@cyclonedx/cdxgen 8.2.2 → 8.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.2.2",
+  "version": "8.2.3",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -773,13 +773,22 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         dependsOn: ddeplist
       });
     }
-    const lockfileVersion = yamlObj.lockfileVersion;
+    let lockfileVersion = yamlObj.lockfileVersion;
+    try {
+      lockfileVersion = parseInt(lockfileVersion, 10);
+    } catch (e) {
+      // ignore parse errors
+    }
     const packages = yamlObj.packages;
     const pkgKeys = Object.keys(packages);
     for (var k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
       // In lockfileVersion 6, /@babel/code-frame@7.18.6
-      const fullName = pkgKeys[k].replace("/@", "@");
+      let fullName = pkgKeys[k].replace("/@", "@");
+      // Handle /vite@4.2.1(@types/node@18.15.11) in lockfileVersion 6
+      if (lockfileVersion >= 6 && fullName.includes("(")) {
+        fullName = fullName.split("(")[0];
+      }
       const parts = fullName.split("/");
       const integrity = packages[pkgKeys[k]].resolution.integrity;
       const deps = packages[pkgKeys[k]].dependencies || [];
@@ -788,12 +797,14 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         let name = "";
         let version = "";
         let group = "";
-        if (lockfileVersion === "6.0" && fullName.includes("@")) {
+        if (lockfileVersion >= 6 && fullName.includes("@")) {
           const tmpA = parts[parts.length - 1].split("@");
           group = parts[0];
           if (parts.length === 2 && tmpA.length > 1) {
             name = tmpA[0];
             version = tmpA[1];
+          } else {
+            console.log(parts, fullName);
           }
         } else {
           if (parts.length === 2) {
@@ -805,6 +816,13 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
             version = parts[2];
           }
         }
+        // Let's have some warnings till we fully support pnpm 8
+        if (!name) {
+          console.warn(
+            `Unable to extract name and version for string ${pkgKeys[k]}`
+          );
+          continue;
+        }
         if (group !== "@types" && name.indexOf("file:") !== 0) {
           const purlString = new PackageURL(
             "npm",

package/utils.test.js

@@ -1215,6 +1215,18 @@ test("parsePnpmLock", async () => {
       "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
     properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
   });
+  parsedList = await utils.parsePnpmLock("./test/data/pnpm-lock6a.yaml");
+  expect(parsedList.pkgList.length).toEqual(229);
+  expect(parsedList.dependenciesList.length).toEqual(229);
+  expect(parsedList.pkgList[0]).toEqual({
+    group: "@babel",
+    name: "code-frame",
+    version: "7.18.6",
+    scope: "optional",
+    _integrity:
+      "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6a.yaml" }]
+  });
 });
 
 test("parseYarnLock", async () => {