@cyclonedx/cdxgen 12.4.3 → 12.4.4

package/lib/helpers/atomUtils.js

@@ -0,0 +1,445 @@
+import process from "node:process";
+
+const ASTGEN_DEFAULT_IGNORE_DIRS = [
+  "venv",
+  "docs",
+  "e2e",
+  "e2e-beta",
+  "examples",
+  "cypress",
+  "jest-cache",
+  "eslint-rules",
+  "codemods",
+  "flow-typed",
+  "i18n",
+];
+
+const ATOM_JS_LANGUAGES = new Set([
+  "javascript",
+  "js",
+  "jsx",
+  "node",
+  "nodejs",
+  "typescript",
+  "ts",
+  "tsx",
+]);
+
+function escapeScalaRegexLiteral(value) {
+  return value.replace(/[\\^$*+?.()|[\]{}]/g, "\\$&");
+}
+
+function normalizeGlobPattern(pattern) {
+  pattern = `${pattern}`;
+  let normalizedPattern = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const char = pattern[i];
+    if (char !== "\\") {
+      normalizedPattern += char;
+      continue;
+    }
+    const nextChar = pattern[i + 1];
+    if (nextChar && "*?[]{}()!+@,".includes(nextChar)) {
+      normalizedPattern += char;
+      normalizedPattern += nextChar;
+      i++;
+    } else {
+      normalizedPattern += "/";
+    }
+  }
+  return normalizedPattern.replace(/^\.\//, "");
+}
+
+function splitGlobAlternates(value, separator = ",") {
+  const alternates = [];
+  let current = "";
+  let braceDepth = 0;
+  let bracketDepth = 0;
+  let parenDepth = 0;
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if (char === "\\") {
+      current += char;
+      if (i + 1 < value.length) {
+        current += value[++i];
+      }
+      continue;
+    }
+    if (char === "[" && bracketDepth === 0) {
+      bracketDepth++;
+    } else if (char === "]" && bracketDepth > 0) {
+      bracketDepth--;
+    } else if (!bracketDepth) {
+      if (char === "{") {
+        braceDepth++;
+      } else if (char === "}" && braceDepth > 0) {
+        braceDepth--;
+      } else if (char === "(") {
+        parenDepth++;
+      } else if (char === ")" && parenDepth > 0) {
+        parenDepth--;
+      } else if (char === separator && braceDepth === 0 && parenDepth === 0) {
+        alternates.push(current);
+        current = "";
+        continue;
+      }
+    }
+    current += char;
+  }
+  alternates.push(current);
+  return alternates;
+}
+
+function findClosingGlobToken(value, startIndex, openChar, closeChar) {
+  if (openChar === "[") {
+    for (let i = startIndex + 1; i < value.length; i++) {
+      if (value[i] === "\\") {
+        i++;
+      } else if (value[i] === closeChar) {
+        return i;
+      }
+    }
+    return -1;
+  }
+  let depth = 0;
+  let inBracket = false;
+  for (let i = startIndex; i < value.length; i++) {
+    const char = value[i];
+    if (char === "\\") {
+      i++;
+      continue;
+    }
+    if (char === "[" && !inBracket) {
+      inBracket = true;
+    } else if (char === "]" && inBracket) {
+      inBracket = false;
+    } else if (!inBracket) {
+      if (char === openChar) {
+        depth++;
+      } else if (char === closeChar) {
+        depth--;
+        if (depth === 0) {
+          return i;
+        }
+      }
+    }
+  }
+  return -1;
+}
+
+function globCharClassToRegex(value) {
+  if (!value.length) {
+    return "\\[";
+  }
+  let classValue = value;
+  let prefix = "";
+  if (classValue[0] === "!" || classValue[0] === "^") {
+    prefix = "^";
+    classValue = classValue.slice(1);
+  }
+  if (!classValue.length) {
+    return "\\[";
+  }
+  classValue = classValue.replace(/\\/g, "\\\\").replace(/]/g, "\\]");
+  return `[${prefix}${classValue}]`;
+}
+
+function globSegmentToScalaRegex(segment) {
+  let regex = "";
+  for (let i = 0; i < segment.length; i++) {
+    const char = segment[i];
+    const nextChar = segment[i + 1];
+    if (char === "\\") {
+      if (i + 1 < segment.length) {
+        regex += escapeScalaRegexLiteral(segment[++i]);
+      } else {
+        regex += "\\\\";
+      }
+    } else if (char === "*" && nextChar !== "(") {
+      regex += "[^/\\\\]*";
+    } else if (char === "?" && nextChar !== "(") {
+      regex += "[^/\\\\]";
+    } else if (char === "[") {
+      const bracketEnd = findClosingGlobToken(segment, i, "[", "]");
+      if (bracketEnd === -1) {
+        regex += "\\[";
+      } else {
+        regex += globCharClassToRegex(segment.slice(i + 1, bracketEnd));
+        i = bracketEnd;
+      }
+    } else if (char === "{") {
+      const braceEnd = findClosingGlobToken(segment, i, "{", "}");
+      if (braceEnd === -1) {
+        regex += "\\{";
+      } else {
+        const alternates = splitGlobAlternates(
+          segment.slice(i + 1, braceEnd),
+        ).map((alternate) => globSegmentToScalaRegex(alternate));
+        regex += `(?:${alternates.join("|")})`;
+        i = braceEnd;
+      }
+    } else if (["@", "?", "+", "*", "!"].includes(char) && nextChar === "(") {
+      const parenEnd = findClosingGlobToken(segment, i + 1, "(", ")");
+      if (parenEnd === -1) {
+        regex += escapeScalaRegexLiteral(char);
+      } else {
+        const alternates = splitGlobAlternates(
+          segment.slice(i + 2, parenEnd),
+          "|",
+        ).map((alternate) => globSegmentToScalaRegex(alternate));
+        const alternateRegex = `(?:${alternates.join("|")})`;
+        if (char === "@") {
+          regex += alternateRegex;
+        } else if (char === "?") {
+          regex += `${alternateRegex}?`;
+        } else if (char === "+") {
+          regex += `${alternateRegex}+`;
+        } else if (char === "*") {
+          regex += `${alternateRegex}*`;
+        } else {
+          regex += `(?!(?:${alternates.join("|")})$)[^/\\\\]*`;
+        }
+        i = parenEnd;
+      }
+    } else {
+      regex += escapeScalaRegexLiteral(char);
+    }
+  }
+  return regex;
+}
+
+function getExcludePatterns(options = {}) {
+  if (!Array.isArray(options.exclude)) {
+    return [];
+  }
+  return options.exclude
+    .flatMap((pattern) => {
+      pattern = `${pattern}`;
+      return pattern.includes(",") && !pattern.includes("{")
+        ? pattern.split(",")
+        : [pattern];
+    })
+    .map((pattern) => pattern.trim())
+    .filter(Boolean)
+    .filter((pattern) => !pattern.startsWith("!"));
+}
+
+function extractIgnoreDirsFromExcludePatterns(
+  patterns,
+  includeExactPathFragments = false,
+) {
+  const ignoreDirs = new Set();
+  for (const pattern of patterns) {
+    const normalizedPattern = normalizeGlobPattern(pattern);
+    const isExactPath = !/[!*?{}[\]]/.test(normalizedPattern);
+    const segments = normalizedPattern.split("/").filter(Boolean);
+    const literalSegments = segments.filter(
+      (segment) =>
+        !/[!*?{}[\]]/.test(segment) && segment !== "." && segment !== "..",
+    );
+    if (!literalSegments.length) {
+      continue;
+    }
+    const dirName = literalSegments.at(-1);
+    if (
+      dirName &&
+      ((includeExactPathFragments && isExactPath) ||
+        !dirName.includes(".") ||
+        segments.at(-1) !== dirName)
+    ) {
+      ignoreDirs.add(dirName);
+    }
+  }
+  return Array.from(ignoreDirs);
+}
+
+function globToScalaRegexFragment(pattern) {
+  pattern = normalizeGlobPattern(pattern);
+  const isAbsolute = pattern.startsWith("/");
+  const segments = pattern.split("/").filter(Boolean);
+  if (!segments.length) {
+    return "$^";
+  }
+  if (segments.length === 1 && segments[0] === "**") {
+    return ".*";
+  }
+  let regex = isAbsolute ? "^[/\\\\]" : "(?:^|.*[/\\\\])";
+  for (let i = 0; i < segments.length; i++) {
+    const segment = segments[i];
+    const isLast = i === segments.length - 1;
+    const nextSegment = segments[i + 1];
+    if (segment === "**") {
+      if (i === 0) {
+        continue;
+      }
+      if (isLast) {
+        regex += "(?:[/\\\\].*)?";
+      } else {
+        regex += "(?:[/\\\\][^/\\\\]+)*[/\\\\]";
+      }
+      continue;
+    }
+    regex += globSegmentToScalaRegex(segment);
+    if (!isLast && nextSegment !== "**") {
+      regex += "[/\\\\]";
+    }
+  }
+  return `${regex}$`;
+}
+
+/**
+ * Convert cdxgen's glob-style exclude patterns to a Scala/Java regex string.
+ *
+ * @param {string[]} patterns Glob patterns from cdxgen's `--exclude` option
+ * @returns {string|undefined} Scala-compatible regex or undefined when empty
+ */
+export function globPatternsToAtomIgnoreRegex(patterns = []) {
+  const fragments = getExcludePatterns({ exclude: patterns }).map((pattern) =>
+    globToScalaRegexFragment(pattern),
+  );
+  if (!fragments.length) {
+    return undefined;
+  }
+  return `(?:${fragments.join("|")})`;
+}
+
+export function isPathExcludedByGlobPatterns(filePath, patterns = []) {
+  const atomIgnoreRegex = globPatternsToAtomIgnoreRegex(patterns);
+  if (!atomIgnoreRegex) {
+    return false;
+  }
+  const normalizedPath = `${filePath}`.replace(/\\/g, "/").replace(/^\.\//, "");
+  const regex = new RegExp(atomIgnoreRegex);
+  return regex.test(normalizedPath) || regex.test(`./${normalizedPath}`);
+}
+
+export function filterAtomSlicesByExcludePatterns(sliceData, patterns = []) {
+  if (!sliceData || !getExcludePatterns({ exclude: patterns }).length) {
+    return sliceData;
+  }
+  const shouldKeepFile = (fileName) =>
+    !fileName || !isPathExcludedByGlobPatterns(fileName, patterns);
+  if (Array.isArray(sliceData)) {
+    return sliceData.filter((slice) => shouldKeepFile(slice.fileName));
+  }
+  const filteredSliceData = { ...sliceData };
+  if (Array.isArray(filteredSliceData.objectSlices)) {
+    filteredSliceData.objectSlices = filteredSliceData.objectSlices.filter(
+      (slice) => shouldKeepFile(slice.fileName),
+    );
+  }
+  if (Array.isArray(filteredSliceData.userDefinedTypes)) {
+    filteredSliceData.userDefinedTypes =
+      filteredSliceData.userDefinedTypes.filter((slice) =>
+        shouldKeepFile(slice.fileName),
+      );
+  }
+  if (Array.isArray(filteredSliceData.reachables)) {
+    filteredSliceData.reachables = filteredSliceData.reachables.filter(
+      (reachable) =>
+        (reachable.flows || []).every((flow) =>
+          shouldKeepFile(flow.parentFileName || flow.fileName),
+        ),
+    );
+  }
+  if (
+    filteredSliceData.graph?.nodes &&
+    Array.isArray(filteredSliceData.paths)
+  ) {
+    const excludedNodeIds = new Set(
+      filteredSliceData.graph.nodes
+        .filter((node) => !shouldKeepFile(node.parentFileName || node.fileName))
+        .map((node) => node.id),
+    );
+    filteredSliceData.paths = filteredSliceData.paths.filter((path) =>
+      path.every((nodeId) => !excludedNodeIds.has(nodeId)),
+    );
+    const retainedNodeIds = new Set(filteredSliceData.paths.flat());
+    filteredSliceData.graph = {
+      ...filteredSliceData.graph,
+      nodes: filteredSliceData.graph.nodes.filter(
+        (node) => retainedNodeIds.has(node.id) || !excludedNodeIds.has(node.id),
+      ),
+      edges: (filteredSliceData.graph.edges || []).filter((edge) => {
+        const source = edge.src ?? edge.source;
+        const destination = edge.dst ?? edge.destination;
+        return (
+          !excludedNodeIds.has(source) && !excludedNodeIds.has(destination)
+        );
+      }),
+    };
+  }
+  return filteredSliceData;
+}
+
+function mergeCsvValues(...valueLists) {
+  const values = new Set();
+  for (const valueList of valueLists) {
+    if (Array.isArray(valueList)) {
+      valueList.forEach((value) => {
+        values.add(`${value}`.trim());
+      });
+    } else if (typeof valueList === "string" && valueList.length) {
+      valueList.split(",").forEach((value) => {
+        values.add(value.trim());
+      });
+    }
+  }
+  return Array.from(values).filter(Boolean).join(",");
+}
+
+function mergeRegexValues(...regexValues) {
+  const values = regexValues
+    .map((regexValue) => `${regexValue || ""}`.trim())
+    .filter(Boolean);
+  if (!values.length) {
+    return undefined;
+  }
+  return values.map((regexValue) => `(?:${regexValue})`).join("|");
+}
+
+/**
+ * Build additional environment variables for Atom from cdxgen CLI options.
+ *
+ * @param {Object} options CLI options
+ * @param {string} language Atom language name
+ * @returns {Object} Environment variables to pass to Atom
+ */
+export function buildAtomCommandEnv(options = {}, language = "") {
+  const excludePatterns = getExcludePatterns(options);
+  if (!excludePatterns.length) {
+    return {};
+  }
+  const chenIgnoreDirs = mergeCsvValues(
+    process.env.CHEN_IGNORE_DIRS,
+    extractIgnoreDirsFromExcludePatterns(excludePatterns, true),
+  );
+  const env = {};
+  if (chenIgnoreDirs) {
+    env.CHEN_IGNORE_DIRS = chenIgnoreDirs;
+  }
+  const atomIgnoreRegex = globPatternsToAtomIgnoreRegex(excludePatterns);
+  const normalizedLanguage = `${language}`.toLowerCase();
+  if (ATOM_JS_LANGUAGES.has(normalizedLanguage)) {
+    const astgenBaseIgnoreDirs =
+      process.env.ASTGEN_IGNORE_DIRS === undefined
+        ? ASTGEN_DEFAULT_IGNORE_DIRS
+        : process.env.ASTGEN_IGNORE_DIRS;
+    const astgenIgnoreDirs = mergeCsvValues(
+      astgenBaseIgnoreDirs,
+      "node_modules",
+      extractIgnoreDirsFromExcludePatterns(excludePatterns),
+    );
+    if (astgenIgnoreDirs) {
+      env.ASTGEN_IGNORE_DIRS = astgenIgnoreDirs;
+    }
+    const astgenIgnoreFilePattern = mergeRegexValues(
+      process.env.ASTGEN_IGNORE_FILE_PATTERN,
+      atomIgnoreRegex,
+    );
+    if (astgenIgnoreFilePattern) {
+      env.ASTGEN_IGNORE_FILE_PATTERN = astgenIgnoreFilePattern;
+    }
+  }
+  return env;
+}

package/lib/helpers/atomUtils.poku.js

@@ -0,0 +1,137 @@
+import process from "node:process";
+
+import { assert, it } from "poku";
+
+import {
+  buildAtomCommandEnv,
+  filterAtomSlicesByExcludePatterns,
+  globPatternsToAtomIgnoreRegex,
+  isPathExcludedByGlobPatterns,
+} from "./atomUtils.js";
+
+it("converts cdxgen exclude globs to Scala-compatible regex", () => {
+  const atomRegex = globPatternsToAtomIgnoreRegex([
+    "**/*.spec.js",
+    "src/**/fixtures/*.{js,ts}",
+    "test/[!a-c]?.jsx",
+    "packages/@(api|web)/**/*.test.ts",
+  ]);
+  const regex = new RegExp(atomRegex);
+  assert.ok(regex.test("example.spec.js"));
+  assert.ok(regex.test("src/example.spec.js"));
+  assert.ok(regex.test("src\\example.spec.js"));
+  assert.ok(regex.test("src/app/fixtures/demo.ts"));
+  assert.ok(regex.test("test/z1.jsx"));
+  assert.ok(regex.test("packages/api/src/foo.test.ts"));
+  assert.ok(regex.test("packages/web/foo.test.ts"));
+  assert.ok(!regex.test("src/app/fixtures/demo.py"));
+  assert.ok(!regex.test("test/a1.jsx"));
+  assert.ok(!regex.test("packages/mobile/foo.test.ts"));
+  assert.ok(!regex.test("src/example.spec.jsx"));
+});
+
+it("treats escaped glob wildcards as literal characters", () => {
+  const atomRegex = globPatternsToAtomIgnoreRegex(["src/escaped/\\*.js"]);
+  const regex = new RegExp(atomRegex);
+  assert.ok(regex.test("src/escaped/*.js"));
+  assert.ok(!regex.test("src/escaped/index.js"));
+});
+
+it("matches paths against cdxgen exclude globs", () => {
+  const patterns = ["**/*.spec.js", "src/generated/**"];
+  assert.ok(isPathExcludedByGlobPatterns("src/foo.spec.js", patterns));
+  assert.ok(isPathExcludedByGlobPatterns("src/generated/client.js", patterns));
+  assert.ok(isPathExcludedByGlobPatterns("src\\foo.spec.js", patterns));
+  assert.ok(!isPathExcludedByGlobPatterns("src/foo.test.js", patterns));
+  assert.ok(!isPathExcludedByGlobPatterns("src/manual/client.js", patterns));
+});
+
+it("builds global Atom and JavaScript astgen exclude environment", () => {
+  const originalAstgenIgnoreDirs = process.env.ASTGEN_IGNORE_DIRS;
+  const originalAstgenIgnoreFilePattern =
+    process.env.ASTGEN_IGNORE_FILE_PATTERN;
+  const originalChenIgnoreDirs = process.env.CHEN_IGNORE_DIRS;
+  try {
+    delete process.env.ASTGEN_IGNORE_DIRS;
+    delete process.env.ASTGEN_IGNORE_FILE_PATTERN;
+    process.env.CHEN_IGNORE_DIRS = "vendor";
+    const options = {
+      exclude: [
+        "**/ignored/**",
+        "src/generated/**",
+        "**/*.spec.js",
+        "noxfile.py",
+      ],
+    };
+    const env = buildAtomCommandEnv(options, "javascript");
+    const chenIgnoreDirs = env.CHEN_IGNORE_DIRS.split(",");
+    const astgenIgnoreDirs = env.ASTGEN_IGNORE_DIRS.split(",");
+    assert.deepStrictEqual(Object.keys(env).sort(), [
+      "ASTGEN_IGNORE_DIRS",
+      "ASTGEN_IGNORE_FILE_PATTERN",
+      "CHEN_IGNORE_DIRS",
+    ]);
+    assert.ok(chenIgnoreDirs.includes("vendor"));
+    assert.ok(chenIgnoreDirs.includes("ignored"));
+    assert.ok(chenIgnoreDirs.includes("generated"));
+    assert.ok(chenIgnoreDirs.includes("noxfile.py"));
+    assert.ok(!chenIgnoreDirs.includes("src"));
+    assert.ok(astgenIgnoreDirs.includes("node_modules"));
+    assert.ok(astgenIgnoreDirs.includes("ignored"));
+    assert.ok(astgenIgnoreDirs.includes("generated"));
+    assert.ok(!astgenIgnoreDirs.includes("noxfile.py"));
+    assert.ok(!astgenIgnoreDirs.includes("src"));
+    assert.ok(
+      new RegExp(env.ASTGEN_IGNORE_FILE_PATTERN).test("src/foo.spec.js"),
+    );
+
+    const pythonEnv = buildAtomCommandEnv(options, "python");
+    assert.deepStrictEqual(Object.keys(pythonEnv).sort(), ["CHEN_IGNORE_DIRS"]);
+  } finally {
+    if (originalAstgenIgnoreDirs === undefined) {
+      delete process.env.ASTGEN_IGNORE_DIRS;
+    } else {
+      process.env.ASTGEN_IGNORE_DIRS = originalAstgenIgnoreDirs;
+    }
+    if (originalAstgenIgnoreFilePattern === undefined) {
+      delete process.env.ASTGEN_IGNORE_FILE_PATTERN;
+    } else {
+      process.env.ASTGEN_IGNORE_FILE_PATTERN = originalAstgenIgnoreFilePattern;
+    }
+    if (originalChenIgnoreDirs === undefined) {
+      delete process.env.CHEN_IGNORE_DIRS;
+    } else {
+      process.env.CHEN_IGNORE_DIRS = originalChenIgnoreDirs;
+    }
+  }
+});
+
+it("filters Atom slices using exclude globs", () => {
+  const sliceData = {
+    objectSlices: [
+      { fileName: "src/index.js", fullName: "src/index.js::program" },
+      { fileName: "src/index.spec.js", fullName: "src/index.spec.js::program" },
+    ],
+    userDefinedTypes: [
+      { fileName: "src/generated/client.js", name: "GeneratedClient" },
+      { fileName: "src/model.js", name: "Model" },
+    ],
+    reachables: [
+      { flows: [{ parentFileName: "src/index.js" }] },
+      { flows: [{ parentFileName: "src/index.spec.js" }] },
+    ],
+  };
+  const filtered = filterAtomSlicesByExcludePatterns(sliceData, [
+    "**/*.spec.js",
+    "src/generated/**",
+  ]);
+  assert.deepStrictEqual(
+    filtered.objectSlices.map((slice) => slice.fileName),
+    ["src/index.js"],
+  );
+  assert.deepStrictEqual(
+    filtered.userDefinedTypes.map((slice) => slice.fileName),
+    ["src/model.js"],
+  );
+  assert.strictEqual(filtered.reachables.length, 1);
+});

package/lib/helpers/bomUtils.js

@@ -11,6 +11,39 @@ const CYCLONEDX_FORMAT_KEYS = new Set([
   MODERN_CYCLONEDX_ROOT_KEY,
   "specVersion",
 ]);
+const COMPONENT_TYPES_1_4 = [
+  "application",
+  "framework",
+  "library",
+  "container",
+  "operating-system",
+  "device",
+  "firmware",
+  "file",
+];
+const COMPONENT_TYPES_1_5 = [
+  "application",
+  "framework",
+  "library",
+  "container",
+  "platform",
+  "operating-system",
+  "device",
+  "device-driver",
+  "firmware",
+  "file",
+  "machine-learning-model",
+  "data",
+];
+const COMPONENT_TYPES_1_6 = [...COMPONENT_TYPES_1_5, "cryptographic-asset"];
+
+export const CYCLONEDX_COMPONENT_TYPES_BY_SPEC_VERSION = Object.freeze({
+  1.4: Object.freeze(COMPONENT_TYPES_1_4),
+  1.5: Object.freeze(COMPONENT_TYPES_1_5),
+  1.6: Object.freeze(COMPONENT_TYPES_1_6),
+  1.7: Object.freeze(COMPONENT_TYPES_1_6),
+  "2.0": Object.freeze(COMPONENT_TYPES_1_6),
+});
 
 export const isSpdxJsonLd = (bomJson) =>
   Boolean(
@@ -67,6 +100,44 @@ export const isCycloneDxSpecVersionAtLeast = (specVersion, minimumVersion) => {
 export const isCycloneDx20SpecVersion = (specVersion) =>
   isCycloneDxSpecVersionAtLeast(specVersion, 2);
 
+export const getSupportedCycloneDxComponentTypes = (specVersion = 1.7) => {
+  const normalizedSpecVersion = toCycloneDxSpecVersionString(specVersion);
+  return [
+    ...(CYCLONEDX_COMPONENT_TYPES_BY_SPEC_VERSION[normalizedSpecVersion] ||
+      CYCLONEDX_COMPONENT_TYPES_BY_SPEC_VERSION["1.7"]),
+  ];
+};
+
+export const normalizeCycloneDxComponentTypeFilter = (componentType) => {
+  if (!componentType) {
+    return [];
+  }
+  const componentTypes = Array.isArray(componentType)
+    ? componentType
+    : [componentType];
+  return Array.from(
+    new Set(componentTypes.map((type) => `${type}`.trim()).filter(Boolean)),
+  );
+};
+
+export const isCycloneDxComponentTypeEnabled = (
+  componentType,
+  options = {},
+) => {
+  if (!componentType) {
+    return false;
+  }
+  const requestedComponentTypes = normalizeCycloneDxComponentTypeFilter(
+    options.componentType,
+  );
+  if (requestedComponentTypes.length) {
+    return requestedComponentTypes.includes(componentType);
+  }
+  return getSupportedCycloneDxComponentTypes(options.specVersion).includes(
+    componentType,
+  );
+};
+
 export const getCycloneDxRootFormatKey = (specVersionOrBom) => {
   const specVersion =
     specVersionOrBom && typeof specVersionOrBom === "object"