@cyclonedx/cdxgen 8.4.3 → 8.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.4.3",
+  "version": "8.4.6",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -43,14 +43,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cyclonedx/cdxgen.git"
+    "url": "git+https://github.com/CycloneDX/cdxgen"
   },
   "bugs": {
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.21.4",
-    "@babel/traverse": "^7.21.4",
+    "@babel/parser": "^7.21.8",
+    "@babel/traverse": "^7.21.5",
     "cheerio": "^1.0.0-rc.12",
     "edn-data": "^1.0.0",
     "glob": "^8.1.0",
@@ -66,11 +66,11 @@
     "semver": "^7.5.0",
     "ssri": "^8.0.1",
     "table": "^6.8.1",
-    "tar": "^6.1.13",
+    "tar": "^6.1.14",
     "uuid": "^9.0.0",
     "xml-js": "^1.6.11",
     "xmlbuilder": "^15.1.1",
-    "yargs": "^17.7.1"
+    "yargs": "^17.7.2"
   },
   "optionalDependencies": {
     "@cyclonedx/cdxgen-plugins-bin": "^1.1.0",
@@ -88,7 +88,7 @@
     "queries.json"
   ],
   "devDependencies": {
-    "eslint": "^8.39.0",
+    "eslint": "^8.40.0",
     "jest": "^26.6.3"
   }
 }

package/utils.js

@@ -256,18 +256,33 @@ const _getDepPkgList = async function (
   depKeys,
   pkg
 ) {
-  if (pkg && pkg.dependencies) {
-    const pkgKeys = Object.keys(pkg.dependencies);
-    for (var k in pkgKeys) {
-      const name = pkgKeys[k];
-      const version = pkg.dependencies[name].version;
-      const purl = new PackageURL("npm", "", name, version, null, null);
+  let pkgDependencies =
+    pkg.lockfileVersion && pkg.lockfileVersion >= 3
+      ? pkg.packages
+      : pkg.dependencies;
+  if (pkg && pkgDependencies) {
+    const pkgKeys = Object.keys(pkgDependencies);
+    for (const k of pkgKeys) {
+      // Skip the root package in lockFileVersion 3 and above
+      if (k === "") {
+        continue;
+      }
+      let name = k;
+      const version = pkgDependencies[name].version;
+      const purl = new PackageURL(
+        "npm",
+        "",
+        name.replace("node_modules/", ""),
+        version,
+        null,
+        null
+      );
       const purlString = decodeURIComponent(purl.toString());
-      let scope = pkg.dependencies[name].dev === true ? "optional" : undefined;
+      let scope = pkgDependencies[name].dev === true ? "optional" : undefined;
       const apkg = {
-        name,
+        name: name.replace("node_modules/", ""),
         version,
-        _integrity: pkg.dependencies[name].integrity,
+        _integrity: pkgDependencies[name].integrity,
         scope,
         properties: [
           {
@@ -277,9 +292,9 @@ const _getDepPkgList = async function (
         ]
       };
       pkgList.push(apkg);
-      if (pkg.dependencies[name].dependencies) {
+      if (pkgDependencies[name].dependencies) {
         // Include child dependencies
-        const dependencies = pkg.dependencies[name].dependencies;
+        const dependencies = pkgDependencies[name].dependencies;
         const pkgDepKeys = Object.keys(dependencies);
         const deplist = [];
         for (const j in pkgDepKeys) {
@@ -288,7 +303,7 @@ const _getDepPkgList = async function (
           const deppurl = new PackageURL(
             "npm",
             "",
-            depName,
+            depName.replace("node_modules/", ""),
             depVersion,
             null,
             null
@@ -303,13 +318,17 @@ const _getDepPkgList = async function (
           });
           depKeys[purlString] = true;
         }
-        await _getDepPkgList(
-          pkgLockFile,
-          pkgList,
-          dependenciesList,
-          depKeys,
-          pkg.dependencies[name]
-        );
+        if (pkg.lockfileVersion && pkg.lockfileVersion >= 3) {
+          // Do not recurse for lock file v3 and above
+        } else {
+          await _getDepPkgList(
+            pkgLockFile,
+            pkgList,
+            dependenciesList,
+            depKeys,
+            pkgDependencies[name]
+          );
+        }
       } else {
         if (!depKeys[purlString]) {
           dependenciesList.push({

package/utils.test.js

@@ -1097,6 +1097,30 @@ test("parsePkgLock", async () => {
     "bom-ref": "pkg:application/MyProject",
     name: "MyProject"
   });
+  parsedList = await utils.parsePkgLock("./test/data/package-lock-v2.json");
+  deps = parsedList.pkgList;
+  expect(deps.length).toEqual(1467);
+  expect(parsedList.dependenciesList.length).toEqual(1280);
+  expect(deps[0]).toEqual({
+    "bom-ref": "pkg:application/flink-dashboard@2.0.0",
+    group: "",
+    name: "flink-dashboard",
+    type: "application",
+    version: "2.0.0"
+  });
+  expect(deps[deps.length - 1].name).toEqual("zone.js");
+  parsedList = await utils.parsePkgLock("./test/data/package-lock-v3.json");
+  deps = parsedList.pkgList;
+  expect(deps.length).toEqual(879);
+  expect(parsedList.dependenciesList.length).toEqual(879);
+  expect(deps[0]).toEqual({
+    "bom-ref": "pkg:application/@cyclonedx/cdxgen@8.4.3",
+    group: "",
+    name: "@cyclonedx/cdxgen",
+    type: "application",
+    version: "8.4.3"
+  });
+  expect(deps[deps.length - 1].name).toEqual("yocto-queue");
 });
 
 test("parseBowerJson", async () => {