       }
       let rootRequires = [];
       // Is there a composer.json to find the module parent component
-      if (existsSync(join(basePath, "composer.json"))) {
+      if (safeExistsSync(join(basePath, "composer.json"))) {
         const retMap = parseComposerJson(join(basePath, "composer.json"));
         moduleParent = retMap.moduleParent;
         rootRequires = retMap.rootRequires;
@@ -5884,7 +5890,7 @@ export async function createCsharpBom(path, options) {
         join(path, options.depsSlicesFile) || join(getTmpDir(), "dosai.json"),
       );
       // Create the slices file if it doesn't exist
-      if (!existsSync(slicesFile)) {
+      if (!safeExistsSync(slicesFile)) {
         const sliceResult = getDotnetSlices(resolve(path), resolve(slicesFile));
         if (!sliceResult && DEBUG_MODE) {
           console.log(
@@ -6745,9 +6751,9 @@ export async function createXBom(path, options) {
     return undefined;
   }
   if (
-    existsSync(join(path, "package.json")) ||
-    existsSync(join(path, "rush.json")) ||
-    existsSync(join(path, "yarn.lock"))
+    safeExistsSync(join(path, "package.json")) ||
+    safeExistsSync(join(path, "rush.json")) ||
+    safeExistsSync(join(path, "yarn.lock"))
   ) {
     return await createNodejsBom(path, options);
   }
@@ -6773,10 +6779,11 @@ export async function createXBom(path, options) {
     return await createJavaBom(path, options);
   }
   // python
-  const pipenvMode = existsSync(join(path, "Pipfile"));
-  const poetryMode = existsSync(join(path, "poetry.lock"));
-  const pyProjectMode = !poetryMode && existsSync(join(path, "pyproject.toml"));
-  const setupPyMode = existsSync(join(path, "setup.py"));
+  const pipenvMode = safeExistsSync(join(path, "Pipfile"));
+  const poetryMode = safeExistsSync(join(path, "poetry.lock"));
+  const pyProjectMode =
+    !poetryMode && safeExistsSync(join(path, "pyproject.toml"));
+  const setupPyMode = safeExistsSync(join(path, "setup.py"));
   if (pipenvMode || poetryMode || pyProjectMode || setupPyMode) {
     return await createPythonBom(path, options);
   }
@@ -7111,7 +7118,7 @@ export async function createBom(path, options) {
       allLayersDir: path,
       allLayersExplodedDir: path,
     };
-    if (existsSync(join(path, "all-layers"))) {
+    if (safeExistsSync(join(path, "all-layers"))) {
       exportData.allLayersDir = join(path, "all-layers");
     }
     exportData.pkgPathList = getPkgPathList(exportData, undefined);

package/lib/evinser/evinser.js

@@ -16,6 +16,8 @@ import {
   getMavenCommand,
   getTimestamp,
   getTmpDir,
+  safeExistsSync,
+  safeMkdirSync,
 } from "../helpers/utils.js";
 import { postProcess } from "../stages/postgen/postgen.js";
 import { createSemanticsSlices } from "./swiftsem.js";
@@ -29,16 +31,16 @@ const typePurlsCache = {};
  * @param {Object} options Command line options
  */
 export async function prepareDB(options) {
-  if (!options.dbPath.includes("memory") && !fs.existsSync(options.dbPath)) {
+  if (!options.dbPath.includes("memory") && !safeExistsSync(options.dbPath)) {
     try {
-      fs.mkdirSync(options.dbPath, { recursive: true });
+      safeMkdirSync(options.dbPath, { recursive: true });
     } catch (e) {
       // ignore
     }
   }
   const dirPath = options._[0] || ".";
   const bomJsonFile = options.input;
-  if (!fs.existsSync(bomJsonFile)) {
+  if (!safeExistsSync(bomJsonFile)) {
     console.log(
       "Bom file doesn't exist. Check if cdxgen was invoked with the correct type argument.",
     );
@@ -102,7 +104,7 @@ export async function catalogMavenDeps(
   options = {},
 ) {
   let jarNSMapping = undefined;
-  if (fs.existsSync(path.join(dirPath, "bom.json.map"))) {
+  if (safeExistsSync(path.join(dirPath, "bom.json.map"))) {
     try {
       const mapData = JSON.parse(
         fs.readFileSync(path.join(dirPath, "bom.json.map"), "utf-8"),
@@ -190,7 +192,7 @@ export async function createAndStoreSlice(
 ) {
   const retMap = createSlice(purl, purlsJars[purl], "usages", options);
   let sliceData = undefined;
-  if (retMap?.slicesFile && fs.existsSync(retMap.slicesFile)) {
+  if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
     sliceData = await Usages.findOrCreate({
       where: { purl },
       defaults: {
@@ -245,7 +247,7 @@ export async function createSlice(
   );
   if (options?.output) {
     sliceOutputDir =
-      fs.existsSync(options.output) &&
+      safeExistsSync(options.output) &&
       fs.lstatSync(options.output).isDirectory()
         ? path.basename(options.output)
         : path.dirname(options.output);
@@ -290,7 +292,7 @@ export async function createSlice(
 
   args.push(path.resolve(filePath));
   const result = executeAtom(filePath, args);
-  if (!result || !fs.existsSync(slicesFile)) {
+  if (!result || !safeExistsSync(slicesFile)) {
     console.warn(
       `Unable to generate ${sliceType} slice using atom. Check if this is a supported language.`,
     );
@@ -378,7 +380,7 @@ export function initFromSbom(components, language) {
 }
 
 function usableSlicesFile(slicesFile) {
-  if (!slicesFile || !fs.existsSync(slicesFile)) {
+  if (!slicesFile || !safeExistsSync(slicesFile)) {
     return false;
   }
   const stats = fs.statSync(slicesFile);
@@ -432,7 +434,7 @@ export async function analyzeProject(dbObjMap, options) {
       );
     } else {
       retMap = await createSlice(language, dirPath, "reachables", options);
-      if (retMap?.slicesFile && fs.existsSync(retMap.slicesFile)) {
+      if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         reachablesSlicesFile = retMap.slicesFile;
         reachablesSlice = JSON.parse(
           fs.readFileSync(retMap.slicesFile, "utf-8"),
@@ -453,7 +455,7 @@ export async function analyzeProject(dbObjMap, options) {
   } else {
     // Generate our own slices
     retMap = await createSlice(language, dirPath, "usages", options);
-    if (retMap?.slicesFile && fs.existsSync(retMap.slicesFile)) {
+    if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
       usagesSlicesFile = retMap.slicesFile;
     }
@@ -463,7 +465,7 @@ export async function analyzeProject(dbObjMap, options) {
     // Reuse existing semantics slices
     if (
       options.semanticsSlicesFile &&
-      fs.existsSync(options.semanticsSlicesFile)
+      safeExistsSync(options.semanticsSlicesFile)
     ) {
       semanticsSlice = JSON.parse(
         fs.readFileSync(options.semanticsSlicesFile, "utf-8"),
@@ -472,7 +474,7 @@ export async function analyzeProject(dbObjMap, options) {
     } else {
       // Generate our own slices
       retMap = await createSlice(language, dirPath, "semantics", options);
-      if (retMap?.slicesFile && fs.existsSync(retMap.slicesFile)) {
+      if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         semanticsSlice = JSON.parse(
           fs.readFileSync(retMap.slicesFile, "utf-8"),
         );
@@ -507,7 +509,7 @@ export async function analyzeProject(dbObjMap, options) {
   if (options.withDataFlow) {
     if (
       options.dataFlowSlicesFile &&
-      fs.existsSync(options.dataFlowSlicesFile)
+      safeExistsSync(options.dataFlowSlicesFile)
     ) {
       dataFlowSlicesFile = options.dataFlowSlicesFile;
       dataFlowSlice = JSON.parse(
@@ -515,7 +517,7 @@ export async function analyzeProject(dbObjMap, options) {
       );
     } else {
       retMap = await createSlice(language, dirPath, "data-flow", options);
-      if (retMap?.slicesFile && fs.existsSync(retMap.slicesFile)) {
+      if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         dataFlowSlicesFile = retMap.slicesFile;
         dataFlowSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
       }
@@ -1359,7 +1361,7 @@ export function createEvinseFile(sliceArtefacts, options) {
     bomJson.dependencies = newDependencies;
   }
   if (options.annotate) {
-    if (usagesSlicesFile && fs.existsSync(usagesSlicesFile)) {
+    if (usagesSlicesFile && safeExistsSync(usagesSlicesFile)) {
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },
@@ -1367,7 +1369,7 @@ export function createEvinseFile(sliceArtefacts, options) {
         text: fs.readFileSync(usagesSlicesFile, "utf8"),
       });
     }
-    if (dataFlowSlicesFile && fs.existsSync(dataFlowSlicesFile)) {
+    if (dataFlowSlicesFile && safeExistsSync(dataFlowSlicesFile)) {
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },
@@ -1375,7 +1377,7 @@ export function createEvinseFile(sliceArtefacts, options) {
         text: fs.readFileSync(dataFlowSlicesFile, "utf8"),
       });
     }
-    if (reachablesSlicesFile && fs.existsSync(reachablesSlicesFile)) {
+    if (reachablesSlicesFile && safeExistsSync(reachablesSlicesFile)) {
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },

package/lib/helpers/envcontext.js

@@ -1,6 +1,5 @@
 import { Buffer } from "node:buffer";
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
 import { arch, homedir } from "node:os";
 import { delimiter, dirname, join } from "node:path";
 import process from "node:process";
@@ -23,18 +22,19 @@ import {
   getTmpDir,
   isMac,
   isWin,
+  safeExistsSync,
 } from "./utils.js";
 
 export const GIT_COMMAND = process.env.GIT_CMD || "git";
 
 // sdkman tool aliases
 export const SDKMAN_JAVA_TOOL_ALIASES = {
-  java8: process.env.JAVA8_TOOL || "8.0.432-tem",
+  java8: process.env.JAVA8_TOOL || "8.0.442-amzn", // Temurin no longer offers java8 :(
   java11: process.env.JAVA11_TOOL || "11.0.25-tem",
   java17: process.env.JAVA17_TOOL || "17.0.14-tem",
   java21: process.env.JAVA21_TOOL || "21.0.6-tem",
   java22: process.env.JAVA22_TOOL || "22.0.2-tem",
-  java23: process.env.JAVA23_TOOL || "23.0.1-tem",
+  java23: process.env.JAVA23_TOOL || "23.0.2-tem",
 };
 
 /**
@@ -421,9 +421,9 @@ const getCommandOutput = (cmd, dir, args) => {
 export function isSdkmanAvailable() {
   let isSdkmanSetup =
     ["SDKMAN_DIR", "SDKMAN_CANDIDATES_DIR"].filter(
-      (v) => process.env[v] && existsSync(process.env[v]),
+      (v) => process.env[v] && safeExistsSync(process.env[v]),
     ).length >= 1;
-  if (!isSdkmanSetup && existsSync(join(homedir(), ".sdkman", "bin"))) {
+  if (!isSdkmanSetup && safeExistsSync(join(homedir(), ".sdkman", "bin"))) {
     process.env.SDKMAN_DIR = join(homedir(), ".sdkman");
     process.env.SDKMAN_CANDIDATES_DIR = join(
       homedir(),
@@ -462,12 +462,12 @@ export function isSdkmanToolAvailable(toolType, toolName) {
   toolName = getSdkmanToolFullname(toolName);
   let isToolAvailable =
     process.env.SDKMAN_CANDIDATES_DIR &&
-    existsSync(
+    safeExistsSync(
       join(process.env.SDKMAN_CANDIDATES_DIR, toolType, toolName, "bin"),
     );
   if (
     !isToolAvailable &&
-    existsSync(
+    safeExistsSync(
       join(homedir(), ".sdkman", "candidates", toolType, toolName, "bin"),
     )
   ) {
@@ -549,7 +549,7 @@ export function installSdkmanTool(toolType, toolName) {
     );
   } else if (
     process.env.SDKMAN_CANDIDATES_DIR &&
-    existsSync(join(process.env.SDKMAN_CANDIDATES_DIR, toolType, toolName))
+    safeExistsSync(join(process.env.SDKMAN_CANDIDATES_DIR, toolType, toolName))
   ) {
     process.env[`${toolUpper}_HOME`] = join(
       process.env.SDKMAN_CANDIDATES_DIR,
@@ -740,7 +740,7 @@ export function bundleInstallWithDocker(rubyVersion, cdxgenGemHome, filePath) {
   if (result.error || result.status !== 0) {
     return false;
   }
-  if (existsSync(join(filePath, "Gemfile.lock"))) {
+  if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
     console.log(
       "Gemfile.lock was generated successfully. Thank you for trying this feature!",
     );
@@ -763,7 +763,7 @@ export function installRubyVersion(rubyVersion, filePath) {
     return { fullToolBinDir: undefined, status: true };
   }
   const fullToolBinDir = rubyVersionDir(rubyVersion);
-  if (existsSync(fullToolBinDir)) {
+  if (safeExistsSync(fullToolBinDir)) {
     const result = spawnSync(
       process.env.RBENV_CMD || "rbenv",
       ["local", rubyVersion],
@@ -861,7 +861,7 @@ export function installRubyBundler(rubyVersion, bundlerVersion) {
     bundlerWarningShown = true;
   }
   const fullToolBinDir = rubyVersionDir(rubyVersion);
-  if (existsSync(fullToolBinDir)) {
+  if (safeExistsSync(fullToolBinDir)) {
     const gemInstallArgs = ["install", "bundler"];
     if (bundlerVersion) {
       gemInstallArgs.push("-v");
@@ -1038,7 +1038,7 @@ export function performBundleInstall(
         "This project requires a specific version of RubyGems. To do this, the existing version must be uninstalled followed by installing the required version. `sudo gem uninstall rubygems-update -v <existing version>` and then `sudo gem install rubygems-update -v <required version>`.",
       );
       rubyVersionWarningShown = true;
-      if (existsSync(gemFileLock)) {
+      if (safeExistsSync(gemFileLock)) {
         console.log("Run `bundle install` command to troubleshoot the build.");
       } else {
         console.log(

package/lib/helpers/envcontext.test.js

@@ -41,7 +41,7 @@ test("tools tests", () => {
 test("sdkman tests", () => {
   if (process.env?.SDKMAN_VERSION) {
     expect(isSdkmanAvailable()).toBeTruthy();
-    expect(isSdkmanToolAvailable("java", "23.0.1-tem")).toBeTruthy();
+    expect(isSdkmanToolAvailable("java", "23.0.2-tem")).toBeTruthy();
   }
 });