@cyclonedx/cdxgen 9.7.5 → 9.8.0

package/utils.js

@@ -1,29 +1,50 @@
 import { globSync } from "glob";
-import { homedir, tmpdir, platform } from "node:os";
+import { homedir, platform, tmpdir } from "node:os";
 import {
-  dirname,
-  sep as _sep,
   basename,
+  delimiter as _delimiter,
+  dirname,
   extname,
   join,
   resolve,
-  delimiter as _delimiter
+  sep as _sep
 } from "node:path";
 import {
+  chmodSync,
+  constants,
+  copyFileSync,
   existsSync,
-  readFileSync,
   lstatSync,
   mkdtempSync,
+  readFileSync,
   rmSync,
-  copyFileSync,
-  constants,
-  writeFileSync,
   unlinkSync,
-  chmodSync
+  writeFileSync
 } from "node:fs";
 import got from "got";
+import Arborist from "@npmcli/arborist";
+import path from "path";
 import { xml2js } from "xml-js";
 import { fileURLToPath } from "node:url";
+import { load } from "cheerio";
+import { load as _load } from "js-yaml";
+import { spawnSync } from "node:child_process";
+import propertiesReader from "properties-reader";
+import {
+  clean,
+  coerce,
+  compare,
+  maxSatisfying,
+  satisfies,
+  valid,
+  parse
+} from "semver";
+import StreamZip from "node-stream-zip";
+import { parseEDNString } from "edn-data";
+import { PackageURL } from "packageurl-js";
+import { getTreeWithPlugin } from "./piptree.js";
+import iconv from "iconv-lite";
+
 let url = import.meta.url;
 if (!url.startsWith("file://")) {
   url = new URL(`file://${import.meta.url}`).toString();
@@ -45,16 +66,6 @@ const knownLicenses = JSON.parse(
 const mesonWrapDB = JSON.parse(
   readFileSync(join(dirNameStr, "data", "wrapdb-releases.json"))
 );
-import { load } from "cheerio";
-import { load as _load } from "js-yaml";
-import { spawnSync } from "node:child_process";
-import propertiesReader from "properties-reader";
-import { satisfies, coerce, maxSatisfying, clean, valid } from "semver";
-import StreamZip from "node-stream-zip";
-import { parseEDNString } from "edn-data";
-import { PackageURL } from "packageurl-js";
-import { getTreeWithPlugin } from "./piptree.js";
-import iconv from "iconv-lite";
 
 const selfPJson = JSON.parse(readFileSync(join(dirNameStr, "package.json")));
 const _version = selfPJson.version;
@@ -80,7 +91,7 @@ export const DEBUG_MODE =
 const TIMEOUT_MS = parseInt(process.env.CDXGEN_TIMEOUT_MS) || 20 * 60 * 1000;
 
 // Metadata cache
-let metadata_cache = {};
+export let metadata_cache = {};
 
 // Whether test scope shall be included for java/maven projects; default, if unset shall be 'true'
 export const includeMavenTestScope =
@@ -88,7 +99,7 @@ export const includeMavenTestScope =
   ["true", "1"].includes(process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE);
 
 // Whether license information should be fetched
-const fetchLicenses =
+export const FETCH_LICENSE =
   process.env.FETCH_LICENSE &&
   ["true", "1"].includes(process.env.FETCH_LICENSE);
 
@@ -100,7 +111,7 @@ if (process.env.PYTHON_CMD) {
 }
 
 // Custom user-agent for cdxgen
-const cdxgenAgent = got.extend({
+export const cdxgenAgent = got.extend({
   headers: {
     "user-agent": `@CycloneDX/cdxgen ${_version}`
   }
@@ -330,121 +341,6 @@ export const getNpmMetadata = async function (pkgList) {
   return cdepList;
 };
 
-const _getDepPkgList = async function (
-  pkgLockFile,
-  pkgList,
-  depKeys,
-  pkg,
-  versionCache
-) {
-  const pkgDependencies = {
-    ...(pkg.packages || {}),
-    ...(pkg.dependencies || {})
-  };
-  if (pkg.packages) {
-    for (const k in pkg.packages) {
-      if (k === "") {
-        continue;
-      }
-      const pl = pkg.packages[k];
-      versionCache[k] = pl.version;
-      versionCache[k.replaceAll("node_modules/", "")] = pl.version;
-    }
-  }
-  if (pkg && pkgDependencies) {
-    const pkgKeys = Object.keys(pkgDependencies);
-    for (const k of pkgKeys) {
-      // Skip the root package in lockFileVersion 3 and above
-      if (k === "") {
-        continue;
-      }
-      const name = k;
-      let version = pkgDependencies[name].version;
-      if (!version && versionCache[k]) {
-        version = versionCache[k];
-      }
-      if (!version && pkgDependencies["node_modules/" + name]) {
-        version = pkgDependencies["node_modules/" + name].version;
-      }
-      const purl = new PackageURL(
-        "npm",
-        "",
-        name.replaceAll("node_modules/", ""),
-        version,
-        null,
-        null
-      );
-      const purlString = decodeURIComponent(purl.toString());
-      const scope = pkgDependencies[name].dev === true ? "optional" : undefined;
-      const apkg = {
-        name: name.replaceAll("node_modules/", ""),
-        version,
-        _integrity: pkgDependencies[name].integrity,
-        scope,
-        properties: [
-          {
-            name: "SrcFile",
-            value: pkgLockFile
-          }
-        ],
-        evidence: {
-          identity: {
-            field: "purl",
-            confidence: 1,
-            methods: [
-              {
-                technique: "manifest-analysis",
-                confidence: 1,
-                value: pkgLockFile
-              }
-            ]
-          }
-        }
-      };
-      pkgList.push(apkg);
-      if (pkgDependencies[name].dependencies) {
-        // Include child dependencies
-        const dependencies = pkgDependencies[name].dependencies;
-        const pkgDepKeys = Object.keys(dependencies);
-        const deplist = [];
-        for (const j in pkgDepKeys) {
-          const depName = pkgDepKeys[j];
-          const depVersion =
-            versionCache[depName] || dependencies[depName].version;
-          if (!depVersion) {
-            continue;
-          }
-          const deppurl = new PackageURL(
-            "npm",
-            "",
-            depName.replaceAll("node_modules/", ""),
-            depVersion,
-            null,
-            null
-          );
-          const deppurlString = decodeURIComponent(deppurl.toString());
-          deplist.push(deppurlString);
-        }
-        depKeys[purlString] = (depKeys[purlString] || []).concat(deplist);
-        if (pkg.lockfileVersion && pkg.lockfileVersion >= 3) {
-          // Do not recurse for lock file v3 and above
-        } else {
-          await _getDepPkgList(
-            pkgLockFile,
-            pkgList,
-            depKeys,
-            pkgDependencies[name],
-            versionCache
-          );
-        }
-      } else if (!depKeys[purlString]) {
-        depKeys[purlString] = [];
-      }
-    }
-  }
-  return pkgList;
-};
-
 /**
  * Parse nodejs package json file
  *
@@ -495,7 +391,7 @@ export const parsePkgJson = async (pkgJsonFile) => {
       // continue regardless of error
     }
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePkgJson`
@@ -514,115 +410,247 @@ export const parsePkgJson = async (pkgJsonFile) => {
  */
 export const parsePkgLock = async (pkgLockFile, options = {}) => {
   let pkgList = [];
-  const dependenciesList = [];
-  const depKeys = {};
-  let rootPkg = {};
-  const versionCache = {};
+  let dependenciesList = [];
   if (!options) {
     options = {};
   }
-  if (existsSync(pkgLockFile)) {
-    const lockData = JSON.parse(readFileSync(pkgLockFile, "utf8"));
-    rootPkg.name = lockData.name || "";
-    // lockfile v2 onwards
-    if (lockData.name && lockData.packages && lockData.packages[""]) {
-      // Build the initial dependency tree for the root package
-      rootPkg = {
+
+  if (!existsSync(pkgLockFile)) {
+    return {
+      pkgList,
+      dependenciesList
+    };
+  }
+
+  const parseArboristNode = (
+    node,
+    rootNode,
+    parentRef = null,
+    visited = new Set(),
+    options = {}
+  ) => {
+    if (visited.has(node)) {
+      return { pkgList: [], dependenciesList: [] };
+    }
+    visited.add(node);
+    let pkgList = [];
+    let dependenciesList = [];
+
+    // Create the package entry
+    const srcFilePath = node.path.includes(`${_sep}node_modules`)
+      ? node.path.split(`${_sep}node_modules`)[0]
+      : node.path;
+    const scope = node.dev === true ? "optional" : undefined;
+    const integrity = node.integrity ? node.integrity : undefined;
+
+    let pkg = {};
+    let purlString = "";
+    if (node == rootNode) {
+      purlString = decodeURIComponent(
+        new PackageURL(
+          "npm",
+          options.projectGroup || "",
+          options.projectName || node.packageName,
+          options.projectVersion || node.version,
+          null,
+          null
+        ).toString()
+      );
+      pkg = {
+        author: node.package.author,
         group: options.projectGroup || "",
-        name: options.projectName || lockData.name,
-        version: options.projectVersion || lockData.version,
+        name: options.projectName || node.packageName,
+        version: options.projectVersion || node.version,
         type: "application",
-        "bom-ref": decodeURIComponent(
+        "bom-ref": purlString
+      };
+    } else {
+      purlString = decodeURIComponent(
+        new PackageURL(
+          "npm",
+          "",
+          node.packageName,
+          node.version,
+          null,
+          null
+        ).toString()
+      );
+      const pkgLockFile = join(
+        srcFilePath.replace("/", _sep),
+        "package-lock.json"
+      );
+      pkg = {
+        group: "",
+        name: node.packageName,
+        version: node.version,
+        author: node.package.author,
+        scope: scope,
+        _integrity: integrity,
+        properties: [
+          {
+            name: "SrcFile",
+            value: pkgLockFile
+          }
+        ],
+        evidence: {
+          identity: {
+            field: "purl",
+            confidence: 1,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 1,
+                value: pkgLockFile
+              }
+            ]
+          }
+        },
+        type: parentRef ? "npm" : "application",
+        "bom-ref": purlString
+      };
+    }
+    pkgList.push(pkg);
+
+    // retrieve workspace node pkglists
+    let workspaceDependsOn = [];
+    if (node.fsChildren && node.fsChildren.size > 0) {
+      for (let workspaceNode of node.fsChildren) {
+        const {
+          pkgList: childPkgList,
+          dependenciesList: childDependenciesList
+        } = parseArboristNode(workspaceNode, rootNode, purlString, visited);
+        pkgList = pkgList.concat(childPkgList);
+        dependenciesList = dependenciesList.concat(childDependenciesList);
+
+        const depWorkspacePurlString = decodeURIComponent(
           new PackageURL(
             "npm",
-            options.projectGroup || "",
-            options.projectName || lockData.name,
-            options.projectVersion || lockData.version,
+            "",
+            workspaceNode.name,
+            workspaceNode.version,
             null,
             null
           ).toString()
-        )
-      };
-    } else if (lockData.lockfileVersion === 1) {
-      let dirName = dirname(pkgLockFile);
-      const tmpA = dirName.split(_sep);
-      dirName = tmpA[tmpA.length - 1];
-      // v1 lock file
-      rootPkg = {
-        group: options.projectGroup || "",
-        name: options.projectName || lockData.name || dirName,
-        version: options.projectVersion || lockData.version || "",
-        type: "npm"
-      };
+        );
+
+        workspaceDependsOn.push(depWorkspacePurlString);
+      }
     }
-    if (rootPkg && rootPkg.name) {
-      const purl = new PackageURL(
-        "npm",
-        "",
-        rootPkg.name,
-        rootPkg.version,
-        null,
-        null
-      );
-      const purlString = decodeURIComponent(purl.toString());
-      rootPkg["bom-ref"] = purlString;
-      pkgList.push(rootPkg);
-      // npm ls command seems to include both dependencies and devDependencies
-      // For tree purposes, including only the dependencies should be enough
-      let rootPkgDeps = [];
-      if (
-        lockData.packages &&
-        lockData.packages[""] &&
-        lockData.packages[""].dependencies
-      ) {
-        rootPkgDeps =
-          Object.keys(lockData.packages[""].dependencies || {}) || [];
-      } else if (lockData.dependencies) {
-        rootPkgDeps = Object.keys(lockData.dependencies || {}) || [];
+
+    // this handles the case when a node has ["dependencies"] key in a package-lock.json
+    // for a node. We exclude the root node because it's already been handled
+    let childrenDependsOn = [];
+    if (node != rootNode) {
+      for (const child of node.children) {
+        let childNode = child[1];
+        const {
+          pkgList: childPkgList,
+          dependenciesList: childDependenciesList
+        } = parseArboristNode(childNode, rootNode, purlString, visited);
+        pkgList = pkgList.concat(childPkgList);
+        dependenciesList = dependenciesList.concat(childDependenciesList);
+
+        const depChildString = decodeURIComponent(
+          new PackageURL(
+            "npm",
+            "",
+            childNode.name,
+            childNode.version,
+            null,
+            null
+          ).toString()
+        );
+        childrenDependsOn.push(depChildString);
       }
-      const deplist = [];
-      for (const rd of rootPkgDeps) {
-        let resolvedVersion = undefined;
-        if (lockData.packages) {
-          resolvedVersion = (lockData.packages[`node_modules/${rd}`] || {})
-            .version;
-        } else if (lockData.dependencies) {
-          resolvedVersion = lockData.dependencies[rd].version;
-        }
-        if (resolvedVersion) {
-          const dpurl = decodeURIComponent(
-            new PackageURL(
-              "npm",
-              "",
-              rd,
-              resolvedVersion,
-              null,
-              null
-            ).toString()
-          );
-          deplist.push(dpurl);
+    }
+
+    // this handles the case when a node has a ["requires"] key
+    const pkgDependsOn = [];
+    for (const edge of node.edgesOut.values()) {
+      let targetVersion;
+      let targetName;
+
+      // if the edge doesn't have an integrity, it's likely a peer dependency
+      // which isn't installed
+      let edgeToIntegrity = edge.to ? edge.to.integrity : null;
+      // let packageName = node.packageName;
+      // let edgeName = edge.name;
+      if (!edgeToIntegrity) {
+        continue;
+      }
+
+      // the edges don't actually contain a version, so we need to search the root node
+      // children to find the correct version. we check the node children first, then
+      // we check the root node children
+      let foundMatch = false;
+      for (const child of node.children) {
+        if (child[1].integrity == edgeToIntegrity) {
+          targetName = child[0].replace(/node_modules\//g, "");
+          targetVersion = child[1].version;
+          foundMatch = true;
+          break;
         }
       }
-      dependenciesList.push({
-        ref: purlString,
-        dependsOn: deplist
-      });
+      if (!foundMatch) {
+        for (const child of rootNode.children) {
+          if (child[1].integrity == edgeToIntegrity) {
+            targetName = child[0].replace(/node_modules\//g, "");
+            targetVersion = child[1].version;
+            break;
+          }
+        }
+      }
+
+      // if we can't find the version of the edge, continue
+      // it may be an optional peer dependency
+      if (!targetVersion || !targetName) {
+        continue;
+      }
+
+      const depPurlString = decodeURIComponent(
+        new PackageURL(
+          "npm",
+          "",
+          targetName,
+          targetVersion,
+          null,
+          null
+        ).toString()
+      );
+
+      pkgDependsOn.push(depPurlString);
+      if (edge.to == null) continue;
+      const { pkgList: childPkgList, dependenciesList: childDependenciesList } =
+        parseArboristNode(edge.to, rootNode, purlString, visited);
+      pkgList = pkgList.concat(childPkgList);
+      dependenciesList = dependenciesList.concat(childDependenciesList);
     }
-    pkgList = await _getDepPkgList(
-      pkgLockFile,
-      pkgList,
-      depKeys,
-      lockData,
-      versionCache
-    );
-  }
-  for (const dk of Object.keys(depKeys)) {
+
     dependenciesList.push({
-      ref: dk,
-      dependsOn: depKeys[dk] || []
+      ref: purlString,
+      dependsOn: workspaceDependsOn
+        .concat(childrenDependsOn)
+        .concat(pkgDependsOn)
     });
-  }
-  if (fetchLicenses && pkgList && pkgList.length) {
+
+    return { pkgList, dependenciesList };
+  };
+
+  const arb = new Arborist({
+    path: path.dirname(pkgLockFile),
+    // legacyPeerDeps=false enables npm >v3 package dependency resolution
+    legacyPeerDeps: false
+  });
+  const tree = await arb.loadVirtual();
+  ({ pkgList, dependenciesList } = parseArboristNode(
+    tree,
+    tree,
+    null,
+    new Set(),
+    options
+  ));
+
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePkgLock`
@@ -841,7 +869,7 @@ export const parseYarnLock = async function (yarnLockFile) {
       }
     });
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseYarnLock`
@@ -918,7 +946,7 @@ export const parseNodeShrinkwrap = async function (swFile) {
       }
     }
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseNodeShrinkwrap`
@@ -1085,7 +1113,7 @@ export const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
       }
     }
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePnpmLock`
@@ -1144,7 +1172,7 @@ export const parseBowerJson = async (bowerJsonFile) => {
       // continue regardless of error
     }
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseBowerJson`
@@ -1230,7 +1258,7 @@ export const parseMinJs = async (minJsFile) => {
       // continue regardless of error
     }
   }
-  if (fetchLicenses && pkgList && pkgList.length) {
+  if (FETCH_LICENSE && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseMinJs`
@@ -2068,13 +2096,13 @@ export const getMvnMetadata = async function (pkgList) {
   if (!pkgList || !pkgList.length) {
     return pkgList;
   }
-  if (DEBUG_MODE && fetchLicenses) {
+  if (DEBUG_MODE && FETCH_LICENSE) {
     console.log(`About to query maven for ${pkgList.length} packages`);
   }
   for (const p of pkgList) {
     let group = p.group || "";
     // If the package already has key metadata skip querying maven
-    if (group && p.name && p.version && !fetchLicenses) {
+    if (group && p.name && p.version && !FETCH_LICENSE) {
       cdepList.push(p);
       continue;
     }
@@ -2208,7 +2236,7 @@ export const guessPypiMatchingVersion = (versionsList, versionSpecifiers) => {
  * @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
  */
 export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
-  if (!fetchLicenses && !fetchDepsInfo) {
+  if (!FETCH_LICENSE && !fetchDepsInfo) {
     return pkgList;
   }
   const PYPI_URL = "https://pypi.org/pypi/";
@@ -2879,7 +2907,7 @@ export const getGoPkgLicense = async function (repoMetadata) {
 export const getGoPkgComponent = async function (group, name, version, hash) {
   let pkg = {};
   let license = undefined;
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch go package license information for ${group}:${name}`
@@ -3060,7 +3088,7 @@ export const parseGosumData = async function (gosumData) {
       const version = tmpA[1].replace("/go.mod", "");
       const hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
       let license = undefined;
-      if (fetchLicenses) {
+      if (FETCH_LICENSE) {
         if (DEBUG_MODE) {
           console.log(
             `About to fetch go package license information for ${name}`
@@ -3112,7 +3140,7 @@ export const parseGopkgData = async function (gopkgData) {
         case "name":
           pkg.group = "";
           pkg.name = value;
-          if (fetchLicenses) {
+          if (FETCH_LICENSE) {
             pkg.license = await getGoPkgLicense({
               group: pkg.group,
               name: pkg.name
@@ -3239,7 +3267,7 @@ export const parseGemspecData = async function (gemspecData) {
     }
   });
   pkgList = [pkg];
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getRubyGemsMetadata(pkgList);
   } else {
     return pkgList;
@@ -3288,7 +3316,7 @@ export const parseGemfileLockData = async function (gemLockData) {
       specsFound = false;
     }
   });
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getRubyGemsMetadata(pkgList);
   } else {
     return pkgList;
@@ -3458,7 +3486,7 @@ export const parseCargoTomlData = async function (cargoData) {
   if (pkg) {
     pkgList.push(pkg);
   }
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -3506,7 +3534,7 @@ export const parseCargoData = async function (cargoData) {
       }
     }
   });
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -3535,7 +3563,7 @@ export const parseCargoAuditableData = async function (cargoData) {
       });
     }
   });
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -3575,7 +3603,7 @@ export const parsePubLockData = async function (pubLockData) {
       }
     }
   });
-  if (fetchLicenses) {
+  if (FETCH_LICENSE) {
     return await getDartMetadata(pkgList);
   } else {
     return pkgList;
@@ -4280,11 +4308,7 @@ export const parseNuspecData = async function (nupkgFile, nuspecData) {
     }
   };
   pkgList.push(pkg);
-  if (fetchLicenses) {
-    return await getNugetMetadata(pkgList);
-  } else {
-    return pkgList;
-  }
+  return pkgList;
 };
 
 export const parseCsPkgData = async function (pkgData) {
@@ -4311,11 +4335,7 @@ export const parseCsPkgData = async function (pkgData) {
     pkg.version = p.version;
     pkgList.push(pkg);
   }
-  if (fetchLicenses) {
-    return await getNugetMetadata(pkgList);
-  } else {
-    return pkgList;
-  }
+  return pkgList;
 };
 
 export const parseCsProjData = async function (csProjData) {
@@ -4365,11 +4385,7 @@ export const parseCsProjData = async function (csProjData) {
       }
     }
   }
-  if (fetchLicenses) {
-    return await getNugetMetadata(pkgList);
-  } else {
-    return pkgList;
-  }
+  return pkgList;
 };
 
 export const parseCsProjAssetsData = async function (csProjData) {
@@ -4516,14 +4532,10 @@ export const parseCsProjAssetsData = async function (csProjData) {
       }
     }
   }
-  if (fetchLicenses) {
-    return await getNugetMetadata(pkgList);
-  } else {
-    return {
-      pkgList,
-      dependenciesList
-    };
-  }
+  return {
+    pkgList,
+    dependenciesList
+  };
 };
 
 export const parseCsPkgLockData = async function (csLockData) {
@@ -4547,120 +4559,7 @@ export const parseCsPkgLockData = async function (csLockData) {
       pkgList.push(pkg);
     }
   }
-  if (fetchLicenses) {
-    return await getNugetMetadata(pkgList);
-  } else {
-    return pkgList;
-  }
-};
-
-/**
- * Method to retrieve metadata for nuget packages
- *
- * @param {Array} pkgList Package list
- */
-export const getNugetMetadata = async function (pkgList) {
-  const NUGET_URL = "https://api.nuget.org/v3/registration3/";
-  const cdepList = [];
-  for (const p of pkgList) {
-    let cacheKey = undefined;
-    try {
-      if (
-        (p.group && p.group.toLowerCase() === "system") ||
-        p.name.toLowerCase().startsWith("system")
-      ) {
-        p.license = "http://go.microsoft.com/fwlink/?LinkId=329770";
-      } else if (
-        (p.group && p.group.toLowerCase() === "microsoft") ||
-        p.name.toLowerCase().startsWith("microsoft")
-      ) {
-        p.license =
-          "http://www.microsoft.com/web/webpi/eula/net_library_eula_enu.htm";
-      } else if (
-        (p.group && p.group.toLowerCase() === "nuget") ||
-        p.name.toLowerCase().startsWith("nuget")
-      ) {
-        p.license = "Apache-2.0";
-      } else {
-        // If there is a version, we can safely use the cache to retrieve the license
-        // See: https://github.com/CycloneDX/cdxgen/issues/352
-        const twoPartName = p.name.split(".").slice(0, 2).join(".");
-        cacheKey = `${p.group}|${twoPartName}`;
-        let body = metadata_cache[cacheKey];
-        if (body && body.error) {
-          cdepList.push(p);
-          continue;
-        }
-        if (!body) {
-          if (DEBUG_MODE) {
-            console.log(`Querying nuget for ${p.name}`);
-          }
-          const res = await cdxgenAgent.get(
-            NUGET_URL +
-              p.group.toLowerCase() +
-              (p.group !== "" ? "." : "") +
-              p.name.toLowerCase() +
-              "/index.json",
-            { responseType: "json" }
-          );
-          const items = res.body.items;
-          if (!items || !items[0] || !items[0].items) {
-            continue;
-          }
-          const firstItem = items[0];
-          // Work backwards to find the body for the matching version
-          body = firstItem.items[firstItem.items.length - 1];
-          if (p.version) {
-            const newBody = firstItem.items
-              .reverse()
-              .filter(
-                (i) => i.catalogEntry && i.catalogEntry.version === p.version
-              );
-            if (newBody && newBody.length) {
-              body = newBody[0];
-            }
-          }
-          metadata_cache[cacheKey] = body;
-        }
-        // Set the latest version in case it is missing
-        if (!p.version && body.catalogEntry.version) {
-          p.version = body.catalogEntry.version;
-        }
-        p.description = body.catalogEntry.description;
-        if (body.catalogEntry.authors) {
-          p.author = body.catalogEntry.authors.trim();
-        }
-        if (
-          body.catalogEntry.licenseExpression &&
-          body.catalogEntry.licenseExpression !== ""
-        ) {
-          p.license = findLicenseId(body.catalogEntry.licenseExpression);
-        } else if (body.catalogEntry.licenseUrl) {
-          p.license = findLicenseId(body.catalogEntry.licenseUrl);
-        }
-        if (body.catalogEntry.projectUrl) {
-          p.repository = { url: body.catalogEntry.projectUrl };
-          p.homepage = {
-            url:
-              "https://www.nuget.org/packages/" +
-              p.group +
-              (p.group !== "" ? "." : "") +
-              p.name +
-              "/" +
-              p.version +
-              "/"
-          };
-        }
-      }
-      cdepList.push(p);
-    } catch (err) {
-      if (cacheKey) {
-        metadata_cache[cacheKey] = { error: err.code };
-      }
-      cdepList.push(p);
-    }
-  }
-  return cdepList;
+  return pkgList;
 };
 
 /**
@@ -7074,13 +6973,10 @@ export const getCppModules = (src, options, osPkgsList, epkgList) => {
   });
   if (options.usagesSlicesFile && existsSync(options.usagesSlicesFile)) {
     sliceData = JSON.parse(readFileSync(options.usagesSlicesFile));
-    console.log("Re-using existing slices file", options.usagesSlicesFile);
-  } else {
-    if (!options.deep) {
-      console.log(
-        "By default, cdxgen parses c/c++ header files only which might miss system libraries and dependencies used directly in code. Pass the argument --deep to parse both source and header files. Please refer to the instructions in https://github.com/CycloneDX/cdxgen/blob/master/ADVANCED.md"
-      );
+    if (DEBUG_MODE) {
+      console.log("Re-using existing slices file", options.usagesSlicesFile);
     }
+  } else {
     sliceData = findAppModules(
       src,
       options.deep ? "c" : "h",
@@ -7096,7 +6992,12 @@ export const getCppModules = (src, options, osPkgsList, epkgList) => {
     }
     let extn = extname(fileName);
     let group = dirname(afile);
-    if (group.startsWith(".") || group.startsWith(_sep) || existsSync(afile)) {
+    if (
+      group.startsWith(".") ||
+      group.startsWith(_sep) ||
+      existsSync(resolve(afile)) ||
+      existsSync(resolve(src, afile))
+    ) {
       group = "";
     }
     let version = "";
@@ -7230,3 +7131,206 @@ export const parseCUsageSlice = (sliceData) => {
   }
   return usageData;
 };
+
+async function getNugetUrl() {
+  const req = "https://api.nuget.org/v3/index.json";
+  const res = await cdxgenAgent.get(req, {
+    responseType: "json"
+  });
+  const urls = res.body.resources;
+  for (const resource of urls) {
+    if (resource["@type"] === "RegistrationsBaseUrl/3.6.0") {
+      return resource["@id"];
+    }
+  }
+  return "https://api.nuget.org/v3/registration3/";
+}
+
+async function queryNuget(p, NUGET_URL) {
+  if (DEBUG_MODE) {
+    console.log(`Querying nuget for ${p.name}`);
+  }
+  const np = JSON.parse(JSON.stringify(p));
+  const body = [];
+  const newBody = [];
+  let res = await cdxgenAgent.get(
+    NUGET_URL + np.name.toLowerCase() + "/index.json",
+    { responseType: "json" }
+  );
+  let items = res.body.items;
+  if (!items || !items[0]) {
+    return [np, newBody, body];
+  }
+  if (items[0] && !items[0].items) {
+    if (!p.version || p.version === "0.0.0" || p.version === "latest") {
+      const tmpVersion = parse(res.body.items[res.body.items.length - 1].upper);
+      np.version =
+        tmpVersion.major + "." + tmpVersion.minor + "." + tmpVersion.patch;
+      if (
+        compare(np.version, res.body.items[res.body.items.length - 1].upper) ===
+        1
+      ) {
+        if (tmpVersion.patch > 0) {
+          np.version =
+            tmpVersion.major +
+            "." +
+            tmpVersion.minor +
+            "." +
+            (tmpVersion.patch - 1).toString();
+        }
+      }
+    }
+    for (const item of items) {
+      // if (!p.version || p.version === "0.0.0" || p.version === "latest") {
+      //   const tmpVersion = parse(res.body.items[res.body.items.length - 1].upper);
+      //   np.version = tmpVersion.major + "." + tmpVersion.minor + "." + tmpVersion.patch;
+      //
+      // }
+      if (np.version && valid(np.version)) {
+        let lower = compare(item.lower, np.version);
+        let upper = compare(item.upper, np.version);
+        if (lower !== 1 && upper !== -1) {
+          res = await cdxgenAgent.get(item["@id"], { responseType: "json" });
+          newBody.push(
+            res.body.items
+              .reverse()
+              .filter(
+                (i) => i.catalogEntry && i.catalogEntry.version === np.version
+              )
+          );
+          break;
+        }
+      }
+    }
+  } else {
+    if (!p.version || p.version === "0.0.0" || p.version === "latest") {
+      const tmpVersion = parse(res.body.items[res.body.items.length - 1].upper);
+      np.version =
+        tmpVersion.major + "." + tmpVersion.minor + "." + tmpVersion.patch;
+    }
+    const firstItem = items[0];
+    // Work backwards to find the body for the matching version
+    // body.push(firstItem.items[firstItem.items.length - 1])
+    if (np.version) {
+      newBody.push(
+        firstItem.items
+          .reverse()
+          .filter(
+            (i) => i.catalogEntry && i.catalogEntry.version === np.version
+          )
+      );
+    }
+  }
+  return [np, newBody];
+}
+
+/**
+ * Method to retrieve metadata for nuget packages
+ *
+ * @param {Array} pkgList Package list
+ */
+export const getNugetMetadata = async function (
+  pkgList,
+  dependencies = undefined
+) {
+  const NUGET_URL = await getNugetUrl();
+  const cdepList = [];
+  const depRepList = {};
+  for (const p of pkgList) {
+    let cacheKey = undefined;
+    try {
+      // If there is a version, we can safely use the cache to retrieve the license
+      // See: https://github.com/CycloneDX/cdxgen/issues/352
+      cacheKey = `${p.name}|${p.version}`;
+      let body = metadata_cache[cacheKey];
+
+      if (body && body.error) {
+        cdepList.push(p);
+        continue;
+      }
+      if (!body) {
+        let newBody = {};
+        let np = {};
+        [np, newBody] = await queryNuget(p, NUGET_URL);
+        if (p.version !== np.version) {
+          const oldRef = p["bom-ref"];
+          p["bom-ref"] = decodeURIComponent(
+            new PackageURL(
+              "nuget",
+              "",
+              np.name,
+              np.version,
+              null,
+              null
+            ).toString()
+          );
+          depRepList[oldRef] = p["bom-ref"];
+          p.version = np.version;
+        }
+        if (newBody && newBody[0].length > 0) {
+          body = newBody[0][0];
+        }
+        if (body) {
+          metadata_cache[cacheKey] = body;
+          // Set the latest version in case it is missing
+          if (!p.version && body.catalogEntry.version) {
+            p.version = body.catalogEntry.version;
+          }
+          p.description = body.catalogEntry.description;
+          if (body.catalogEntry.authors) {
+            p.author = body.catalogEntry.authors.trim();
+          }
+          if (
+            body.catalogEntry.licenseExpression &&
+            body.catalogEntry.licenseExpression !== ""
+          ) {
+            p.license = findLicenseId(body.catalogEntry.licenseExpression);
+          } else if (body.catalogEntry.licenseUrl) {
+            p.license = findLicenseId(body.catalogEntry.licenseUrl);
+          }
+          if (body.catalogEntry.projectUrl) {
+            p.repository = { url: body.catalogEntry.projectUrl };
+            p.homepage = {
+              url:
+                "https://www.nuget.org/packages/" +
+                p.name +
+                "/" +
+                p.version +
+                "/"
+            };
+          }
+          cdepList.push(p);
+        }
+      }
+    } catch (err) {
+      if (cacheKey) {
+        metadata_cache[cacheKey] = { error: err.code };
+      }
+      cdepList.push(p);
+    }
+  }
+  const newDependencies = [].concat(dependencies);
+  if (depRepList && newDependencies.length) {
+    const changed = Object.keys(depRepList);
+    // if (!parentComponent.version || parentComponent.version === "latest" || parentComponent.version === "0.0.0"){
+    //   if (changed.includes(parentComponent["bom-ref"])) {
+    //     parentComponent["bom-ref"] = depRepList[parentComponent["bom-ref"]["ref"]];
+    //   }
+    // }
+    for (const d of newDependencies) {
+      if (changed.length > 0 && changed.includes(d["ref"])) {
+        d["ref"] = depRepList[d["ref"]];
+      }
+      for (const dd in d["dependsOn"]) {
+        if (changed.includes(d["dependsOn"][dd])) {
+          const replace = d["dependsOn"][dd];
+          d["dependsOn"][dd] = depRepList[replace];
+        }
+      }
+    }
+  }
+  return {
+    pkgList: cdepList,
+    dependencies: newDependencies
+  };
+};