@cyclonedx/cdxgen 12.3.0 → 12.3.2

package/lib/helpers/utils.js

@@ -77,6 +77,7 @@ import {
 } from "./pylockutils.js";
 import { get_python_command_from_env, getVenvMetadata } from "./pythonutils.js";
 import {
+  collectCargoRegistryProvenanceProperties,
   collectNpmRegistryProvenanceProperties,
   collectPypiRegistryProvenanceProperties,
 } from "./registryProvenance.js";
@@ -95,6 +96,15 @@ export const isSecureMode =
   ["true", "1"].includes(process.env?.CDXGEN_SECURE_MODE) ||
   process.env?.NODE_OPTIONS?.includes("--permission");
 
+// CLI dry-run must be detected during module initialization because some probes
+// execute while modules are imported, before bin/cdxgen.js can thread options.
+const hasDryRunArg = process.argv?.some(
+  (arg) =>
+    arg === "--dry-run" || arg === "--dry-run=true" || arg === "--dry-run=1",
+);
+export let isDryRun =
+  ["true", "1"].includes(process.env?.CDXGEN_DRY_RUN) || hasDryRunArg;
+
 export const isNode = globalThis.process?.versions?.node !== undefined;
 export const isBun = globalThis.Bun?.version !== undefined;
 export const isDeno = globalThis.Deno?.version?.deno !== undefined;
@@ -102,6 +112,104 @@ export const isDeno = globalThis.Deno?.version?.deno !== undefined;
 export const isWin = platform() === "win32";
 export const isMac = platform() === "darwin";
 
+export const DRY_RUN_ERROR_CODE = "CDXGEN_DRY_RUN";
+const activityLedger = [];
+let activityCounter = 0;
+let currentActivityContext = {};
+
+export function setDryRunMode(enabled) {
+  isDryRun = !!enabled;
+  if (enabled) {
+    process.env.CDXGEN_DRY_RUN = "true";
+    return;
+  }
+  delete process.env.CDXGEN_DRY_RUN;
+}
+
+export function createDryRunError(action, target, reason) {
+  const message =
+    reason || `Dry run mode blocked the attempted ${action} operation.`;
+  const error = new Error(message);
+  error.code = DRY_RUN_ERROR_CODE;
+  error.name = "DryRunError";
+  error.action = action;
+  error.target = target;
+  error.dryRun = true;
+  return error;
+}
+
+export function isDryRunError(error) {
+  return !!(error?.dryRun || error?.code === DRY_RUN_ERROR_CODE);
+}
+
+export function setActivityContext(context = {}) {
+  currentActivityContext = {
+    ...currentActivityContext,
+    ...context,
+  };
+}
+
+export function resetActivityContext() {
+  currentActivityContext = {};
+}
+
+export function recordActivity(activity) {
+  if (!(isDryRun || DEBUG_MODE)) {
+    return undefined;
+  }
+  const identifier = `ACT-${String(++activityCounter).padStart(4, "0")}`;
+  const entry = {
+    identifier,
+    timestamp: new Date().toISOString(),
+    projectType: currentActivityContext.projectType,
+    packageType: currentActivityContext.packageType,
+    sourcePath: currentActivityContext.sourcePath,
+    ...activity,
+  };
+  activityLedger.push(entry);
+  traceLog("activity", entry);
+  return entry;
+}
+
+export function getRecordedActivities() {
+  return [...activityLedger];
+}
+
+export function resetRecordedActivities() {
+  activityLedger.length = 0;
+  activityCounter = 0;
+}
+
+function recordFilesystemActivity(kind, target, status, reason = undefined) {
+  return recordActivity({
+    kind,
+    reason,
+    status,
+    target,
+  });
+}
+
+function hasReadPermission(filePath) {
+  if (!(isSecureMode && process.permission)) {
+    return true;
+  }
+  return process.permission.has("fs.read", join(filePath, "", "*"));
+}
+
+function hasWritePermission(filePath) {
+  if (!(isSecureMode && process.permission)) {
+    return true;
+  }
+  const candidatePaths = [
+    filePath,
+    join(filePath, "", "*"),
+    join(dirname(filePath), "*"),
+  ];
+  return candidatePaths.some((candidatePath) =>
+    process.permission.has("fs.write", candidatePath),
+  );
+}
+
 /**
  * Safely check if a file path exists without crashing due to a lack of permissions
  *
@@ -109,17 +217,42 @@ export const isMac = platform() === "darwin";
  * @Boolean True if the path exists. False otherwise
  */
 export function safeExistsSync(filePath) {
-  if (isSecureMode && process.permission) {
-    if (!process.permission.has("fs.read", join(filePath, "", "*"))) {
-      if (DEBUG_MODE) {
-        console.log(`cdxgen lacks read permission for: ${filePath}`);
-      }
-      return false;
+  if (!hasReadPermission(filePath)) {
+    if (DEBUG_MODE) {
+      console.log("cdxgen lacks read permission for a requested path.");
     }
+    return false;
   }
   return existsSync(filePath);
 }
 
+export function safeWriteSync(filePath, data, options) {
+  if (isDryRun) {
+    recordFilesystemActivity(
+      "write",
+      filePath,
+      "blocked",
+      "Dry run mode blocks filesystem writes.",
+    );
+    return undefined;
+  }
+  if (!hasWritePermission(filePath)) {
+    if (DEBUG_MODE) {
+      console.log("cdxgen lacks write permission for a requested path.");
+    }
+    recordFilesystemActivity(
+      "write",
+      filePath,
+      "blocked",
+      "cdxgen lacks write permission for this path.",
+    );
+    return undefined;
+  }
+  const result = writeFileSync(filePath, data, options);
+  recordFilesystemActivity("write", filePath, "completed");
+  return result;
+}
+
 /**
  * Safely create a directory without crashing due to a lack of permissions
  *
@@ -128,15 +261,118 @@ export function safeExistsSync(filePath) {
  * @Boolean True if the path exists. False otherwise
  */
 export function safeMkdirSync(filePath, options) {
-  if (isSecureMode && process.permission) {
-    if (!process.permission.has("fs.write", join(filePath, "", "*"))) {
-      if (DEBUG_MODE) {
-        console.log(`cdxgen lacks write permission for: ${filePath}`);
-      }
-      return undefined;
+  if (isDryRun) {
+    recordFilesystemActivity(
+      "mkdir",
+      filePath,
+      "blocked",
+      "Dry run mode blocks directory creation.",
+    );
+    return undefined;
+  }
+  if (!hasWritePermission(filePath)) {
+    if (DEBUG_MODE) {
+      console.log("cdxgen lacks write permission for a requested path.");
     }
+    recordFilesystemActivity(
+      "mkdir",
+      filePath,
+      "blocked",
+      "cdxgen lacks write permission for this path.",
+    );
+    return undefined;
+  }
+  const result = mkdirSync(filePath, options);
+  recordFilesystemActivity("mkdir", filePath, "completed");
+  return result;
+}
+
+export function safeMkdtempSync(prefix, options = undefined) {
+  if (isDryRun) {
+    const tempPath = `${prefix}${randomUUID().replaceAll("-", "").slice(0, 6)}`;
+    recordFilesystemActivity(
+      "temp-dir",
+      tempPath,
+      "blocked",
+      "Dry run mode blocks temporary directory creation.",
+    );
+    return tempPath;
+  }
+  const tempPath = mkdtempSync(prefix, options);
+  recordFilesystemActivity("temp-dir", tempPath, "completed");
+  return tempPath;
+}
+
+export function safeRmSync(filePath, options = undefined) {
+  if (isDryRun) {
+    recordFilesystemActivity(
+      "cleanup",
+      filePath,
+      "blocked",
+      "Dry run mode blocks filesystem deletions.",
+    );
+    return undefined;
+  }
+  const result = rmSync(filePath, options);
+  recordFilesystemActivity("cleanup", filePath, "completed");
+  return result;
+}
+
+export function safeUnlinkSync(filePath) {
+  if (isDryRun) {
+    recordFilesystemActivity(
+      "cleanup",
+      filePath,
+      "blocked",
+      "Dry run mode blocks file deletions.",
+    );
+    return undefined;
+  }
+  const result = unlinkSync(filePath);
+  recordFilesystemActivity("cleanup", filePath, "completed");
+  return result;
+}
+
+export function safeCopyFileSync(src, dest, mode = undefined) {
+  if (isDryRun) {
+    recordFilesystemActivity(
+      "write",
+      dest,
+      "blocked",
+      `Dry run mode blocks copying files from ${src}.`,
+    );
+    return undefined;
+  }
+  const result =
+    mode === undefined
+      ? copyFileSync(src, dest)
+      : copyFileSync(src, dest, mode);
+  recordFilesystemActivity("write", dest, "completed", `Copied from ${src}.`);
+  return result;
+}
+
+export async function safeExtractArchive(
+  sourcePath,
+  targetPath,
+  extractor,
+  kind = "unzip",
+) {
+  if (isDryRun) {
+    recordActivity({
+      kind,
+      reason: "Dry run mode blocks archive extraction and decompression.",
+      status: "blocked",
+      target: `${sourcePath} -> ${targetPath}`,
+    });
+    return false;
   }
-  return mkdirSync(filePath, options);
+  await extractor();
+  recordActivity({
+    kind,
+    status: "completed",
+    target: `${sourcePath} -> ${targetPath}`,
+  });
+  return true;
 }
 
 export const commandsExecuted = new Set();
@@ -203,6 +439,25 @@ function isWindowsShellHijackRisk(command, options) {
  * @returns {Object} spawnSync result object with status, stdout, stderr, and error fields
  */
 export function safeSpawnSync(command, args, options) {
+  if (isDryRun) {
+    const error = createDryRunError(
+      "execute",
+      command,
+      "Dry run mode blocks child process execution.",
+    );
+    recordActivity({
+      kind: "execute",
+      reason: error.message,
+      status: "blocked",
+      target: `${command}${args?.length ? ` ${args.join(" ")}` : ""}`,
+    });
+    return {
+      status: 1,
+      stdout: undefined,
+      stderr: undefined,
+      error,
+    };
+  }
   if (
     (isSecureMode && process.permission && !process.permission.has("child")) ||
     !isAllowedCommand(command)
@@ -210,6 +465,12 @@ export function safeSpawnSync(command, args, options) {
     if (DEBUG_MODE) {
       console.log(`cdxgen lacks execute permission for ${command}`);
     }
+    recordActivity({
+      kind: "execute",
+      reason: "cdxgen lacks execute permission for this command.",
+      status: "blocked",
+      target: `${command}${args?.length ? ` ${args.join(" ")}` : ""}`,
+    });
     return {
       status: 1,
       stdout: undefined,
@@ -221,6 +482,12 @@ export function safeSpawnSync(command, args, options) {
     if (isWindowsShellHijackRisk(command, options)) {
       const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
       console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
+      recordActivity({
+        kind: "execute",
+        reason: blockedReason,
+        status: "blocked",
+        target: `${command}${args?.length ? ` ${args.join(" ")}` : ""}`,
+      });
       return {
         status: 1,
         stdout: undefined,
@@ -335,7 +602,14 @@ export function safeSpawnSync(command, args, options) {
       args = undefined;
     }
   }
-  return spawnSync(command, args, options);
+  const result = spawnSync(command, args, options);
+  recordActivity({
+    kind: "execute",
+    reason: result.error?.message,
+    status: result.status === 0 && !result.error ? "completed" : "failed",
+    target: `${command}${args?.length ? ` ${args.join(" ")}` : ""}`,
+  });
+  return result;
 }
 
 const licenseMapping = JSON.parse(
@@ -413,7 +687,7 @@ const temporaryFiles = new Set();
 process.on("exit", () =>
   temporaryFiles.forEach((tempFile) => {
     if (safeExistsSync(tempFile)) {
-      unlinkSync(tempFile);
+      safeUnlinkSync(tempFile);
     }
   }),
 );
@@ -620,6 +894,7 @@ export const PROJECT_TYPE_ALIASES = {
   "gradle-index": ["gradle-index", "gradle-cache"],
   "sbt-index": ["sbt-index", "sbt-cache"],
   "maven-index": ["maven-index", "maven-cache", "maven-core"],
+  "cargo-cache": ["cargo-cache", "cargo-index"],
   js: [
     "npm",
     "pnpm",
@@ -651,6 +926,8 @@ export const PROJECT_TYPE_ALIASES = {
     "yarn",
     "rush",
   ],
+  mcp: ["mcp"],
+  "ai-skill": ["ai-skill", "skill", "skills"],
   py: [
     "py",
     "python",
@@ -950,10 +1227,36 @@ export const cdxgenAgent = got.extend({
   hooks: {
     beforeRequest: [
       (options) => {
+        options.context = {
+          ...options.context,
+          activityTarget: options.url.toString(),
+        };
+        if (isDryRun) {
+          const error = createDryRunError(
+            "network",
+            options.url.toString(),
+            "Dry run mode blocks outbound network access.",
+          );
+          recordActivity({
+            kind: "network",
+            reason: error.message,
+            status: "blocked",
+            target: options.url.toString(),
+          });
+          options.context.activityBlocked = true;
+          throw error;
+        }
         if (!isAllowedHost(options.url.hostname)) {
           console.log(
             `Access to the remote host '${options.url.hostname}' is not permitted.`,
           );
+          recordActivity({
+            kind: "network",
+            reason: "The remote host is not permitted.",
+            status: "blocked",
+            target: options.url.toString(),
+          });
+          options.context.activityBlocked = true;
           return new AbortController().abort();
         }
         // Only allow https protocol in secure mode
@@ -961,6 +1264,13 @@ export const cdxgenAgent = got.extend({
           console.log(
             `Access to the remote host '${options.url.hostname}' is not permitted via the '${options.url.protocol}' protocol.`,
           );
+          recordActivity({
+            kind: "network",
+            reason: `The '${options.url.protocol}' protocol is not permitted in secure mode.`,
+            status: "blocked",
+            target: options.url.toString(),
+          });
+          options.context.activityBlocked = true;
           return new AbortController().abort();
         }
         remoteHostsAccessed.add(options.url.hostname);
@@ -971,6 +1281,39 @@ export const cdxgenAgent = got.extend({
         });
       },
     ],
+    afterResponse: [
+      (response) => {
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+          return response;
+        }
+        const activityTarget =
+          response.request.options.context?.activityTarget ||
+          response.request.options.url?.toString() ||
+          response.url;
+        recordActivity({
+          kind: "network",
+          status: "completed",
+          target: activityTarget,
+        });
+        return response;
+      },
+    ],
+    beforeError: [
+      (error) => {
+        if (error.options?.context?.activityBlocked) {
+          return error;
+        }
+        recordActivity({
+          kind: "network",
+          reason: error.message,
+          status: "failed",
+          target:
+            error.options?.context?.activityTarget ||
+            error.options?.url?.toString(),
+        });
+        return error;
+      },
+    ],
   },
 });
 
@@ -9751,12 +10094,24 @@ export async function getCratesMetadata(pkgList) {
   const cdepList = [];
   for (const p of pkgList) {
     try {
+      if (!p?.name || !p?.version || p.version === "workspace") {
+        cdepList.push(p);
+        continue;
+      }
       if (DEBUG_MODE) {
         console.log(`Querying crates.io for ${p.name}@${p.version}`);
       }
       const res = await cdxgenAgent.get(CRATES_URL + p.name, {
         responseType: "json",
       });
+      let ownersRes;
+      try {
+        ownersRes = await cdxgenAgent.get(`${CRATES_URL + p.name}/owners`, {
+          responseType: "json",
+        });
+      } catch (_err) {
+        ownersRes = undefined;
+      }
       let versionToUse = res?.body?.versions[0];
       if (p.version) {
         for (const aversion of res.body.versions) {
@@ -9782,7 +10137,7 @@ export async function getCratesMetadata(pkgList) {
         p.version = body.newest_version;
       }
       if (!p._integrity && versionToUse.checksum) {
-        p._integrity = `sha384-${versionToUse.checksum}`;
+        p._integrity = normalizeCargoIntegrity(versionToUse.checksum);
       }
       if (!p.properties) {
         p.properties = [];
@@ -9808,6 +10163,13 @@ export async function getCratesMetadata(pkgList) {
           value: JSON.stringify(versionToUse.features),
         });
       }
+      p.properties = p.properties.concat(
+        collectCargoRegistryProvenanceProperties(
+          res?.body,
+          versionToUse?.num || p.version,
+          ownersRes?.body,
+        ),
+      );
       cdepList.push(p);
     } catch (_err) {
       cdepList.push(p);
@@ -9926,7 +10288,10 @@ function parseCargoDependencyFromPackageNode(packageNode) {
   }
 
   if (!isExtendFromWorkspace(pkgChecksum) && pkgChecksum) {
-    pkg._integrity = `${pkgChecksum}`;
+    const normalizedCargoIntegrity = normalizeCargoIntegrity(pkgChecksum);
+    if (normalizedCargoIntegrity) {
+      pkg._integrity = normalizedCargoIntegrity;
+    }
   }
   if (!isExtendFromWorkspace(pkgName) && pkgName) {
     pkg.group = group;
@@ -9957,6 +10322,555 @@ function parseCargoDependencyFromPackageNode(packageNode) {
   return pkg;
 }
 
+function normalizeCargoIntegrity(integrity) {
+  if (typeof integrity !== "string") {
+    return undefined;
+  }
+  const normalizedIntegrity = integrity.trim().toLowerCase();
+  const prefixedMatch = /^(sha256|sha384)-(?<digest>[a-f0-9]+)$/i.exec(
+    normalizedIntegrity,
+  );
+  if (prefixedMatch?.groups?.digest) {
+    const algorithm = prefixedMatch[1].toLowerCase();
+    const digest = prefixedMatch.groups.digest;
+    const expectedDigestLength = algorithm === "sha384" ? 96 : 64;
+    if (digest.length === expectedDigestLength) {
+      return `${algorithm}-${digest}`;
+    }
+    return undefined;
+  }
+  if (!/^[a-f0-9]+$/i.test(normalizedIntegrity)) {
+    return undefined;
+  }
+  if (normalizedIntegrity.length === 64) {
+    return `sha256-${normalizedIntegrity}`;
+  }
+  if (normalizedIntegrity.length === 96) {
+    return `sha384-${normalizedIntegrity}`;
+  }
+  return undefined;
+}
+
+function cargoIntegrityToComponentHash(integrity) {
+  const normalizedIntegrity = normalizeCargoIntegrity(integrity);
+  if (!normalizedIntegrity) {
+    return undefined;
+  }
+  const [, algorithm, digest] = /^(sha256|sha384)-([a-f0-9]+)$/i.exec(
+    normalizedIntegrity,
+  );
+  return {
+    alg: algorithm.toLowerCase() === "sha384" ? "SHA-384" : "SHA-256",
+    content: digest,
+  };
+}
+
+function readCargoTomlData(cargoTomlFile) {
+  if (!cargoTomlFile || !safeExistsSync(cargoTomlFile)) {
+    return undefined;
+  }
+  try {
+    return toml.parse(readFileSync(cargoTomlFile, { encoding: "utf-8" }));
+  } catch (error) {
+    traceLog("cargo", {
+      cargoTomlFile,
+      error: error.message,
+    });
+    if (DEBUG_MODE) {
+      console.warn(`Failed to parse Cargo manifest ${cargoTomlFile}:`, error);
+    }
+    return undefined;
+  }
+}
+
+function isCargoWorkspaceReference(value) {
+  return Boolean(value?.workspace);
+}
+
+function cargoPackageInfoToPurl(pkg) {
+  return decodeURIComponent(
+    new PackageURL(
+      "cargo",
+      pkg?.group,
+      pkg?.name,
+      pkg?.version,
+      null,
+      null,
+    ).toString(),
+  );
+}
+
+function resolveCargoDependencyAliasName(dependencyName, dependencyNode) {
+  if (
+    dependencyNode &&
+    typeof dependencyNode === "object" &&
+    typeof dependencyNode.package === "string" &&
+    dependencyNode.package
+  ) {
+    return dependencyNode.package;
+  }
+  return dependencyName;
+}
+
+function resolveCargoWorkspaceContext(cargoTomlFile, cargoData, context = {}) {
+  if (
+    context?.workspaceRootFile &&
+    context?.workspaceRootData &&
+    safeExistsSync(context.workspaceRootFile)
+  ) {
+    return {
+      isVirtualWorkspace: !context.workspaceRootData?.package,
+      isWorkspaceRoot: context.workspaceRootFile === cargoTomlFile,
+      workspaceData: context.workspaceRootData.workspace,
+      workspaceRootData: context.workspaceRootData,
+      workspaceRootFile: context.workspaceRootFile,
+    };
+  }
+  let currentDir = dirname(cargoTomlFile);
+  while (currentDir && currentDir !== dirname(currentDir)) {
+    const candidateFile = join(currentDir, "Cargo.toml");
+    if (safeExistsSync(candidateFile)) {
+      const candidateData =
+        candidateFile === cargoTomlFile
+          ? cargoData
+          : readCargoTomlData(candidateFile);
+      if (candidateData?.workspace) {
+        return {
+          isVirtualWorkspace: !candidateData?.package,
+          isWorkspaceRoot: candidateFile === cargoTomlFile,
+          workspaceData: candidateData.workspace,
+          workspaceRootData: candidateData,
+          workspaceRootFile: candidateFile,
+        };
+      }
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+  }
+  return {};
+}
+
+function resolveCargoWorkspaceMembers(workspaceRootFile, workspaceData) {
+  const workspaceRootDir = dirname(workspaceRootFile);
+  const members = [];
+  const excludedRoots = new Set();
+  for (const excludedPattern of workspaceData?.exclude || []) {
+    excludedRoots.add(resolve(workspaceRootDir, excludedPattern));
+  }
+  for (const memberPattern of workspaceData?.members || []) {
+    const directMemberFile = resolve(
+      workspaceRootDir,
+      memberPattern,
+      "Cargo.toml",
+    );
+    if (safeExistsSync(directMemberFile)) {
+      members.push(directMemberFile);
+      continue;
+    }
+    const matchedMemberFiles = globSync(
+      join(memberPattern, "Cargo.toml").replaceAll("\\", "/"),
+      {
+        absolute: true,
+        cwd: workspaceRootDir,
+        nodir: true,
+        windowsPathsNoEscape: true,
+      },
+    );
+    if (matchedMemberFiles?.length) {
+      members.push(...matchedMemberFiles);
+    }
+  }
+  return [...new Set(members)]
+    .filter((memberFile) => {
+      const memberDir = resolve(dirname(memberFile));
+      for (const excludedRoot of excludedRoots) {
+        if (
+          memberDir === excludedRoot ||
+          memberDir.startsWith(`${excludedRoot}${_sep}`)
+        ) {
+          return false;
+        }
+      }
+      return true;
+    })
+    .sort();
+}
+
+function resolveCargoWorkspacePackageNode(packageNode, workspacePackageNode) {
+  if (!packageNode || typeof packageNode !== "object") {
+    return packageNode;
+  }
+  const mergedNode = { ...packageNode };
+  for (const fieldName of [
+    "authors",
+    "description",
+    "documentation",
+    "edition",
+    "homepage",
+    "keywords",
+    "license",
+    "name",
+    "readme",
+    "repository",
+    "rust-version",
+    "version",
+  ]) {
+    if (
+      isCargoWorkspaceReference(packageNode[fieldName]) &&
+      workspacePackageNode?.[fieldName] !== undefined
+    ) {
+      mergedNode[fieldName] = workspacePackageNode[fieldName];
+    }
+  }
+  return mergedNode;
+}
+
+function resolveCargoManifestPackageIdentity(
+  cargoTomlFile,
+  cargoData,
+  context = {},
+) {
+  const workspaceContext = resolveCargoWorkspaceContext(
+    cargoTomlFile,
+    cargoData,
+    context,
+  );
+  const resolvedPackageNode = resolveCargoWorkspacePackageNode(
+    cargoData?.package,
+    workspaceContext?.workspaceData?.package,
+  );
+  if (
+    resolvedPackageNode &&
+    typeof resolvedPackageNode === "object" &&
+    !Array.isArray(resolvedPackageNode)
+  ) {
+    try {
+      return parseCargoDependencyFromPackageNode(resolvedPackageNode);
+    } catch {
+      return undefined;
+    }
+  }
+  if (
+    cargoData?.workspace &&
+    workspaceContext?.isWorkspaceRoot &&
+    workspaceContext?.isVirtualWorkspace
+  ) {
+    return {
+      group: "",
+      name: basename(dirname(cargoTomlFile)),
+      version: "workspace",
+    };
+  }
+  return undefined;
+}
+
+function normalizeCargoDependencySpec(dependencySpec) {
+  if (typeof dependencySpec === "string") {
+    return { version: dependencySpec };
+  }
+  if (!dependencySpec || typeof dependencySpec !== "object") {
+    return {};
+  }
+  return { ...dependencySpec };
+}
+
+function mergeCargoWorkspaceDependencySpec(
+  dependencyName,
+  dependencyNode,
+  workspaceDependencies,
+) {
+  if (
+    !dependencyNode ||
+    typeof dependencyNode !== "object" ||
+    dependencyNode.workspace !== true
+  ) {
+    return dependencyNode;
+  }
+  const workspaceDependencyNode = workspaceDependencies?.[dependencyName];
+  if (workspaceDependencyNode === undefined) {
+    return dependencyNode;
+  }
+  const mergedSpec = {
+    ...normalizeCargoDependencySpec(workspaceDependencyNode),
+    ...normalizeCargoDependencySpec(dependencyNode),
+  };
+  mergedSpec.workspace = true;
+  if (
+    Array.isArray(workspaceDependencyNode?.features) ||
+    Array.isArray(dependencyNode?.features)
+  ) {
+    mergedSpec.features = [
+      ...new Set([
+        ...(workspaceDependencyNode?.features || []),
+        ...(dependencyNode?.features || []),
+      ]),
+    ];
+  }
+  return mergedSpec;
+}
+
+function resolveCargoWorkspaceMemberMap(
+  workspaceRootFile,
+  workspaceRootData,
+  workspaceMemberCache,
+) {
+  if (!workspaceRootFile || !workspaceRootData?.workspace) {
+    return new Map();
+  }
+  const cacheKey = resolve(workspaceRootFile);
+  if (workspaceMemberCache?.has(cacheKey)) {
+    return workspaceMemberCache.get(cacheKey);
+  }
+  const memberMap = new Map();
+  const workspaceMemberFiles = resolveCargoWorkspaceMembers(
+    workspaceRootFile,
+    workspaceRootData.workspace,
+  );
+  for (const workspaceMemberFile of workspaceMemberFiles) {
+    const memberCargoData = readCargoTomlData(workspaceMemberFile);
+    if (!memberCargoData) {
+      continue;
+    }
+    const memberIdentity = resolveCargoManifestPackageIdentity(
+      workspaceMemberFile,
+      memberCargoData,
+      {
+        workspaceRootData,
+        workspaceRootFile,
+      },
+    );
+    if (!memberIdentity?.name || !memberIdentity?.version) {
+      continue;
+    }
+    memberMap.set(memberIdentity.name, {
+      ...memberIdentity,
+      filePath: workspaceMemberFile,
+      ref: cargoPackageInfoToPurl(memberIdentity),
+    });
+  }
+  workspaceMemberCache?.set(cacheKey, memberMap);
+  return memberMap;
+}
+
+function resolveCargoWorkspaceDependencyTarget(
+  cargoTomlFile,
+  dependencyName,
+  dependencyNode,
+  workspaceContext,
+  workspaceMemberMap,
+) {
+  const resolvedDependencyName = resolveCargoDependencyAliasName(
+    dependencyName,
+    dependencyNode,
+  );
+  if (
+    dependencyNode &&
+    typeof dependencyNode === "object" &&
+    dependencyNode.workspace === true &&
+    workspaceMemberMap?.has(resolvedDependencyName)
+  ) {
+    return workspaceMemberMap.get(resolvedDependencyName);
+  }
+  const dependencyPath =
+    dependencyNode &&
+    typeof dependencyNode === "object" &&
+    typeof dependencyNode.path === "string" &&
+    dependencyNode.path
+      ? resolve(dirname(cargoTomlFile), dependencyNode.path, "Cargo.toml")
+      : undefined;
+  if (!dependencyPath || !safeExistsSync(dependencyPath)) {
+    return undefined;
+  }
+  const dependencyCargoData = readCargoTomlData(dependencyPath);
+  if (!dependencyCargoData) {
+    return undefined;
+  }
+  const dependencyIdentity = resolveCargoManifestPackageIdentity(
+    dependencyPath,
+    dependencyCargoData,
+    {
+      workspaceRootData: workspaceContext?.workspaceRootData,
+      workspaceRootFile: workspaceContext?.workspaceRootFile,
+    },
+  );
+  if (!dependencyIdentity?.name || !dependencyIdentity?.version) {
+    return undefined;
+  }
+  return {
+    ...dependencyIdentity,
+    filePath: dependencyPath,
+    ref: cargoPackageInfoToPurl(dependencyIdentity),
+  };
+}
+
+function ensurePropertiesArray(pkg) {
+  if (!pkg.properties) {
+    pkg.properties = [];
+  }
+  return pkg.properties;
+}
+
+function appendCargoProperty(pkg, name, value) {
+  if (!name || value === undefined || value === null || value === "") {
+    return;
+  }
+  const properties = ensurePropertiesArray(pkg);
+  const stringValue = typeof value === "string" ? value : String(value);
+  if (
+    properties.some(
+      (property) => property.name === name && property.value === stringValue,
+    )
+  ) {
+    return;
+  }
+  properties.push({
+    name,
+    value: stringValue,
+  });
+}
+
+function normalizeCargoDependencyVersion(dependencyNode) {
+  if (typeof dependencyNode === "string" || dependencyNode instanceof String) {
+    return dependencyNode.trim();
+  }
+  if (!dependencyNode || typeof dependencyNode !== "object") {
+    return "";
+  }
+  if (typeof dependencyNode.version === "string" && dependencyNode.version) {
+    return dependencyNode.version;
+  }
+  if (typeof dependencyNode.git === "string" && dependencyNode.git) {
+    return `git+${dependencyNode.git}`;
+  }
+  if (typeof dependencyNode.path === "string" && dependencyNode.path) {
+    return `path+${dependencyNode.path}`;
+  }
+  if (dependencyNode.workspace === true) {
+    return "workspace";
+  }
+  return "";
+}
+
+function applyCargoDependencySpecMetadata(
+  pkg,
+  dependencyNode,
+  dependencyKind,
+  targetSelector,
+  resolvedWorkspaceTarget,
+) {
+  appendCargoProperty(pkg, "cdx:cargo:dependencyKind", dependencyKind);
+  appendCargoProperty(pkg, "cdx:cargo:scope", dependencyKind);
+  if (targetSelector) {
+    appendCargoProperty(pkg, "cdx:cargo:target", targetSelector);
+  }
+  if (!dependencyNode || typeof dependencyNode !== "object") {
+    if (dependencyKind === "dev") {
+      pkg.scope = "excluded";
+    }
+    return;
+  }
+  if (dependencyKind === "dev") {
+    pkg.scope = "excluded";
+  }
+  if (dependencyNode.optional === true) {
+    pkg.scope = "optional";
+    appendCargoProperty(pkg, "cdx:cargo:optional", "true");
+  }
+  if (dependencyNode.default_features === false) {
+    appendCargoProperty(pkg, "cdx:cargo:defaultFeatures", "false");
+  }
+  if (dependencyNode["default-features"] === false) {
+    appendCargoProperty(pkg, "cdx:cargo:defaultFeatures", "false");
+  }
+  if (
+    Array.isArray(dependencyNode.features) &&
+    dependencyNode.features.length
+  ) {
+    appendCargoProperty(
+      pkg,
+      "cdx:cargo:dependencyFeatures",
+      JSON.stringify(dependencyNode.features),
+    );
+  }
+  appendCargoProperty(pkg, "cdx:cargo:path", dependencyNode.path);
+  appendCargoProperty(pkg, "cdx:cargo:git", dependencyNode.git);
+  appendCargoProperty(pkg, "cdx:cargo:gitBranch", dependencyNode.branch);
+  appendCargoProperty(pkg, "cdx:cargo:gitTag", dependencyNode.tag);
+  appendCargoProperty(pkg, "cdx:cargo:gitRev", dependencyNode.rev);
+  appendCargoProperty(pkg, "cdx:cargo:registry", dependencyNode.registry);
+  appendCargoProperty(pkg, "cdx:cargo:package", dependencyNode.package);
+  appendCargoProperty(
+    pkg,
+    "cdx:cargo:workspaceDependency",
+    dependencyNode.workspace === true ? "true" : undefined,
+  );
+  appendCargoProperty(
+    pkg,
+    "cdx:cargo:workspaceDependencyResolved",
+    resolvedWorkspaceTarget ? "true" : undefined,
+  );
+  appendCargoProperty(
+    pkg,
+    "cdx:cargo:resolvedWorkspaceMember",
+    resolvedWorkspaceTarget?.name,
+  );
+  appendCargoProperty(
+    pkg,
+    "cdx:cargo:resolvedMemberPath",
+    resolvedWorkspaceTarget?.filePath,
+  );
+}
+
+function collectCargoManifestDependencyComponents(
+  dependencyEntries,
+  addPackageToList,
+  pkgList,
+  simple,
+  dependencyKind,
+  targetSelector,
+  workspaceDependencies,
+  cargoTomlFile,
+  workspaceContext,
+  workspaceMemberMap,
+) {
+  if (!dependencyEntries || typeof dependencyEntries !== "object") {
+    return;
+  }
+  for (const dependencyName of Object.keys(dependencyEntries)) {
+    const dependencyNode = mergeCargoWorkspaceDependencySpec(
+      dependencyName,
+      dependencyEntries[dependencyName],
+      workspaceDependencies,
+    );
+    const resolvedWorkspaceTarget = resolveCargoWorkspaceDependencyTarget(
+      cargoTomlFile,
+      dependencyName,
+      dependencyNode,
+      workspaceContext,
+      workspaceMemberMap,
+    );
+    const version = normalizeCargoDependencyVersion(dependencyNode);
+    if (!dependencyName || !version) {
+      continue;
+    }
+    const pkg = {
+      name: dependencyName,
+      version,
+    };
+    applyCargoDependencySpecMetadata(
+      pkg,
+      dependencyNode,
+      dependencyKind,
+      targetSelector,
+      resolvedWorkspaceTarget,
+    );
+    addPackageToList(pkgList, pkg, { packageMode: false, simple });
+  }
+}
+
 /**
  * Method to parse cargo.toml data
  *
@@ -9979,6 +10893,7 @@ export async function parseCargoTomlData(
   cargoTomlFile,
   simple = false,
   pkgFilesMap = {},
+  context = {},
 ) {
   const pkgList = [];
 
@@ -9995,6 +10910,7 @@ export async function parseCargoTomlData(
           name: "SrcFile",
           value: cargoTomlFile,
         },
+        ...(pkg.properties || []),
       ];
       if (pkgFilesMap?.[pkg.name]) {
         pkg.components = fileListToComponents(pkgFilesMap[pkg.name]);
@@ -10038,16 +10954,39 @@ export async function parseCargoTomlData(
   if (!cargoTomlFile || !safeExistsSync(cargoTomlFile)) {
     return pkgList;
   }
-  let cargoData;
-  try {
-    cargoData = toml.parse(readFileSync(cargoTomlFile, { encoding: "utf-8" }));
-  } catch (e) {
-    console.log(e);
+  const normalizedCargoTomlFile = resolve(cargoTomlFile);
+  cargoTomlFile = normalizedCargoTomlFile;
+  const visitedCargoTomlFiles = context?.visitedCargoTomlFiles || new Set();
+  for (const visitedCargoTomlFile of visitedCargoTomlFiles) {
+    if (typeof visitedCargoTomlFile === "string") {
+      visitedCargoTomlFiles.add(resolve(visitedCargoTomlFile));
+    }
   }
+  if (visitedCargoTomlFiles.has(normalizedCargoTomlFile)) {
+    return pkgList;
+  }
+  visitedCargoTomlFiles.add(normalizedCargoTomlFile);
+  const cargoData = readCargoTomlData(normalizedCargoTomlFile);
   if (!cargoData) {
     return pkgList;
   }
-  const packageNode = cargoData["package"];
+  const workspaceContext = resolveCargoWorkspaceContext(
+    normalizedCargoTomlFile,
+    cargoData,
+    context,
+  );
+  const workspacePackageNode = workspaceContext?.workspaceData?.package;
+  const workspaceDependencies = workspaceContext?.workspaceData?.dependencies;
+  const workspaceMemberCache = context?.workspaceMemberCache || new Map();
+  const workspaceMemberMap = resolveCargoWorkspaceMemberMap(
+    workspaceContext?.workspaceRootFile,
+    workspaceContext?.workspaceRootData,
+    workspaceMemberCache,
+  );
+  const packageNode = resolveCargoWorkspacePackageNode(
+    cargoData["package"],
+    workspacePackageNode,
+  );
   // parse `[package]`
   if (packageNode instanceof Object && !Array.isArray(packageNode)) {
     /** @type {Object} */
@@ -10060,45 +10999,159 @@ export async function parseCargoTomlData(
         `Failed to parse package: ${packageObjNode?.name}@${packageObjNode?.version},fail with:${e.message}`,
       );
     }
+  } else if (
+    cargoData.workspace &&
+    workspaceContext?.isWorkspaceRoot &&
+    workspaceContext?.isVirtualWorkspace
+  ) {
+    const workspaceComponent = {
+      name: basename(dirname(cargoTomlFile)),
+      properties: [],
+      version: "workspace",
+    };
+    appendCargoProperty(
+      workspaceComponent,
+      "cdx:cargo:manifestMode",
+      "virtual-workspace",
+    );
+    addPackageToList(pkgList, workspaceComponent, {
+      packageMode: true,
+      simple,
+    });
   }
-  // parse `[dependencies]`
-  const dependenciesNode = cargoData["dependencies"];
-  if (dependenciesNode) {
-    for (const dependencyName in dependenciesNode) {
-      const dependencyNode = dependenciesNode[dependencyName];
-      let version = "";
-      if (
-        typeof dependencyNode === "string" ||
-        dependencyNode instanceof String
-      ) {
-        // like `libc = 0.2.79`
-        version = dependencyNode;
-      } else if (Object.keys(dependencyNode).length > 0) {
-        // like `libc = { version = "0.2.79", features = ['rustc-dep-of-std'], default-features = false }`
-        version = dependencyNode?.version;
-        const git = dependencyNode?.git;
-        if (!version && git) {
-          version = `git+${git}`;
-        }
-      }
-      if (dependencyName && version) {
-        const pkg = {};
-        pkg.name = dependencyName;
-        pkg.version = version;
-        addPackageToList(pkgList, pkg, { packageMode: false, simple });
+  if (pkgList[0] && workspaceContext?.workspaceRootFile) {
+    appendCargoProperty(
+      pkgList[0],
+      "cdx:cargo:workspaceRoot",
+      workspaceContext.workspaceRootFile,
+    );
+    appendCargoProperty(
+      pkgList[0],
+      "cdx:cargo:manifestMode",
+      cargoData?.workspace
+        ? workspaceContext?.isVirtualWorkspace
+          ? "virtual-workspace"
+          : "workspace"
+        : "package",
+    );
+  }
+  if (Array.isArray(cargoData?.workspace?.members) && pkgList[0]) {
+    appendCargoProperty(pkgList[0], "cdx:cargo:hasWorkspaceMembers", "true");
+    appendCargoProperty(
+      pkgList[0],
+      "cdx:cargo:workspaceMembers",
+      cargoData.workspace.members.join(", "),
+    );
+  }
+  collectCargoManifestDependencyComponents(
+    cargoData["dependencies"],
+    addPackageToList,
+    pkgList,
+    simple,
+    "runtime",
+    undefined,
+    workspaceDependencies,
+    cargoTomlFile,
+    workspaceContext,
+    workspaceMemberMap,
+  );
+  collectCargoManifestDependencyComponents(
+    cargoData["build-dependencies"],
+    addPackageToList,
+    pkgList,
+    simple,
+    "build",
+    undefined,
+    workspaceDependencies,
+    cargoTomlFile,
+    workspaceContext,
+    workspaceMemberMap,
+  );
+  collectCargoManifestDependencyComponents(
+    cargoData["dev-dependencies"],
+    addPackageToList,
+    pkgList,
+    simple,
+    "dev",
+    undefined,
+    workspaceDependencies,
+    cargoTomlFile,
+    workspaceContext,
+    workspaceMemberMap,
+  );
+  if (cargoData.target && typeof cargoData.target === "object") {
+    for (const targetSelector of Object.keys(cargoData.target)) {
+      const targetBlock = cargoData.target[targetSelector];
+      if (!targetBlock || typeof targetBlock !== "object") {
+        continue;
       }
+      collectCargoManifestDependencyComponents(
+        targetBlock["dependencies"],
+        addPackageToList,
+        pkgList,
+        simple,
+        "runtime",
+        targetSelector,
+        workspaceDependencies,
+        cargoTomlFile,
+        workspaceContext,
+        workspaceMemberMap,
+      );
+      collectCargoManifestDependencyComponents(
+        targetBlock["build-dependencies"],
+        addPackageToList,
+        pkgList,
+        simple,
+        "build",
+        targetSelector,
+        workspaceDependencies,
+        cargoTomlFile,
+        workspaceContext,
+        workspaceMemberMap,
+      );
+      collectCargoManifestDependencyComponents(
+        targetBlock["dev-dependencies"],
+        addPackageToList,
+        pkgList,
+        simple,
+        "dev",
+        targetSelector,
+        workspaceDependencies,
+        cargoTomlFile,
+        workspaceContext,
+        workspaceMemberMap,
+      );
     }
   }
-
-  // Properly parsing project with workspaces is currently unsupported. Some
-  // projects may have a top-level Cargo.toml file containing only
-  // workspace definitions and no package name. That will make the parent
-  // component unreliable.
-  // See: https://doc.rust-lang.org/cargo/reference/workspaces.html#virtual-workspace
-  if (cargoData.workspace && DEBUG_MODE) {
-    console.log(
-      `Found [workspace] section in ${cargoTomlFile}. Workspaces are currently not fully supported. Verify that the parent component is correct.`,
+  if (
+    context?.includeWorkspaceMembers !== false &&
+    workspaceContext?.isWorkspaceRoot &&
+    Array.isArray(cargoData?.workspace?.members)
+  ) {
+    const workspaceMemberFiles = resolveCargoWorkspaceMembers(
+      cargoTomlFile,
+      cargoData.workspace,
     );
+    for (const workspaceMemberFile of workspaceMemberFiles) {
+      if (workspaceMemberFile === cargoTomlFile) {
+        continue;
+      }
+      const workspaceMemberPackages = await parseCargoTomlData(
+        workspaceMemberFile,
+        simple,
+        pkgFilesMap,
+        {
+          includeWorkspaceMembers: false,
+          visitedCargoTomlFiles,
+          workspaceMemberCache,
+          workspaceRootData: cargoData,
+          workspaceRootFile: cargoTomlFile,
+        },
+      );
+      if (workspaceMemberPackages?.length) {
+        pkgList.push(...workspaceMemberPackages);
+      }
+    }
   }
 
   if (!simple && shouldFetchLicense()) {
@@ -10143,13 +11196,9 @@ export async function parseCargoData(
       version: newPackage.version,
     };
 
-    if (newPackage._integrity) {
-      component.hashes = [
-        {
-          alg: "SHA-384",
-          content: newPackage._integrity,
-        },
-      ];
+    const integrityHash = cargoIntegrityToComponentHash(newPackage._integrity);
+    if (integrityHash) {
+      component.hashes = [integrityHash];
     }
 
     if (!simple) {
@@ -10221,6 +11270,178 @@ export async function parseCargoData(
   return pkgList;
 }
 
+function collectCargoManifestDependencyRefs(
+  cargoTomlFile,
+  dependencyEntries,
+  workspaceDependencies,
+  workspaceContext,
+  workspaceMemberMap,
+  dependsOn,
+) {
+  if (!dependencyEntries || typeof dependencyEntries !== "object") {
+    return;
+  }
+  for (const dependencyName of Object.keys(dependencyEntries)) {
+    const dependencyNode = mergeCargoWorkspaceDependencySpec(
+      dependencyName,
+      dependencyEntries[dependencyName],
+      workspaceDependencies,
+    );
+    const resolvedWorkspaceTarget = resolveCargoWorkspaceDependencyTarget(
+      cargoTomlFile,
+      dependencyName,
+      dependencyNode,
+      workspaceContext,
+      workspaceMemberMap,
+    );
+    if (resolvedWorkspaceTarget?.ref) {
+      dependsOn.add(resolvedWorkspaceTarget.ref);
+    }
+  }
+}
+
+/**
+ * Build a Cargo dependency graph from manifest relationships so workspace roots
+ * and member-to-member links can complement lockfile-derived dependency data.
+ *
+ * @param {string} cargoTomlFile Cargo.toml path
+ * @param {object} [context] manifest graph context
+ * @returns {object[]} Cargo dependency relationships
+ */
+export function parseCargoManifestDependencyData(cargoTomlFile, context = {}) {
+  if (!cargoTomlFile || !safeExistsSync(cargoTomlFile)) {
+    return [];
+  }
+  const normalizedCargoTomlFile = resolve(cargoTomlFile);
+  cargoTomlFile = normalizedCargoTomlFile;
+  const visitedCargoTomlFiles =
+    context?.visitedCargoTomlDependencyGraphFiles || new Set();
+  for (const visitedCargoTomlFile of visitedCargoTomlFiles) {
+    if (typeof visitedCargoTomlFile === "string") {
+      visitedCargoTomlFiles.add(resolve(visitedCargoTomlFile));
+    }
+  }
+  if (visitedCargoTomlFiles.has(normalizedCargoTomlFile)) {
+    return [];
+  }
+  visitedCargoTomlFiles.add(normalizedCargoTomlFile);
+  const cargoData = readCargoTomlData(normalizedCargoTomlFile);
+  if (!cargoData) {
+    return [];
+  }
+  const workspaceContext = resolveCargoWorkspaceContext(
+    cargoTomlFile,
+    cargoData,
+    context,
+  );
+  const workspaceMemberCache = context?.workspaceMemberCache || new Map();
+  const workspaceMemberMap = resolveCargoWorkspaceMemberMap(
+    workspaceContext?.workspaceRootFile,
+    workspaceContext?.workspaceRootData,
+    workspaceMemberCache,
+  );
+  const workspaceDependencies = workspaceContext?.workspaceData?.dependencies;
+  const currentIdentity = resolveCargoManifestPackageIdentity(
+    cargoTomlFile,
+    cargoData,
+    context,
+  );
+  const dependencyGraph = [];
+  const dependsOn = new Set();
+  if (workspaceContext?.isWorkspaceRoot) {
+    for (const workspaceMember of workspaceMemberMap.values()) {
+      if (workspaceMember?.ref) {
+        dependsOn.add(workspaceMember.ref);
+      }
+    }
+  }
+  collectCargoManifestDependencyRefs(
+    cargoTomlFile,
+    cargoData.dependencies,
+    workspaceDependencies,
+    workspaceContext,
+    workspaceMemberMap,
+    dependsOn,
+  );
+  collectCargoManifestDependencyRefs(
+    cargoTomlFile,
+    cargoData["build-dependencies"],
+    workspaceDependencies,
+    workspaceContext,
+    workspaceMemberMap,
+    dependsOn,
+  );
+  collectCargoManifestDependencyRefs(
+    cargoTomlFile,
+    cargoData["dev-dependencies"],
+    workspaceDependencies,
+    workspaceContext,
+    workspaceMemberMap,
+    dependsOn,
+  );
+  if (cargoData.target && typeof cargoData.target === "object") {
+    for (const targetBlock of Object.values(cargoData.target)) {
+      if (!targetBlock || typeof targetBlock !== "object") {
+        continue;
+      }
+      collectCargoManifestDependencyRefs(
+        cargoTomlFile,
+        targetBlock.dependencies,
+        workspaceDependencies,
+        workspaceContext,
+        workspaceMemberMap,
+        dependsOn,
+      );
+      collectCargoManifestDependencyRefs(
+        cargoTomlFile,
+        targetBlock["build-dependencies"],
+        workspaceDependencies,
+        workspaceContext,
+        workspaceMemberMap,
+        dependsOn,
+      );
+      collectCargoManifestDependencyRefs(
+        cargoTomlFile,
+        targetBlock["dev-dependencies"],
+        workspaceDependencies,
+        workspaceContext,
+        workspaceMemberMap,
+        dependsOn,
+      );
+    }
+  }
+  if (currentIdentity?.name && currentIdentity?.version) {
+    dependencyGraph.push({
+      dependsOn: [...dependsOn].sort(),
+      ref: cargoPackageInfoToPurl(currentIdentity),
+    });
+  }
+  if (
+    context?.includeWorkspaceMembers !== false &&
+    workspaceContext?.isWorkspaceRoot &&
+    Array.isArray(cargoData?.workspace?.members)
+  ) {
+    for (const workspaceMemberFile of resolveCargoWorkspaceMembers(
+      cargoTomlFile,
+      cargoData.workspace,
+    )) {
+      if (workspaceMemberFile === cargoTomlFile) {
+        continue;
+      }
+      dependencyGraph.push(
+        ...parseCargoManifestDependencyData(workspaceMemberFile, {
+          includeWorkspaceMembers: false,
+          visitedCargoTomlDependencyGraphFiles: visitedCargoTomlFiles,
+          workspaceMemberCache,
+          workspaceRootData: cargoData,
+          workspaceRootFile: cargoTomlFile,
+        }),
+      );
+    }
+  }
+  return dependencyGraph;
+}
+
 /**
  * Parses a Cargo.lock file's TOML data and returns a flat dependency graph as an
  * array of objects mapping each package purl to the purls it directly depends on.
@@ -11082,7 +12303,15 @@ export function parseMixLockData(mixData) {
  */
 export function parseGitHubWorkflowData(f) {
   const { components } = parseWorkflowFile(f);
-  return components.filter((c) => c.scope === "required");
+  return components.filter(
+    (component) =>
+      component.scope === "required" ||
+      component.properties?.some(
+        (property) =>
+          property?.name === "cdx:github:step:usesCargo" &&
+          property?.value === "true",
+      ),
+  );
 }
 
 /**
@@ -13843,7 +15072,7 @@ export async function collectMvnDependencies(
   let jarNSMapping = {};
   const MAVEN_CACHE_DIR =
     process.env.MAVEN_CACHE_DIR || join(homedir(), ".m2", "repository");
-  const tempDir = mkdtempSync(join(tmpdir(), "mvn-deps-"));
+  const tempDir = safeMkdtempSync(join(tmpdir(), "mvn-deps-"));
   let copyArgs = [
     "dependency:copy-dependencies",
     `-DoutputDirectory=${tempDir}`,
@@ -13888,8 +15117,8 @@ export async function collectMvnDependencies(
   }
 
   // Clean up
-  if (cleanup && tempDir?.startsWith(tmpdir()) && rmSync) {
-    rmSync(tempDir, { recursive: true, force: true });
+  if (cleanup && tempDir?.startsWith(tmpdir())) {
+    safeRmSync(tempDir, { recursive: true, force: true });
   }
   return jarNSMapping;
 }
@@ -14465,7 +15694,7 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
     lstatSync(jarFile).isFile()
   ) {
     // Only copy if the file doesn't exist
-    copyFileSync(jarFile, join(tempDir, fname), constants.COPYFILE_FICLONE);
+    safeCopyFileSync(jarFile, join(tempDir, fname), constants.COPYFILE_FICLONE);
   }
   const env = {
     ...process.env,
@@ -14485,8 +15714,17 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
     if (safeExistsSync(join(tempDir, fname))) {
       try {
         const zip = new StreamZip.async({ file: join(tempDir, fname) });
-        await zip.extract(null, tempDir);
+        const extracted = await safeExtractArchive(
+          join(tempDir, fname),
+          tempDir,
+          async () => {
+            await zip.extract(null, tempDir);
+          },
+        );
         await zip.close();
+        if (!extracted) {
+          return pkgList;
+        }
       } catch (e) {
         console.log(`Unable to extract ${join(tempDir, fname)}. Skipping.`, e);
         return pkgList;
@@ -14541,9 +15779,11 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         // Unzip natively
         try {
           const zip = new StreamZip.async({ file: jf });
-          await zip.extract(null, tempDir);
+          const extracted = await safeExtractArchive(jf, tempDir, async () => {
+            await zip.extract(null, tempDir);
+          });
           await zip.close();
-          jarResult = { status: 0 };
+          jarResult = { status: extracted ? 0 : 1 };
         } catch (_e) {
           if (DEBUG_MODE) {
             console.log(`Unable to extract ${jf}. Skipping.`);
@@ -14786,9 +16026,9 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         }
       }
       try {
-        if (rmSync && safeExistsSync(join(tempDir, "META-INF"))) {
+        if (safeExistsSync(join(tempDir, "META-INF"))) {
           // Clean up META-INF
-          rmSync(join(tempDir, "META-INF"), {
+          safeRmSync(join(tempDir, "META-INF"), {
             recursive: true,
             force: true,
           });
@@ -14859,10 +16099,14 @@ export function addPlugin(projectPath, plugin) {
   let originalPluginsFile = null;
   if (safeExistsSync(pluginsFile)) {
     originalPluginsFile = `${pluginsFile}.cdxgen`;
-    copyFileSync(pluginsFile, originalPluginsFile, constants.COPYFILE_FICLONE);
+    safeCopyFileSync(
+      pluginsFile,
+      originalPluginsFile,
+      constants.COPYFILE_FICLONE,
+    );
   }
 
-  writeFileSync(pluginsFile, plugin, { flag: "a" });
+  safeWriteSync(pluginsFile, plugin, { flag: "a" });
   return originalPluginsFile;
 }
 
@@ -14878,12 +16122,16 @@ export function cleanupPlugin(projectPath, originalPluginsFile) {
   if (safeExistsSync(pluginsFile)) {
     if (!originalPluginsFile) {
       // just remove the file, it was never there
-      unlinkSync(pluginsFile);
+      safeUnlinkSync(pluginsFile);
       return !safeExistsSync(pluginsFile);
     }
     // Bring back the original file
-    copyFileSync(originalPluginsFile, pluginsFile, constants.COPYFILE_FICLONE);
-    unlinkSync(originalPluginsFile);
+    safeCopyFileSync(
+      originalPluginsFile,
+      pluginsFile,
+      constants.COPYFILE_FICLONE,
+    );
+    safeUnlinkSync(originalPluginsFile);
     return true;
   }
   return false;
@@ -15600,7 +16848,7 @@ async function fullScanCocoaPod(dependency, component, options) {
         dirname(podspecLocation),
         `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
       );
-      writeFileSync(podspecLocation, podspecContent);
+      safeWriteSync(podspecLocation, podspecContent);
       temporaryFiles.add(podspecLocation);
     }
     result = executePodCommand(
@@ -16123,7 +17371,7 @@ export function findAppModules(
   methodology = "usages",
   slicesFile = undefined,
 ) {
-  const tempDir = mkdtempSync(join(tmpdir(), "atom-deps-"));
+  const tempDir = safeMkdtempSync(join(tmpdir(), "atom-deps-"));
   const atomFile = join(tempDir, `${language}-app.atom`);
   if (!slicesFile) {
     slicesFile = join(tempDir, "slices.json");
@@ -16155,8 +17403,8 @@ export function findAppModules(
     );
   }
   // Clean up
-  if (tempDir?.startsWith(tmpdir()) && rmSync) {
-    rmSync(tempDir, { recursive: true, force: true });
+  if (tempDir?.startsWith(tmpdir())) {
+    safeRmSync(tempDir, { recursive: true, force: true });
   }
   return retList;
 }