@cyclonedx/cdxgen 12.1.1 → 12.1.3

package/lib/cli/index.js

@@ -3957,7 +3957,7 @@ export async function createPythonBom(path, options) {
       metadataFilename = reqDirFiles.join(", ");
     } else if (reqFiles?.length) {
       for (const f of reqFiles) {
-        const dlist = await parseReqFile(f, true);
+        const dlist = await parseReqFile(f, false);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
@@ -4379,7 +4379,7 @@ export async function createGoBom(path, options) {
     ) {
       for (const f of sortedGomodFiles) {
         const basePath = dirname(f);
-        // Ignore vendor packages
+        // Ignore vendor packages and test fixtures
         if (
           basePath.includes("/vendor/") ||
           basePath.includes("/build/") ||
@@ -4391,13 +4391,14 @@ export async function createGoBom(path, options) {
         if (DEBUG_MODE) {
           console.log("Executing go list -deps in", basePath);
         }
+        // TODO: Replacing this with -json gives us more interesting data points such as GoFiles, Imports, and Deps
         let result = safeSpawnSync(
           "go",
           [
             "list",
             "-deps",
             "-f",
-            "'{{with .Module}}{{.Path}} {{.Version}} {{.Indirect}} {{.GoMod}} {{.GoVersion}} {{.Main}}{{end}}'",
+            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}{{end}}'",
             "./...",
           ],
           {
@@ -6407,6 +6408,7 @@ export async function createRubyBom(path, options) {
   const gemLockExcludeList = (options.exclude || []).concat([
     "**/vendor/bundle/ruby/**/Gemfile.lock",
     "**/test/data/**/Gemfile*.lock",
+    "**/.rbenv/versions/**/Gemfile.lock",
   ]);
   if (!hasAnyProjectType(["oci"], options, false)) {
     excludeList.push("**/vendor/bundle/**");
@@ -6509,6 +6511,7 @@ export async function createRubyBom(path, options) {
     }
   }
   // Parsing .gemspec files would help us get more metadata such as description, authors, licenses etc
+  let rootGemspecComponent;
   if (gemspecFiles.length) {
     if (!gemLockFiles.length && !hasAnyProjectType(["oci"], options, false)) {
       console.log(
@@ -6522,8 +6525,33 @@ export async function createRubyBom(path, options) {
       if (gpkgList.length) {
         pkgList = pkgList.concat(gpkgList);
         pkgList = trimComponents(pkgList);
+        if (
+          !rootGemspecComponent &&
+          dirname(resolve(f)) === resolve(path) &&
+          gpkgList[0]?.name
+        ) {
+          rootGemspecComponent = gpkgList[0];
+        }
       }
     }
+    if (
+      rootGemspecComponent &&
+      !("project-name" in options) &&
+      options.projectName === undefined
+    ) {
+      parentComponent.name = rootGemspecComponent.name;
+      parentComponent.version = rootGemspecComponent.version || "latest";
+      const parentPurl = new PackageURL(
+        "gem",
+        parentComponent.group,
+        parentComponent.name,
+        parentComponent.version,
+        null,
+        null,
+      ).toString();
+      parentComponent["bom-ref"] = decodeURIComponent(parentPurl);
+      parentComponent["purl"] = parentPurl;
+    }
   }
   if (rootList.length) {
     dependencies = mergeDependencies(
@@ -7033,7 +7061,7 @@ export async function createCsharpBom(path, options) {
     }
   }
   // Parent dependency tree
-  if (parentDependsOn.size && parentComponent && parentComponent["bom-ref"]) {
+  if (parentDependsOn.size && parentComponent?.["bom-ref"]) {
     dependencies.splice(0, 0, {
       ref: parentComponent["bom-ref"],
       dependsOn: Array.from(parentDependsOn).sort(),

package/lib/evinser/evinser.js

@@ -1248,8 +1248,7 @@ export function detectServicesFromUsages(language, slice, servicesMap = {}) {
 export function detectServicesFromUDT(language, userDefinedTypes, servicesMap) {
   if (
     ["python", "py", "c", "cpp", "c++", "php", "ruby"].includes(language) &&
-    userDefinedTypes &&
-    userDefinedTypes.length
+    userDefinedTypes?.length
   ) {
     for (const audt of userDefinedTypes) {
       if (
@@ -1270,12 +1269,7 @@ export function detectServicesFromUDT(language, userDefinedTypes, servicesMap) {
         audt.name.toLowerCase().includes("connect")
       ) {
         const fields = audt.fields || [];
-        if (
-          fields.length &&
-          fields[0] &&
-          fields[0].name &&
-          fields[0].name.length > 1
-        ) {
+        if (fields.length && fields[0]?.name && fields[0].name.length > 1) {
           const endpoints = extractEndpoints(language, fields[0].name);
           let serviceName = "service";
           if (audt.fileName) {

package/lib/helpers/display.js

@@ -14,7 +14,7 @@ const SYMBOLS_ANSI = {
 
 const MAX_TREE_DEPTH = 6;
 const highlightStr = (s, highlight) => {
-  if (highlight && s && s.includes(highlight)) {
+  if (highlight && s?.includes(highlight)) {
     s = s.replaceAll(highlight, `\x1b[1;33m${highlight}\x1b[0m`);
   }
   return s;

package/lib/helpers/envcontext.js

@@ -200,9 +200,17 @@ export function collectDotnetInfo(dir) {
  * @returns Object containing python details
  */
 export function collectPythonInfo(dir) {
-  const versionDesc = getCommandOutput(getPythonCommand(), dir, ["--version"]);
+  const versionDesc = getCommandOutput(getPythonCommand(), dir, [
+    "-S",
+    "--version",
+  ]);
   const moduleDesc =
-    getCommandOutput(getPythonCommand(), dir, ["-m", "pip", "--version"]) || "";
+    getCommandOutput(getPythonCommand(), dir, [
+      "-S",
+      "-m",
+      "pip",
+      "--version",
+    ]) || "";
   if (versionDesc) {
     return {
       type: "platform",