@cyclonedx/cdxgen 8.3.0 → 8.3.1

package/binary.js

@@ -279,8 +279,12 @@ const getOSPackages = (src) => {
     const bomJsonFile = path.join(tempDir, "trivy-bom.json");
     const args = [
       imageType,
-      "--skip-update",
+      "--skip-db-update",
+      "--skip-java-db-update",
       "--offline-scan",
+      "--no-progress",
+      "--exit-code",
+      "0",
       "--format",
       "cyclonedx",
       "--output",
@@ -302,11 +306,16 @@ const getOSPackages = (src) => {
       }
     }
     if (fs.existsSync(bomJsonFile)) {
-      const tmpBom = JSON.parse(
-        fs.readFileSync(bomJsonFile, {
-          encoding: "utf-8"
-        })
-      );
+      let tmpBom = {};
+      try {
+        tmpBom = JSON.parse(
+          fs.readFileSync(bomJsonFile, {
+            encoding: "utf-8"
+          })
+        );
+      } catch (e) {
+        // ignore errors
+      }
       // Clean up
       if (tempDir && tempDir.startsWith(os.tmpdir())) {
         if (DEBUG_MODE) {

package/docker.js

@@ -159,9 +159,11 @@ const getConnection = async (options) => {
       dockerConn = got.extend(opts);
       if (DEBUG_MODE) {
         if (isDockerRootless) {
-          console.log("Docker service in rootless mode detected!");
+          console.log("Docker service in rootless mode detected.");
         } else {
-          console.log("Docker service in root mode detected!");
+          console.log(
+            "Docker service in root mode detected. Consider switching to rootless mode to improve security. See https://docs.docker.com/engine/security/rootless/"
+          );
         }
       }
     } catch (err) {
@@ -172,7 +174,7 @@ const getConnection = async (options) => {
         dockerConn = got.extend(opts);
         isDockerRootless = true;
         if (DEBUG_MODE) {
-          console.log("Docker service in rootless mode detected!");
+          console.log("Docker service in rootless mode detected.");
         }
         return dockerConn;
       } catch (err) {
@@ -185,7 +187,7 @@ const getConnection = async (options) => {
           dockerConn = got.extend(opts);
           isWinLocalTLS = true;
           if (DEBUG_MODE) {
-            console.log("Docker desktop on Windows detected!");
+            console.log("Docker desktop on Windows detected.");
           }
         } else {
           opts.prefixUrl = opts.podmanRootlessPrefixUrl;
@@ -194,7 +196,9 @@ const getConnection = async (options) => {
           isPodmanRootless = true;
           dockerConn = got.extend(opts);
           if (DEBUG_MODE) {
-            console.log("Podman in rootless mode detected!");
+            console.log(
+              "Podman in rootless mode detected. Thank you for using podman!"
+            );
           }
         }
       } catch (err) {
@@ -205,7 +209,9 @@ const getConnection = async (options) => {
           isPodman = true;
           isPodmanRootless = false;
           dockerConn = got.extend(opts);
-          console.log("Podman in root mode detected!");
+          console.log(
+            "Podman in root mode detected. Consider switching to rootless mode to improve security. See https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md"
+          );
         } catch (err) {
           if (os.platform() === "win32") {
             console.warn(
@@ -416,7 +422,13 @@ const extractTar = async (fullImageName, dir) => {
         strict: true,
         C: dir,
         portable: true,
-        onwarn: () => {}
+        onwarn: () => {},
+        filter: (path) => {
+          if (path.endsWith("cacerts")) {
+            return false;
+          }
+          return true;
+        }
       })
     );
     return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -49,8 +49,8 @@
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.20.15",
-    "@babel/traverse": "^7.20.13",
+    "@babel/parser": "^7.21.4",
+    "@babel/traverse": "^7.21.4",
     "cheerio": "^1.0.0-rc.12",
     "edn-data": "^1.0.0",
     "glob": "^8.1.0",
@@ -59,24 +59,24 @@
     "js-yaml": "^4.1.0",
     "jws": "^4.0.0",
     "node-stream-zip": "^1.15.0",
-    "packageurl-js": "^1.0.0",
+    "packageurl-js": "^1.0.2",
     "parse-packagejson-name": "^1.0.1",
     "prettify-xml": "^1.2.0",
     "properties-reader": "^2.2.0",
-    "semver": "^7.3.8",
+    "semver": "^7.5.0",
     "ssri": "^8.0.1",
     "table": "^6.8.1",
     "tar": "^6.1.13",
     "uuid": "^9.0.0",
     "xml-js": "^1.6.11",
     "xmlbuilder": "^15.1.1",
-    "yargs": "^17.6.2"
+    "yargs": "^17.7.1"
   },
   "optionalDependencies": {
-    "@cyclonedx/cdxgen-plugins-bin": "^1.0.5",
-    "connect": "^3.7.0",
-    "body-parser": "^1.20.1",
-    "compression": "^1.7.4"
+    "@cyclonedx/cdxgen-plugins-bin": "^1.1.0",
+    "body-parser": "^1.20.2",
+    "compression": "^1.7.4",
+    "connect": "^3.7.0"
   },
   "files": [
     "*.js",
@@ -88,7 +88,7 @@
     "queries.json"
   ],
   "devDependencies": {
-    "eslint": "^8.31.0",
+    "eslint": "^8.39.0",
     "jest": "^26.6.3"
   }
 }

package/utils.js

@@ -4207,8 +4207,13 @@ const extractJarArchive = function (jarFile, tempDir) {
   }
   if (pomname && fs.existsSync(pomname)) {
     tempDir = path.dirname(jarFile);
-  } else {
-    fs.copyFileSync(jarFile, path.join(tempDir, fname));
+  } else if (!fs.existsSync(path.join(tempDir, fname))) {
+    // Only copy if the file doesn't exist
+    fs.copyFileSync(
+      jarFile,
+      path.join(tempDir, fname),
+      fs.constants.COPYFILE_FICLONE
+    );
   }
   if (jarFile.endsWith(".war") || jarFile.endsWith(".hpi")) {
     let jarResult = spawnSync("jar", ["-xf", path.join(tempDir, fname)], {
@@ -4405,7 +4410,11 @@ const addPlugin = function (projectPath, plugin) {
   var originalPluginsFile = null;
   if (fs.existsSync(pluginsFile)) {
     originalPluginsFile = pluginsFile + ".cdxgen";
-    fs.copyFileSync(pluginsFile, originalPluginsFile);
+    fs.copyFileSync(
+      pluginsFile,
+      originalPluginsFile,
+      fs.constants.COPYFILE_FICLONE
+    );
   }
 
   fs.writeFileSync(pluginsFile, plugin, { flag: "a" });
@@ -4429,7 +4438,11 @@ const cleanupPlugin = function (projectPath, originalPluginsFile) {
       return !fs.existsSync(pluginsFile);
     } else {
       // Bring back the original file
-      fs.copyFileSync(originalPluginsFile, pluginsFile);
+      fs.copyFileSync(
+        originalPluginsFile,
+        pluginsFile,
+        fs.constants.COPYFILE_FICLONE
+      );
       fs.unlinkSync(originalPluginsFile);
       return true;
     }