@cyclonedx/cdxgen 8.0.0 → 8.0.1

package/README.md

@@ -2,7 +2,7 @@
 
 ![cdxgen logo](cdxgen.png)
 
-This tool creates a valid and compliant CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.4 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
+This tool creates a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.4 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
 
 When used with plugins, cdxgen could generate an SBoM for Linux docker images and even VMs running Linux or Windows operating system.
 
@@ -352,3 +352,6 @@ Permission to modify and redistribute is granted under the terms of the Apache 2
 ## Discord support
 
 The developers could be reached via the [discord](https://discord.gg/DCNxzaeUpd) channel.
+
+
+[cyclonedx-homepage]: https://cyclonedx.org

package/index.js

@@ -3079,6 +3079,9 @@ const createPHPBom = async (path, options) => {
   const composerLockMode = composerLockFiles.length;
   // Create a composer.lock file for each composer.json file if needed.
   if (!composerLockMode && composerJsonMode && options.installDeps) {
+    if (DEBUG_MODE) {
+      console.log("About to invoke composer --version");
+    }
     const versionResult = spawnSync("composer", ["--version"], {
       encoding: "utf-8"
     });
@@ -3086,18 +3089,26 @@ const createPHPBom = async (path, options) => {
       console.error(
         "No composer version found. Check if composer is installed and available in PATH."
       );
-      console.log(versionResult.error, versionResult.stderr);
+      if (DEBUG_MODE) {
+        console.log(versionResult.error, versionResult.stderr);
+      }
       options.failOnError && process.exit(1);
-      return {};
     }
-    const composerVersion = versionResult.stdout.match(/version (\d)/)[1];
+    let composerVersion = undefined;
     if (DEBUG_MODE) {
-      console.log("Detected composer version:", composerVersion);
+      console.log("Parsing version", versionResult.stdout);
+    }
+    let tmpV = undefined;
+    if (versionResult && versionResult.stdout) {
+      versionResult.stdout.split(" ");
+    }
+    if (tmpV && tmpV.length > 1) {
+      composerVersion = tmpV[1];
     }
     for (let f of composerJsonFiles) {
       const basePath = pathLib.dirname(f);
       let args = [];
-      if (composerVersion > 1) {
+      if (composerVersion && !composerVersion.startsWith("1")) {
         console.log("Generating composer.lock in", basePath);
         args = ["update", "--no-install", "--ignore-platform-reqs"];
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.0.0",
+  "version": "8.0.1",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",