@cyclonedx/cdxgen 8.3.3 → 8.4.1

package/README.md

@@ -246,32 +246,33 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 
 ## Environment variables
 
-| Variable                  | Description                                                                                                        |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| SCAN_DEBUG_MODE           | Set to debug to enable debug messages                                                                              |
-| GITHUB_TOKEN              | Specify GitHub token to prevent traffic shaping while querying license and repo information                        |
-| MVN_CMD                   | Set to override maven command                                                                                      |
-| MVN_ARGS                  | Set to pass additional arguments such as profile or settings to maven                                              |
-| MAVEN_HOME                | Specify maven home                                                                                                 |
-| GRADLE_CACHE_DIR          | Specify gradle cache directory. Useful for class name resolving                                                    |
-| GRADLE_MULTI_PROJECT_MODE | Set this variable for gradle multi-project applications. Do not use this with recurse mode.                        |
-| GRADLE_ARGS               | Set to pass additional arguments such as profile or settings to gradle. Eg: --configuration runtimeClassPath       |
-| GRADLE_HOME               | Specify gradle home                                                                                                |
-| GRADLE_CMD                | Set to override gradle command                                                                                     |
-| GRADLE_DEPENDENCY_TASK    | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                  |
-| SBT_CACHE_DIR             | Specify sbt cache directory. Useful for class name resolving                                                       |
-| FETCH_LICENSE             | Set this variable to fetch license information from the registry. npm and golang only                              |
-| USE_GOSUM                 | Set to true to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
-| CDXGEN_TIMEOUT_MS         | Default timeout for known execution involving maven, gradle or sbt                                                 |
-| CDXGEN_SERVER_TIMEOUT_MS  | Default timeout in server mode                                                                                     |
-| BAZEL_TARGET              | Bazel target to build. Default :all (Eg: //java-maven)                                                             |
-| CLJ_CMD                   | Set to override the clojure cli command                                                                            |
-| LEIN_CMD                  | Set to override the leiningen command                                                                              |
-| SBOM_SIGN_ALGORITHM       | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                     |
-| SBOM_SIGN_PRIVATE_KEY     | Private key to use for signing                                                                                     |
-| SBOM_SIGN_PUBLIC_KEY      | Optional. Public key to include in the SBoM signature                                                              |
-| CDX_MAVEN_PLUGIN          | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.6"                                |
-| CDX_MAVEN_GOAL            | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom               |
+| Variable                     | Description                                                                                                        |
+| ---------------------------- | -------------------------------------------------------------------------------------------------------------------|
+| SCAN_DEBUG_MODE              | Set to debug to enable debug messages                                                                              |
+| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                        |
+| MVN_CMD                      | Set to override maven command                                                                                      |
+| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                              |
+| MAVEN_HOME                   | Specify maven home                                                                                                 |
+| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                    |
+| GRADLE_MULTI_PROJECT_MODE    | Set this variable for gradle multi-project applications. Do not use this with recurse mode.                        |
+| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle. Eg: --configuration runtimeClassPath       |
+| GRADLE_HOME                  | Specify gradle home                                                                                                |
+| GRADLE_CMD                   | Set to override gradle command                                                                                     |
+| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                  |
+| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                       |
+| FETCH_LICENSE                | Set this variable to fetch license information from the registry. npm and golang only                              |
+| USE_GOSUM                    | Set to true to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
+| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                 |
+| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                     |
+| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                             |
+| CLJ_CMD                      | Set to override the clojure cli command                                                                            |
+| LEIN_CMD                     | Set to override the leiningen command                                                                              |
+| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                     |
+| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                     |
+| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                              |
+| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                |
+| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom               |
+| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                             |
 
 ## Plugins
 

package/bin/cdxgen

@@ -128,7 +128,6 @@ let options = {
   dev: true,
   projectType: args.type,
   multiProject: args.recurse,
-  depth: 3,
   output: args.output,
   resolveClass: args.resolveClass,
   installDeps: true,

package/docker.js

@@ -423,9 +423,15 @@ const extractTar = async (fullImageName, dir) => {
         C: dir,
         portable: true,
         onwarn: () => {},
-        filter: (path) => {
+        filter: (path, entry) => {
           // Some files are known to cause issues with extract
-          if (path.includes("cacerts") || path.includes("ssl/certs")) {
+          if (
+            path.includes("cacerts") ||
+            path.includes("ssl/certs") ||
+            path.includes("etc/") ||
+            path.includes("logs/") ||
+            ["CharacterDevice"].includes(entry.type)
+          ) {
             return false;
           }
           return true;
@@ -434,12 +440,14 @@ const extractTar = async (fullImageName, dir) => {
     );
     return true;
   } catch (err) {
-    console.log(
-      "Error during extraction. Please file this bug to the cdxgen repo. https://github.com/CycloneDX/cdxgen/issues"
-    );
-    console.log("------------");
-    console.log(err);
-    console.log("------------");
+    if (err.code !== "TAR_BAD_ARCHIVE") {
+      console.log(
+        `Error while extracting image ${fullImageName} to ${dir}. Please file this bug to the cdxgen repo. https://github.com/CycloneDX/cdxgen/issues`
+      );
+      console.log("------------");
+      console.log(err);
+      console.log("------------");
+    }
     return false;
   }
 };

package/index.js

@@ -988,13 +988,12 @@ const createJavaBom = async (path, options) => {
     if (pomFiles && pomFiles.length) {
       const cdxMavenPlugin =
         process.env.CDX_MAVEN_PLUGIN ||
-        "org.cyclonedx:cyclonedx-maven-plugin:2.7.7";
+        "org.cyclonedx:cyclonedx-maven-plugin:2.7.8";
       const cdxMavenGoal = process.env.CDX_MAVEN_GOAL || "makeAggregateBom";
-      let mvnArgs = [
-        `${cdxMavenPlugin}:${cdxMavenGoal}`,
-        "-DoutputName=bom",
-        "-DincludeTestScope=true"
-      ];
+      let mvnArgs = [`${cdxMavenPlugin}:${cdxMavenGoal}`, "-DoutputName=bom"];
+      if (utils.includeMavenTestScope) {
+        mvnArgs.push("-DincludeTestScope=true");
+      }
       // By using quiet mode we can reduce the maxBuffer used and avoid crashes
       if (!DEBUG_MODE) {
         mvnArgs.push("-q");
@@ -1006,6 +1005,12 @@ const createJavaBom = async (path, options) => {
       }
       for (let f of pomFiles) {
         const basePath = pathLib.dirname(f);
+        const settingsXml = pathLib.join(basePath, "settings.xml");
+        if (fs.existsSync(settingsXml)) {
+          console.log(
+            `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`
+          );
+        }
         let mavenCmd = utils.getMavenCommand(basePath, path);
         // Should we attempt to resolve class names
         if (options.resolveClass) {
@@ -2221,7 +2226,7 @@ const createGoBom = async (path, options) => {
             "list",
             "-deps",
             "-f",
-            "'{{with .Module}}{{.Path}} {{.Version}}{{end}}'",
+            "'{{with .Module}}{{.Path}} {{.Version}} {{.Indirect}} {{.GoMod}} {{.GoVersion}}{{end}}'",
             "./..."
           ],
           { cwd: basePath, encoding: "utf-8", timeout: TIMEOUT_MS }
@@ -2256,7 +2261,11 @@ const createGoBom = async (path, options) => {
         if (circuitBreak) {
           break;
         }
-        let pkgFullName = `${apkg.group}/${apkg.name}`;
+        let pkgFullName = `${apkg.name}`;
+        if (apkg.scope === "required") {
+          allImports[pkgFullName] = true;
+          continue;
+        }
         if (DEBUG_MODE) {
           console.log(`go mod why -m -vendor ${pkgFullName}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.3.3",
+  "version": "8.4.1",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -26,6 +26,12 @@ const DEBUG_MODE =
 // Metadata cache
 let metadata_cache = {};
 
+// Whether test scope shall be included for java/maven projects; default, if unset shall be 'true'
+const includeMavenTestScope =
+  !process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE ||
+  ["true", "1"].includes(process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE);
+exports.includeMavenTestScope = includeMavenTestScope;
+
 const MAX_LICENSE_ID_LENGTH = 100;
 
 /**
@@ -1035,18 +1041,19 @@ const parsePom = function (pomFile) {
       let versionStr = undefined;
       if (version && version._ && version._.indexOf("$") == -1) {
         versionStr = version._;
-        deps.push({
-          group: adep.groupId ? adep.groupId._ : "",
-          name: adep.artifactId ? adep.artifactId._ : "",
-          version: versionStr,
-          qualifiers: { type: "jar" },
-          properties: [
-            {
-              name: "SrcFile",
-              value: pomFile
-            }
-          ]
-        });
+        if (includeMavenTestScope || !adep.scope || adep.scope !== "test")
+          deps.push({
+            group: adep.groupId ? adep.groupId._ : "",
+            name: adep.artifactId ? adep.artifactId._ : "",
+            version: versionStr,
+            qualifiers: { type: "jar" },
+            properties: [
+              {
+                name: "SrcFile",
+                value: pomFile
+              }
+            ]
+          });
       }
     }
   }
@@ -1071,7 +1078,7 @@ const parseMavenTree = function (rawOutput) {
   let last_purl = "";
   let stack = [];
   tmpA.forEach((l) => {
-    if (l.endsWith(":test")) {
+    if (!includeMavenTestScope && l.endsWith(":test")) {
       return;
     }
     let level = 0;
@@ -2104,34 +2111,24 @@ const parseGoModData = async function (goModData, gosumMap) {
 
     if (!isModReplacement) {
       // Add group, name and version component properties for required modules
-      let group = path.dirname(tmpA[0]);
-      const name = path.basename(tmpA[0]);
-      if (group === ".") {
-        group = name;
-      }
       const version = tmpA[1];
-      let gosumHash = gosumMap[`${group}/${name}/${version}`];
+      let gosumHash = gosumMap[`${tmpA[0]}/${version}`];
       // The hash for this version was not found in go.sum, so skip as it is most likely being replaced.
       if (gosumHash === undefined) {
         continue;
       }
-      let component = await getGoPkgComponent(group, name, version, gosumHash);
+      let component = await getGoPkgComponent("", tmpA[0], version, gosumHash);
       pkgComponentsList.push(component);
     } else {
       // Add group, name and version component properties for replacement modules
-      let group = path.dirname(tmpA[2]);
-      const name = path.basename(tmpA[2]);
-      if (group === ".") {
-        group = name;
-      }
       const version = tmpA[3];
 
-      let gosumHash = gosumMap[`${group}/${name}/${version}`];
+      let gosumHash = gosumMap[`${tmpA[2]}/${version}`];
       // The hash for this version was not found in go.sum, so skip.
       if (gosumHash === undefined) {
         continue;
       }
-      let component = await getGoPkgComponent(group, name, version, gosumHash);
+      let component = await getGoPkgComponent("", tmpA[2], version, gosumHash);
       pkgComponentsList.push(component);
     }
   }
@@ -2154,24 +2151,35 @@ const parseGoListDep = async function (rawOutput, gosumMap) {
     const pkgs = rawOutput.split("\n");
     for (let l of pkgs) {
       const verArr = l.trim().replace(new RegExp("[\"']", "g"), "").split(" ");
-      if (verArr && verArr.length === 2) {
+
+      if (verArr && verArr.length === 5) {
         const key = verArr[0] + "-" + verArr[1];
         // Filter duplicates
         if (!keys_cache[key]) {
           keys_cache[key] = key;
-          let group = path.dirname(verArr[0]);
-          const name = path.basename(verArr[0]);
           const version = verArr[1];
-          if (group === ".") {
-            group = name;
-          }
-          let gosumHash = gosumMap[`${group}/${name}/${version}`];
+          let gosumHash = gosumMap[`${verArr[0]}/${version}`];
           let component = await getGoPkgComponent(
-            group,
-            name,
+            "",
+            verArr[0],
             version,
             gosumHash
           );
+          if (verArr[2] === "false") {
+            component.scope = "required";
+          } else if (verArr[2] === "true") {
+            component.scope = "optional";
+          }
+          component.properties = [
+            {
+              name: "SrcGoMod",
+              value: verArr[3] || ""
+            },
+            {
+              name: "ModuleGoVersion",
+              value: verArr[4] || ""
+            }
+          ];
           deps.push(component);
         }
       }
@@ -2212,27 +2220,23 @@ const parseGosumData = async function (gosumData) {
     // look for lines containing go.mod
     if (l.indexOf("go.mod") > -1) {
       const tmpA = l.split(" ");
-      let group = path.dirname(tmpA[0]);
-      const name = path.basename(tmpA[0]);
-      if (group === ".") {
-        group = name;
-      }
+      const name = tmpA[0];
       const version = tmpA[1].replace("/go.mod", "");
       const hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
       let license = undefined;
       if (process.env.FETCH_LICENSE) {
         if (DEBUG_MODE) {
           console.log(
-            `About to fetch go package license information for ${group}:${name}`
+            `About to fetch go package license information for ${name}`
           );
         }
         license = await getGoPkgLicense({
-          group: group,
+          group: "",
           name: name
         });
       }
       pkgList.push({
-        group: group,
+        group: "",
         name: name,
         version: version,
         _integrity: hash,
@@ -2271,11 +2275,8 @@ const parseGopkgData = async function (gopkgData) {
           pkg._integrity = "sha256-" + toBase64(digestStr);
           break;
         case "name":
-          pkg.group = path.dirname(value);
-          pkg.name = path.basename(value);
-          if (pkg.group === ".") {
-            pkg.group = pkg.name;
-          }
+          pkg.group = "";
+          pkg.name = value;
           if (process.env.FETCH_LICENSE) {
             pkg.license = await getGoPkgLicense({
               group: pkg.group,
@@ -2312,16 +2313,12 @@ const parseGoVersionData = async function (buildInfoData) {
     if (!tmpA || tmpA.length < 3) {
       continue;
     }
-    let group = path.dirname(tmpA[1].trim());
-    const name = path.basename(tmpA[1].trim());
-    if (group === ".") {
-      group = name;
-    }
+    const name = tmpA[1].trim();
     let hash = "";
     if (tmpA.length == 4) {
       hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
     }
-    let component = await getGoPkgComponent(group, name, tmpA[2].trim(), hash);
+    let component = await getGoPkgComponent("", name, tmpA[2].trim(), hash);
     pkgList.push(component);
   }
   return pkgList;
@@ -2917,9 +2914,7 @@ const parseContainerSpecData = async function (dcData) {
     try {
       yamlObj = yaml.load(dcData);
     } catch (err) {
-      if (DEBUG_MODE) {
-        console.log(err);
-      }
+      // ignore errors
     }
     if (!yamlObj) {
       continue;

package/utils.test.js

@@ -235,8 +235,8 @@ test("parse maven tree", () => {
   let parsedList = utils.parseMavenTree(
     fs.readFileSync("./test/data/sample-mvn-tree.txt", { encoding: "utf-8" })
   );
-  expect(parsedList.pkgList.length).toEqual(59);
-  expect(parsedList.dependenciesList.length).toEqual(59);
+  expect(parsedList.pkgList.length).toEqual(61);
+  expect(parsedList.dependenciesList.length).toEqual(61);
   expect(parsedList.pkgList[0]).toEqual({
     group: "com.pogeyan.cmis",
     name: "copper-server",
@@ -259,6 +259,7 @@ test("parse maven tree", () => {
       "pkg:maven/commons-fileupload/commons-fileupload@1.4?type=jar",
       "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.0?type=jar",
       "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.0?type=jar",
+      "pkg:maven/junit/junit@4.12?type=jar",
       "pkg:maven/com.typesafe.akka/akka-actor_2.11@2.4.14?type=jar",
       "pkg:maven/com.typesafe.akka/akka-cluster_2.11@2.4.14?type=jar",
       "pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13?type=jar",
@@ -271,8 +272,8 @@ test("parse maven tree", () => {
       encoding: "utf-8"
     })
   );
-  expect(parsedList.pkgList.length).toEqual(27);
-  expect(parsedList.dependenciesList.length).toEqual(27);
+  expect(parsedList.pkgList.length).toEqual(37);
+  expect(parsedList.dependenciesList.length).toEqual(37);
   expect(parsedList.pkgList[0]).toEqual({
     group: "com.gitlab.security_products.tests",
     name: "java-maven",
@@ -282,7 +283,9 @@ test("parse maven tree", () => {
   expect(parsedList.dependenciesList[0]).toEqual({
     ref: "pkg:maven/com.gitlab.security_products.tests/java-maven@1.0-SNAPSHOT?type=jar",
     dependsOn: [
+      "pkg:maven/org.powermock/powermock-api-mockito@1.7.3?type=jar",
       "pkg:maven/io.netty/netty@3.9.1.Final?type=jar",
+      "pkg:maven/junit/junit@3.8.1?type=jar",
       "pkg:maven/org.apache.maven/maven-artifact@3.3.9?type=jar",
       "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.2?type=jar",
       "pkg:maven/org.mozilla/rhino@1.7.10?type=jar",
@@ -385,29 +388,29 @@ test("parseGoModData", async () => {
   );
   expect(dep_list.length).toEqual(4);
   expect(dep_list[0]).toEqual({
-    group: "github.com/aws",
-    name: "aws-sdk-go",
+    group: "",
+    name: "github.com/aws/aws-sdk-go",
     license: undefined,
     version: "v1.38.47",
     _integrity: "sha256-fake-sha-for-aws-go-sdk="
   });
   expect(dep_list[1]).toEqual({
-    group: "github.com/spf13",
-    name: "cobra",
+    group: "",
+    name: "github.com/spf13/cobra",
     license: undefined,
     version: "v1.0.0",
     _integrity: "sha256-/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE="
   });
   expect(dep_list[2]).toEqual({
-    group: "google.golang.org",
-    name: "grpc",
+    group: "",
+    name: "google.golang.org/grpc",
     license: undefined,
     version: "v1.21.0",
     _integrity: "sha256-oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM="
   });
   expect(dep_list[3]).toEqual({
-    group: "github.com/spf13",
-    name: "viper",
+    group: "",
+    name: "github.com/spf13/viper",
     license: undefined,
     version: "v1.0.2",
     _integrity: "sha256-A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM="
@@ -426,29 +429,29 @@ test("parseGoSumData", async () => {
   );
   expect(dep_list.length).toEqual(4);
   expect(dep_list[0]).toEqual({
-    group: "google.golang.org",
-    name: "grpc",
+    group: "",
+    name: "google.golang.org/grpc",
     license: undefined,
     version: "v1.21.0",
     _integrity: "sha256-oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM="
   });
   expect(dep_list[1]).toEqual({
-    group: "github.com/spf13",
-    name: "cobra",
+    group: "",
+    name: "github.com/spf13/cobra",
     license: undefined,
     version: "v1.0.0",
     _integrity: "sha256-/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE="
   });
   expect(dep_list[2]).toEqual({
-    group: "github.com/spf13",
-    name: "viper",
+    group: "",
+    name: "github.com/spf13/viper",
     license: undefined,
     version: "v1.0.2",
     _integrity: "sha256-A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM="
   });
   expect(dep_list[3]).toEqual({
-    group: "github.com/stretchr",
-    name: "testify",
+    group: "",
+    name: "github.com/stretchr/testify",
     license: undefined,
     version: "v1.6.1",
     _integrity: "sha256-6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg="
@@ -463,11 +466,22 @@ test("parse go list dependencies", async () => {
     fs.readFileSync("./test/data/golist-dep.txt", { encoding: "utf-8" }),
     {}
   );
-  expect(dep_list.length).toEqual(8);
+  expect(dep_list.length).toEqual(4);
   expect(dep_list[0]).toEqual({
-    group: "github.com/badoux",
-    name: "checkmail",
-    version: "v0.0.0-20181210160741-9661bd69e9ad"
+    group: "",
+    name: "github.com/gorilla/mux",
+    version: "v1.7.4",
+    _integrity: undefined,
+    license: undefined,
+    scope: "required",
+    properties: [
+      {
+        name: "SrcGoMod",
+        value:
+          "/home/almalinux/go/pkg/mod/cache/download/github.com/gorilla/mux/@v/v1.7.4.mod"
+      },
+      { name: "ModuleGoVersion", value: "1.12" }
+    ]
   });
 });
 
@@ -491,8 +505,8 @@ test("parseGopkgData", async () => {
   );
   expect(dep_list.length).toEqual(36);
   expect(dep_list[0]).toEqual({
-    group: "cloud.google.com",
-    name: "go",
+    group: "",
+    name: "cloud.google.com/go",
     version: "v0.39.0",
     _integrity: "sha256-LKUyprxlVmM0QAS6ECQ20pAxAY6rI2JHZ42x2JeGJ78="
   });
@@ -508,8 +522,8 @@ test("parse go version data", async () => {
   );
   expect(dep_list.length).toEqual(125);
   expect(dep_list[0]).toEqual({
-    group: "github.com/ShiftLeftSecurity",
-    name: "atlassian-connect-go",
+    group: "",
+    name: "github.com/ShiftLeftSecurity/atlassian-connect-go",
     version: "v0.0.2",
     _integrity: "",
     license: undefined
@@ -520,8 +534,8 @@ test("parse go version data", async () => {
   );
   expect(dep_list.length).toEqual(149);
   expect(dep_list[0]).toEqual({
-    group: "cloud.google.com",
-    name: "go",
+    group: "",
+    name: "cloud.google.com/go",
     version: "v0.79.0",
     _integrity: "sha256-oqqswrt4x6b9OGBnNqdssxBl1xf0rSUNjU2BR4BZar0=",
     license: undefined