@cyclonedx/cdxgen 11.4.1 → 11.4.3

package/lib/helpers/utils.test.js

@@ -1,9 +1,11 @@
 import { Buffer } from "node:buffer";
 import { readFileSync } from "node:fs";
 import path from "node:path";
+
 import { afterAll, beforeAll, describe, expect, test } from "@jest/globals";
 import { parse } from "ssri";
 import { parse as loadYaml } from "yaml";
+
 import {
   buildObjectForCocoaPod,
   buildObjectForGradleModule,
@@ -11,12 +13,10 @@ import {
   findLicenseId,
   getCratesMetadata,
   getDartMetadata,
-  getGoPkgLicense,
   getLicenses,
   getMvnMetadata,
   getNugetMetadata,
   getPyMetadata,
-  getRepoLicense,
   guessPypiMatchingVersion,
   hasAnyProjectType,
   isPackageManagerAllowed,
@@ -55,11 +55,11 @@ import {
   parseGoListDep,
   parseGoModData,
   parseGoModGraph,
-  parseGoModWhy,
   parseGoModulesTxt,
-  parseGoVersionData,
+  parseGoModWhy,
   parseGopkgData,
   parseGosumData,
+  parseGoVersionData,
   parseGradleDep,
   parseGradleProjects,
   parseGradleProperties,
@@ -2475,19 +2475,17 @@ test("parse github actions workflow data", () => {
     readFileSync("./.github/workflows/nodejs.yml", { encoding: "utf-8" }),
   );
   expect(dep_list.length).toEqual(8);
-  expect(dep_list[0]).toEqual({
+  expect(dep_list[0]).toMatchObject({
     group: "actions",
     name: "checkout",
-    version: "v4",
   });
   dep_list = parseGitHubWorkflowData(
     readFileSync("./.github/workflows/repotests.yml", { encoding: "utf-8" }),
   );
   expect(dep_list.length).toEqual(13);
-  expect(dep_list[0]).toEqual({
+  expect(dep_list[0]).toMatchObject({
     group: "actions",
     name: "checkout",
-    version: "v4",
   });
 });
 
@@ -3806,8 +3804,8 @@ test("parsePnpmLock", async () => {
   expect(parsedList.dependenciesList).toHaveLength(462);
   expect(parsedList.pkgList.filter((pkg) => !pkg.scope)).toHaveLength(3);
   parsedList = await parsePnpmLock("./pnpm-lock.yaml");
-  expect(parsedList.pkgList.length).toEqual(591);
-  expect(parsedList.dependenciesList.length).toEqual(591);
+  expect(parsedList.pkgList.length).toEqual(593);
+  expect(parsedList.dependenciesList.length).toEqual(593);
   expect(parsedList.pkgList[0]).toEqual({
     group: "@ampproject",
     name: "remapping",
@@ -4537,6 +4535,23 @@ test("parseGemfileLockData", async () => {
   expect(retMap.pkgList.length).toEqual(139);
   expect(retMap.rootList.length).toEqual(22);
   expect(retMap.dependenciesList.length).toEqual(139);
+  retMap = await parseGemfileLockData(
+    readFileSync("./test/data/Gemfile-opt.lock", { encoding: "utf-8" }),
+    "./test/data/Gemfile-opt.lock",
+  );
+  expect(retMap.pkgList.length).toEqual(37);
+  expect(retMap.rootList.length).toEqual(8);
+  expect(retMap.rootList).toEqual([
+    "pkg:gem/http_parser.rb@0.8.0",
+    "pkg:gem/jekyll@4.3.4",
+    "pkg:gem/jekyll-feed@0.17.0",
+    "pkg:gem/jekyll-readme-index@0.3.0",
+    "pkg:gem/tzinfo@2.0.6",
+    "pkg:gem/tzinfo-data",
+    "pkg:gem/wdm",
+    "pkg:gem/webrick@1.8.2",
+  ]);
+  expect(retMap.dependenciesList.length).toEqual(37);
 });
 
 test("toGemModuleName", () => {
@@ -5772,6 +5787,19 @@ test("parsePackageJsonName tests", () => {
     projectName: null,
     scope: "@babel",
   });
+  expect(() => parsePackageJsonName(null)).not.toThrow();
+  expect(parsePackageJsonName(null)).toEqual({
+    fullName: "",
+    moduleName: "",
+    projectName: "",
+    scope: null,
+  });
+  expect(parsePackageJsonName(undefined)).toEqual({
+    fullName: "",
+    moduleName: "",
+    projectName: "",
+    scope: null,
+  });
 });
 
 test("parseDot tests", () => {
@@ -5869,6 +5897,7 @@ test("parseMakeDFile tests", () => {
   });
 });
 
+// biome-ignore-start lint/suspicious/noTemplateCurlyInString: This is a unit test
 test.each([
   ["", false],
   ["git@gitlab.com:behat-chrome/chrome-mink-driver.git", false],
@@ -5893,6 +5922,7 @@ test.each([
 ])("isValidIriReference tests: %s", (url, isValid) => {
   expect(isValidIriReference(url)).toBe(isValid);
 });
+// biome-ignore-end lint/suspicious/noTemplateCurlyInString: This is a unit test
 
 test("hasAnyProjectType tests", () => {
   expect(

package/lib/helpers/validator.js

@@ -1,12 +1,12 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
 import { PackageURL } from "packageurl-js";
-import { DEBUG_MODE, dirNameStr, isPartialTree } from "./utils.js";
 
-import { URL } from "node:url";
 import { thoughtLog } from "./logger.js";
+import { DEBUG_MODE, dirNameStr, isPartialTree } from "./utils.js";
 
 const dirName = dirNameStr;
 
@@ -185,7 +185,7 @@ export const validatePurls = (bomJson) => {
               `purl does not include namespace but includes encoded slash in name for npm type. ${comp.purl}`,
             );
           }
-        } catch (ex) {
+        } catch (_ex) {
           errorList.push(`Invalid purl ${comp.purl}`);
         }
       }
@@ -263,7 +263,7 @@ export const validateRefs = (bomJson) => {
       try {
         const purlObj = PackageURL.fromString(dep.ref);
         parentPurlType = purlObj.type;
-      } catch (e) {
+      } catch (_e) {
         // pass
       }
       if (
@@ -287,7 +287,7 @@ export const validateRefs = (bomJson) => {
           try {
             const purlObj = PackageURL.fromString(don);
             childPurlType = purlObj.type;
-          } catch (e) {
+          } catch (_e) {
             // pass
           }
           if (

package/lib/managers/binary.js

@@ -10,22 +10,24 @@ import {
 import { arch as _arch, platform as _platform, homedir } from "node:os";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import process from "node:process";
+
 import { PackageURL } from "packageurl-js";
+
 import {
-  DEBUG_MODE,
-  MAX_BUFFER,
-  TIMEOUT_MS,
   adjustLicenseInformation,
   collectExecutables,
   collectSharedLibs,
+  DEBUG_MODE,
   dirNameStr,
   extractPathEnv,
   findLicenseId,
   getTmpDir,
   isSpdxLicenseExpression,
+  MAX_BUFFER,
   multiChecksumFile,
   safeMkdirSync,
   safeSpawnSync,
+  TIMEOUT_MS,
 } from "../helpers/utils.js";
 
 const dirName = dirNameStr;
@@ -444,7 +446,7 @@ export async function getOSPackages(src, imageConfig) {
     try {
       safeMkdirSync(join(trivyCacheDir, "db"), { recursive: true });
       safeMkdirSync(join(trivyCacheDir, "java-db"), { recursive: true });
-    } catch (err) {
+    } catch (_err) {
       // ignore errors
     }
     if (existsSync(src)) {
@@ -492,7 +494,7 @@ export async function getOSPackages(src, imageConfig) {
             encoding: "utf-8",
           }),
         );
-      } catch (e) {
+      } catch (_e) {
         // ignore errors
       }
       // Clean up
@@ -505,7 +507,7 @@ export async function getOSPackages(src, imageConfig) {
         }
       }
       const osReleaseData = {};
-      let osReleaseFile = undefined;
+      let osReleaseFile;
       // Let's try to read the os-release file from various locations
       if (existsSync(join(src, "etc", "os-release"))) {
         osReleaseFile = join(src, "etc", "os-release");
@@ -596,7 +598,7 @@ export async function getOSPackages(src, imageConfig) {
             // Fix the group
             let group = dirname(comp.name);
             const name = basename(comp.name);
-            let purlObj = undefined;
+            let purlObj;
             if (group === ".") {
               group = "";
             }
@@ -681,7 +683,7 @@ export async function getOSPackages(src, imageConfig) {
                   ).toString();
                   comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
-              } catch (err) {
+              } catch (_err) {
                 // continue regardless of error
               }
             }
@@ -752,8 +754,8 @@ export async function getOSPackages(src, imageConfig) {
               }
             }
             const compProperties = comp.properties;
-            let srcName = undefined;
-            let srcVersion = undefined;
+            let srcName;
+            let srcVersion;
             if (compProperties && Array.isArray(compProperties)) {
               for (const aprop of compProperties) {
                 if (aprop.name.endsWith("SrcName")) {
@@ -895,12 +897,12 @@ const retrieveDependencies = (tmpDependencies, origBomRef, comp) => {
           }
         }
         dependsOn.add(decodeURIComponent(tmpPurl.toString()));
-      } catch (e) {
+      } catch (_e) {
         // ignore
       }
     });
     return { ref: comp["bom-ref"], dependsOn: Array.from(dependsOn).sort() };
-  } catch (e) {
+  } catch (_e) {
     // ignore
   }
   return undefined;
@@ -943,7 +945,7 @@ export function executeOsQuery(query) {
         if (cmdOutput !== "") {
           try {
             return JSON.parse(cmdOutput);
-          } catch (err) {
+          } catch (_err) {
             // ignore
             if (DEBUG_MODE) {
               console.log("Unable to parse the output from query", query);
@@ -1060,7 +1062,7 @@ async function fileComponents(basePath, fileList, fileType) {
         { alg: "MD5", content: hashValues["md5"] },
         { alg: "SHA-1", content: hashValues["sha1"] },
       ];
-    } catch (e) {
+    } catch (_e) {
       // ignore
     }
     // Collect methods returns relative paths from the extracted directory.
@@ -1081,7 +1083,7 @@ async function fileComponents(basePath, fileList, fileType) {
       isSetuid = !!(mode & 0o4000);
       isSetgid = !!(mode & 0o2000);
       isSticky = !!(mode & 0o1000);
-    } catch (e) {
+    } catch (_e) {
       // ignore
     }
     const properties = [{ name: "SrcFile", value: f }];

package/lib/managers/docker.js

@@ -3,8 +3,8 @@ import {
   createReadStream,
   lstatSync,
   mkdtempSync,
-  readFileSync,
   readdirSync,
+  readFileSync,
   rmSync,
   statSync,
 } from "node:fs";
@@ -13,18 +13,20 @@ import { basename, join, resolve, win32 } from "node:path";
 import process from "node:process";
 import stream from "node:stream/promises";
 import { URL } from "node:url";
+
 import { globSync } from "glob";
 import got from "got";
 import { x } from "tar";
+
 import {
   DEBUG_MODE,
-  TIMEOUT_MS,
   extractPathEnv,
   getAllFiles,
   getTmpDir,
   safeExistsSync,
   safeMkdirSync,
   safeSpawnSync,
+  TIMEOUT_MS,
 } from "../helpers/utils.js";
 
 export const isWin = _platform() === "win32";
@@ -40,7 +42,7 @@ if (NON_STRICT_TAR_EXTRACT) {
   );
 }
 
-let dockerConn = undefined;
+let dockerConn;
 let isPodman = false;
 let isPodmanRootless = true;
 let isDockerRootless = false;
@@ -48,8 +50,8 @@ let isDockerRootless = false;
 let isContainerd = !!process.env.CONTAINERD_ADDRESS;
 const WIN_LOCAL_TLS = "http://localhost:2375";
 let isWinLocalTLS = false;
-let isNerdctl = undefined;
-let isColima = undefined;
+let isNerdctl;
+let isColima;
 
 if (
   !process.env.DOCKER_HOST &&
@@ -176,7 +178,7 @@ export const getDirs = (dirPath, dirName, hidden = false, recurse = true) => {
       follow: false,
       dot: hidden,
     });
-  } catch (err) {
+  } catch (_err) {
     return [];
   }
 };
@@ -192,7 +194,7 @@ function getDirectories(srcpath) {
       .filter((path) => {
         try {
           return statSync(path).isDirectory();
-        } catch (e) {
+        } catch (_e) {
           return false;
         }
       });
@@ -212,7 +214,7 @@ export const getOnlyDirs = (srcpath, dirName) => {
                 return getOnlyDirs(p, dirName);
               }
             }
-          } catch (err) {
+          } catch (_err) {
             // ignore
           }
         })
@@ -326,7 +328,7 @@ const getDefaultOptions = (forRegistry) => {
             }
           }
         }
-      } catch (err) {
+      } catch (_err) {
         // pass
       }
     }
@@ -424,7 +426,7 @@ export const getConnection = async (options, forRegistry) => {
           );
         }
       }
-    } catch (err) {
+    } catch (_err) {
       opts.prefixUrl = `http://unix:${homedir()}/.docker/run/docker.sock:`;
       try {
         await got.get("_ping", opts);
@@ -434,7 +436,7 @@ export const getConnection = async (options, forRegistry) => {
           console.log("Docker service in rootless mode detected.");
         }
         return dockerConn;
-      } catch (err) {
+      } catch (_err) {
         // ignore
       }
       try {
@@ -458,7 +460,7 @@ export const getConnection = async (options, forRegistry) => {
             );
           }
         }
-      } catch (err) {
+      } catch (_err) {
         try {
           opts.prefixUrl = opts.podmanPrefixUrl;
           await got.get("libpod/_ping", opts);
@@ -468,7 +470,7 @@ export const getConnection = async (options, forRegistry) => {
           console.log(
             "Podman in root mode detected. Consider switching to rootless mode to improve security. See https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md",
           );
-        } catch (err) {
+        } catch (_err) {
           if (_platform() === "win32") {
             console.warn(
               "Ensure Docker for Desktop is running as an administrator with 'Exposing daemon on TCP without TLS' setting turned on.",
@@ -634,8 +636,8 @@ const needsCliFallback = () => {
  * Method to get image to the local registry by pulling from the remote if required
  */
 export const getImage = async (fullImageName) => {
-  let localData = undefined;
-  let pullData = undefined;
+  let localData;
+  let pullData;
   const { registry, repo, tag, digest } = parseImageName(fullImageName);
   const repoWithTag =
     registry && registry !== DOCKER_HUB_REGISTRY
@@ -672,7 +674,7 @@ export const getImage = async (fullImageName) => {
             needsPull = false;
             break;
           }
-        } catch (err) {
+        } catch (_err) {
           // continue regardless of error
         }
       }
@@ -712,7 +714,7 @@ export const getImage = async (fullImageName) => {
         }
         return inspectData;
       }
-    } catch (err) {
+    } catch (_err) {
       // continue regardless of error
     }
   }
@@ -725,12 +727,12 @@ export const getImage = async (fullImageName) => {
     if (localData) {
       return localData;
     }
-  } catch (err) {
+  } catch (_err) {
     // ignore
   }
   try {
     localData = await makeRequest(`images/${repo}/json`, "GET", registry);
-  } catch (err) {
+  } catch (_err) {
     try {
       localData = await makeRequest(
         `images/${fullImageName}/json`,
@@ -740,7 +742,7 @@ export const getImage = async (fullImageName) => {
       if (localData) {
         return localData;
       }
-    } catch (err) {
+    } catch (_err) {
       // ignore
     }
     if (DEBUG_MODE) {
@@ -768,7 +770,7 @@ export const getImage = async (fullImageName) => {
         );
         return undefined;
       }
-    } catch (err) {
+    } catch (_err) {
       try {
         if (DEBUG_MODE) {
           console.log(`Re-trying the pull with the name ${repoWithTag}.`);
@@ -778,7 +780,7 @@ export const getImage = async (fullImageName) => {
           "POST",
           registry,
         );
-      } catch (err) {
+      } catch (_err) {
         // continue regardless of error
       }
     }
@@ -794,7 +796,7 @@ export const getImage = async (fullImageName) => {
       if (localData) {
         return localData;
       }
-    } catch (err) {
+    } catch (_err) {
       try {
         if (DEBUG_MODE) {
           console.log(`Trying with ${repo}`);
@@ -803,7 +805,7 @@ export const getImage = async (fullImageName) => {
         if (localData) {
           return localData;
         }
-      } catch (err) {
+      } catch (_err) {
         // continue regardless of error
       }
       try {
@@ -815,7 +817,7 @@ export const getImage = async (fullImageName) => {
           "GET",
           registry,
         );
-      } catch (err) {
+      } catch (_err) {
         // continue regardless of error
       }
     }
@@ -1005,7 +1007,7 @@ export const exportArchive = async (fullImageName, options = {}) => {
     }
     console.log(`Unable to extract image archive to ${tempDir}`);
     options.failOnError && process.exit(1);
-  } catch (err) {
+  } catch (_err) {
     // ignore
     options.failOnError && process.exit(1);
   }
@@ -1061,7 +1063,7 @@ export const extractFromManifest = async (
           );
           continue;
         }
-      } catch (e) {
+      } catch (_e) {
         console.log(`Skipping layer ${layer} since it is not a readable file.`);
         continue;
       }
@@ -1100,7 +1102,7 @@ export const extractFromManifest = async (
         lastWorkingDir = lastLayerConfig.config?.WorkingDir
           ? join(allLayersExplodedDir, lastLayerConfig.config.WorkingDir)
           : "";
-      } catch (err) {
+      } catch (_err) {
         options.failOnError && process.exit(1);
       }
     }
@@ -1210,7 +1212,7 @@ export const exportImage = async (fullImageName, options) => {
           onReadEntry: handleAbsolutePath,
         }),
       );
-    } catch (err) {
+    } catch (_err) {
       if (localData?.Id) {
         console.log(`Retrying with ${localData.Id}`);
         try {
@@ -1232,7 +1234,7 @@ export const exportImage = async (fullImageName, options) => {
               onReadEntry: handleAbsolutePath,
             }),
           );
-        } catch (err) {
+        } catch (_err) {
           // ignore
         }
       }
@@ -1422,7 +1424,7 @@ export const getCredsFromHelper = (exeSuffix, serverAddress) => {
       );
       registry_auth_keys[serverAddress] = authKey;
       return authKey;
-    } catch (err) {
+    } catch (_err) {
       return undefined;
     }
   }

package/lib/managers/docker.test.js

@@ -1,5 +1,7 @@
 import process from "node:process";
+
 import { beforeEach, describe, expect, test } from "@jest/globals";
+
 import {
   addSkippedSrcFiles,
   exportImage,

package/lib/managers/oci.js

@@ -1,10 +1,11 @@
 import { Buffer } from "node:buffer";
 import fs from "node:fs";
+
 import {
-  MAX_BUFFER,
   getAllFiles,
   getTmpDir,
   isWin,
+  MAX_BUFFER,
   safeSpawnSync,
 } from "../helpers/utils.js";
 

package/lib/managers/piptree.js

@@ -12,6 +12,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { delimiter, join } from "node:path";
+
 import { getTmpDir, safeSpawnSync } from "../helpers/utils.js";
 
 const PIP_TREE_PLUGIN_CONTENT = `