@cyclonedx/cdxgen 9.9.5 → 9.9.7

package/README.md

@@ -51,6 +51,7 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 | Docker compose                  | docker-compose\*.yml. Images would also be scanned.                                                               | N/A                                                                                               |          |
 | Dockerfile                      | `*Dockerfile*` Images would also be scanned.                                                                      | N/A                                                                                               |          |
 | Containerfile                   | `*Containerfile*`. Images would also be scanned.                                                                  | N/A                                                                                               |          |
+| Bitbucket Pipelines             | `bitbucket-pipelines.yml` images and pipes would also be scanned.                                                 | N/A                                                                                               |          |
 | Google CloudBuild configuration | cloudbuild.yaml                                                                                                   | N/A                                                                                               |          |
 | OpenAPI                         | openapi\*.json, openapi\*.yaml                                                                                    | N/A                                                                                               |          |
 
@@ -86,10 +87,10 @@ For go, `go mod why` command is used to identify required packages. For php, com
 ## Installing
 
 ```shell
-sudo npm install -g @cyclonedx/cdxgen
+npm install -g @cyclonedx/cdxgen
 
 # For CycloneDX 1.4 compatibility use version 8.6.0 or pass the argument `--spec-version 1.4`
-sudo npm install -g @cyclonedx/cdxgen@8.6.0
+npm install -g @cyclonedx/cdxgen@8.6.0
 ```
 
 If you are a [Homebrew](https://brew.sh/) user, you can also install [cdxgen](https://formulae.brew.sh/formula/cdxgen) via:
@@ -327,7 +328,7 @@ This would create a bom.json.map file with the jar - class name mapping. Refer t
 
 ## Resolving licenses
 
-cdxgen can automatically query public registries such as maven, npm, or nuget to resolve the package licenses. This is a time-consuming operation and is disabled by default. To enable, set the environment variable `FETCH_LICENSE` to `true`, as shown.
+cdxgen can automatically query public registries such as maven, npm, or nuget to resolve the package licenses. This is a time-consuming operation and is disabled by default. To enable, set the environment variable `FETCH_LICENSE` to `true`, as shown. Ensure that `GITHUB_TOKEN` is set or provided by [built-in GITHUB_TOKEN in GitHub Actions](https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api#primary-rate-limit-for-github_token-in-github-actions), otherwise rate limiting might prevent license resolving.
 
 ```bash
 export FETCH_LICENSE=true

package/data/frameworks-list.json

@@ -141,6 +141,25 @@
     "pkg:cargo/nickel",
     "pkg:cargo/yew",
     "pkg:cargo/azul",
-    "pkg:cargo/conrod"
+    "pkg:cargo/conrod",
+    "pkg:generic/Aws",
+    "pkg:generic/Azure",
+    "pkg:generic/google",
+    "pkg:generic/CivetServer",
+    "pkg:generic/civetweb",
+    "pkg:generic/cpprest",
+    "pkg:generic/QCoreApplication",
+    "pkg:generic/drogon",
+    "pkg:generic/wfrest",
+    "pkg:generic/http",
+    "pkg:generic/fio",
+    "pkg:generic/onion",
+    "pkg:generic/lwan",
+    "pkg:generic/oatpp",
+    "pkg:generic/QDjango",
+    "pkg:generic/userver",
+    "pkg:generic/Wt/",
+    "pkg:generic/klone",
+    "pkg:generic/kcgi"
   ]
 }

package/data/known-licenses.json

@@ -1,31 +1,82 @@
 [
-  { "license": "Apache-2.0", "group": "cloud.google.com", "name": "go" },
-  { "license": "Apache-2.0", "group": "cloud.google.com/go", "name": "*" },
-  { "license": "Apache-2.0", "group": "cuelang.org", "name": "go" },
-  { "license": "MIT", "group": "pack.ag", "name": "amqp" },
-  { "license": "Apache-2.0", "group": "google.golang.org", "name": "*" },
-  { "license": "BSD-3-Clause", "group": "golang.org/x", "name": "*" },
   {
-    "license": "BSD-3-Clause",
-    "group": "dmitri.shuralyov.com/gpu",
-    "name": "*"
+    "packageNamespace": "*",
+    "knownLicenses": [{ "license": "MIT", "urlIncludes": "mit-license" }]
   },
-  { "license": "Apache-2.0", "group": "contrib.go.opencensus.io", "name": "*" },
-  { "license": "Apache-2.0", "group": "git.apache.org", "name": "*" },
-  { "license": "Apache-2.0", "group": ".", "name": "go.opencensus.io" },
-  { "license": "MIT", "group": "sigs.k8s.io", "name": "*" },
-  { "license": "BSD-3-Clause", "group": "rsc.io", "name": "*" },
-  { "license": "Apache-2.0", "group": "openpitrix.io", "name": "*" },
-  { "license": "BSD-3-Clause", "group": "modernc.org", "name": "*" },
-  { "license": "Apache-2.0", "group": "kubesphere.io", "name": "*" },
-  { "license": "Apache-2.0", "group": "k8s.io", "name": "*" },
-  { "license": "Apache-2.0", "group": "istio.io", "name": "*" },
-  { "license": "MIT", "group": "honnef.co/go", "name": "*" },
-  { "license": "Apache-2.0", "group": ".", "name": "gotest.tools" },
-  { "license": "Apache-2.0", "group": "gopkg.in", "name": "*" },
-  { "license": "Apache-2.0", "group": "code.cloudfoundry.org", "name": "*" },
-  { "license": "BSD-3-Clause", "group": "gonum.org/v1", "name": "*" },
-  { "license": "Apache-2.0", "group": "gomodules.xyz/jsonpatch", "name": "*" },
-  { "license": "MIT", "group": "go.uber.org", "name": "*" },
-  { "license": "MIT", "group": "go.etcd.io", "name": "*" }
+  {
+    "packageNamespace": "pkg:golang/",
+    "knownLicenses": [
+      { "license": "Apache-2.0", "group": "cloud.google.com", "name": "go" },
+      { "license": "Apache-2.0", "group": "cloud.google.com/go", "name": "*" },
+      { "license": "Apache-2.0", "group": "cuelang.org", "name": "go" },
+      { "license": "MIT", "group": "pack.ag", "name": "amqp" },
+      { "license": "Apache-2.0", "group": "google.golang.org", "name": "*" },
+      { "license": "BSD-3-Clause", "group": "golang.org/x", "name": "*" },
+      {
+        "license": "BSD-3-Clause",
+        "group": "dmitri.shuralyov.com/gpu",
+        "name": "*"
+      },
+      {
+        "license": "Apache-2.0",
+        "group": "contrib.go.opencensus.io",
+        "name": "*"
+      },
+      { "license": "Apache-2.0", "group": "git.apache.org", "name": "*" },
+      { "license": "Apache-2.0", "group": ".", "name": "go.opencensus.io" },
+      { "license": "MIT", "group": "sigs.k8s.io", "name": "*" },
+      { "license": "BSD-3-Clause", "group": "rsc.io", "name": "*" },
+      { "license": "Apache-2.0", "group": "openpitrix.io", "name": "*" },
+      { "license": "BSD-3-Clause", "group": "modernc.org", "name": "*" },
+      { "license": "Apache-2.0", "group": "kubesphere.io", "name": "*" },
+      { "license": "Apache-2.0", "group": "k8s.io", "name": "*" },
+      { "license": "Apache-2.0", "group": "istio.io", "name": "*" },
+      { "license": "MIT", "group": "honnef.co/go", "name": "*" },
+      { "license": "Apache-2.0", "group": ".", "name": "gotest.tools" },
+      { "license": "Apache-2.0", "group": "gopkg.in", "name": "*" },
+      {
+        "license": "Apache-2.0",
+        "group": "code.cloudfoundry.org",
+        "name": "*"
+      },
+      { "license": "BSD-3-Clause", "group": "gonum.org/v1", "name": "*" },
+      {
+        "license": "Apache-2.0",
+        "group": "gomodules.xyz/jsonpatch",
+        "name": "*"
+      },
+      { "license": "MIT", "group": "go.uber.org", "name": "*" },
+      { "license": "MIT", "group": "go.etcd.io", "name": "*" }
+    ]
+  },
+  {
+    "packageNamespace": "pkg:nuget/",
+    "knownLicenses": [
+      {
+        "license": "MIT",
+        "urlIncludes": "//github.com/dotnet/standard/",
+        "licenseEvidence": "https://github.com/dotnet/standard/blob/release/3.0/LICENSE.TXT"
+      },
+      {
+        "license": "MIT",
+        "urlIncludes": "//github.com/dotnet/corefx/",
+        "licenseEvidence": "https://github.com/dotnet/corefx/blob/release/2.0.0/LICENSE.TXT"
+      },
+      {
+        "license": "MIT",
+        "urlIncludes": "//github.com/dotnet/core-setup/",
+        "licenseEvidence": "https://github.com/dotnet/core-setup/blob/release/2.0.0/LICENSE.TXT"
+      },
+      {
+        "licenseName": ".NET Library License",
+        "urlEndswith": "?LinkId=329770",
+        "licenseEvidence": "https://go.microsoft.com/fwlink/?LinkId=329770"
+      },
+      {
+        "licenseName": ".NET Library License",
+        "urlEndswith": "dotnet_library_license.htm",
+        "licenseEvidence": "https://dotnet.microsoft.com/en-us/dotnet_library_license.htm"
+      }
+    ]
+  }
 ]

package/docker.js

@@ -416,11 +416,16 @@ export const parseImageName = (fullImageName) => {
     repo: "",
     tag: "",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "",
+    name: ""
   };
   if (!fullImageName) {
     return nameObj;
   }
+  // ensure it's lowercased
+  fullImageName = fullImageName.toLowerCase();
+
   // Extract registry name
   if (
     fullImageName.includes("/") &&
@@ -437,6 +442,7 @@ export const parseImageName = (fullImageName) => {
       fullImageName = fullImageName.replace(tmpA[0] + "/", "");
     }
   }
+
   // Extract digest name
   if (fullImageName.includes("@sha256:")) {
     const tmpA = fullImageName.split("@sha256:");
@@ -445,6 +451,7 @@ export const parseImageName = (fullImageName) => {
       fullImageName = fullImageName.replace("@sha256:" + nameObj.digest, "");
     }
   }
+
   // Extract tag name
   if (fullImageName.includes(":")) {
     const tmpA = fullImageName.split(":");
@@ -453,11 +460,20 @@ export const parseImageName = (fullImageName) => {
       fullImageName = fullImageName.replace(":" + nameObj.tag, "");
     }
   }
-  if (fullImageName && fullImageName.startsWith("library/")) {
-    fullImageName = fullImageName.replace("library/", "");
-  }
+
   // The left over string is the repo name
   nameObj.repo = fullImageName;
+  nameObj.name = fullImageName;
+
+  // extract group name
+  if (fullImageName.includes("/")) {
+    const tmpA = fullImageName.split("/");
+    if (tmpA.length > 1) {
+      nameObj.name = tmpA[tmpA.length - 1];
+      nameObj.group = fullImageName.replace("/" + tmpA[tmpA.length - 1], "");
+    }
+  }
+
   return nameObj;
 };
 

package/docker.test.js

@@ -24,35 +24,54 @@ test("parseImageName tests", () => {
     repo: "debian",
     tag: "",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "",
+    name: "debian"
   });
   expect(parseImageName("debian:latest")).toEqual({
     registry: "",
     repo: "debian",
     tag: "latest",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "",
+    name: "debian"
+  });
+  expect(parseImageName("library/debian:latest")).toEqual({
+    registry: "",
+    repo: "library/debian",
+    tag: "latest",
+    digest: "",
+    platform: "",
+    group: "library",
+    name: "debian"
   });
   expect(parseImageName("shiftleft/scan:v1.15.6")).toEqual({
     registry: "",
     repo: "shiftleft/scan",
     tag: "v1.15.6",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "shiftleft",
+    name: "scan"
   });
   expect(parseImageName("localhost:5000/shiftleft/scan:v1.15.6")).toEqual({
     registry: "localhost:5000",
     repo: "shiftleft/scan",
     tag: "v1.15.6",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "shiftleft",
+    name: "scan"
   });
   expect(parseImageName("localhost:5000/shiftleft/scan")).toEqual({
     registry: "localhost:5000",
     repo: "shiftleft/scan",
     tag: "",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "shiftleft",
+    name: "scan"
   });
   expect(
     parseImageName("foocorp.jfrog.io/docker/library/eclipse-temurin:latest")
@@ -61,7 +80,9 @@ test("parseImageName tests", () => {
     repo: "docker/library/eclipse-temurin",
     tag: "latest",
     digest: "",
-    platform: ""
+    platform: "",
+    group: "docker/library",
+    name: "eclipse-temurin"
   });
   expect(
     parseImageName(
@@ -72,7 +93,9 @@ test("parseImageName tests", () => {
     repo: "shiftleft/scan-java",
     tag: "",
     digest: "5d008306a7c5d09ba0161a3408fa3839dc2c9dd991ffb68adecc1040399fe9e1",
-    platform: ""
+    platform: "",
+    group: "shiftleft",
+    name: "scan-java"
   });
 }, 120000);
 

package/evinser.js

@@ -322,6 +322,29 @@ export const analyzeProject = async (dbObjMap, options) => {
   // Load any existing purl-location information from the sbom.
   // For eg: cdxgen populates this information for javascript projects
   let { purlLocationMap, purlImportsMap } = initFromSbom(components);
+  // Do reachables first so that usages slicing can reuse the atom file
+  if (options.withReachables) {
+    if (
+      options.reachablesSlicesFile &&
+      fs.existsSync(options.reachablesSlicesFile)
+    ) {
+      reachablesSlicesFile = options.reachablesSlicesFile;
+      reachablesSlice = JSON.parse(
+        fs.readFileSync(options.reachablesSlicesFile, "utf-8")
+      );
+    } else {
+      retMap = createSlice(language, dirPath, "reachables", options);
+      if (retMap && retMap.slicesFile && fs.existsSync(retMap.slicesFile)) {
+        reachablesSlicesFile = retMap.slicesFile;
+        reachablesSlice = JSON.parse(
+          fs.readFileSync(retMap.slicesFile, "utf-8")
+        );
+      }
+    }
+  }
+  if (reachablesSlice && Object.keys(reachablesSlice).length) {
+    dataFlowFrames = await collectReachableFrames(language, reachablesSlice);
+  }
   // Reuse existing usages slices
   if (options.usagesSlicesFile && fs.existsSync(options.usagesSlicesFile)) {
     usageSlice = JSON.parse(fs.readFileSync(options.usagesSlicesFile, "utf-8"));
@@ -374,28 +397,6 @@ export const analyzeProject = async (dbObjMap, options) => {
       purlImportsMap
     );
   }
-  if (options.withReachables) {
-    if (
-      options.reachablesSlicesFile &&
-      fs.existsSync(options.reachablesSlicesFile)
-    ) {
-      reachablesSlicesFile = options.reachablesSlicesFile;
-      reachablesSlice = JSON.parse(
-        fs.readFileSync(options.reachablesSlicesFile, "utf-8")
-      );
-    } else {
-      retMap = createSlice(language, dirPath, "reachables", options);
-      if (retMap && retMap.slicesFile && fs.existsSync(retMap.slicesFile)) {
-        reachablesSlicesFile = retMap.slicesFile;
-        reachablesSlice = JSON.parse(
-          fs.readFileSync(retMap.slicesFile, "utf-8")
-        );
-      }
-    }
-  }
-  if (reachablesSlice && Object.keys(reachablesSlice).length) {
-    dataFlowFrames = await collectReachableFrames(language, reachablesSlice);
-  }
   return {
     atomFile: retMap.atomFile,
     usagesSlicesFile,
@@ -776,15 +777,19 @@ export const detectServicesFromUDT = (
   servicesMap
 ) => {
   if (
-    ["python", "py"].includes(language) &&
+    ["python", "py", "c", "cpp", "c++"].includes(language) &&
     userDefinedTypes &&
     userDefinedTypes.length
   ) {
     for (const audt of userDefinedTypes) {
       if (
-        audt.name.includes("route") ||
-        audt.name.includes("path") ||
-        audt.name.includes("url")
+        audt.name.toLowerCase().includes("route") ||
+        audt.name.toLowerCase().includes("path") ||
+        audt.name.toLowerCase().includes("url") ||
+        audt.name.toLowerCase().includes("registerhandler") ||
+        audt.name.toLowerCase().includes("endpoint") ||
+        audt.name.toLowerCase().includes("api") ||
+        audt.name.toLowerCase().includes("add_method")
       ) {
         const fields = audt.fields || [];
         if (
@@ -875,14 +880,11 @@ export const extractEndpoints = (language, code) => {
           );
       }
       break;
-    case "py":
-    case "python":
+    default:
       endpoints = (code.match(/['"](.*?)['"]/gi) || [])
         .map((v) => v.replace(/["']/g, "").replace("\n", ""))
         .filter((v) => v.length > 2);
       break;
-    default:
-      break;
   }
   return endpoints;
 };
@@ -910,6 +912,7 @@ export const createEvinseFile = (sliceArtefacts, options) => {
   const components = bomJson.components || [];
   let occEvidencePresent = false;
   let csEvidencePresent = false;
+  let servicesPresent = false;
   for (const comp of components) {
     if (!comp.purl) {
       continue;
@@ -957,6 +960,7 @@ export const createEvinseFile = (sliceArtefacts, options) => {
     }
     // Add to existing services
     bomJson.services = (bomJson.services || []).concat(services);
+    servicesPresent = true;
   }
   if (options.annotate) {
     if (!bomJson.annotations) {
@@ -993,7 +997,7 @@ export const createEvinseFile = (sliceArtefacts, options) => {
   bomJson.metadata.timestamp = new Date().toISOString();
   delete bomJson.signature;
   fs.writeFileSync(evinseOutFile, JSON.stringify(bomJson, null, 2));
-  if (occEvidencePresent || csEvidencePresent) {
+  if (occEvidencePresent || csEvidencePresent || servicesPresent) {
     console.log(evinseOutFile, "created successfully.");
   } else {
     console.log(

package/index.js

@@ -105,7 +105,9 @@ import {
   MAX_BUFFER,
   getNugetMetadata,
   frameworksList,
-  parseContainerFile
+  parseContainerFile,
+  parseBitbucketPipelinesFile,
+  getPyMetadata
 } from "./utils.js";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -2574,6 +2576,9 @@ export const createPythonBom = async (path, options) => {
   if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
     rmSync(tempDir, { recursive: true, force: true });
   }
+  if (FETCH_LICENSE) {
+    pkgList = await getPyMetadata(pkgList, false);
+  }
   return buildBomNSData(options, pkgList, "pypi", {
     allImports,
     src: path,
@@ -3148,6 +3153,18 @@ export const createCppBom = (path, options) => {
         retMap.parentComponent.type = "library";
         pkgList.push(retMap.parentComponent);
       }
+      // Retain the dependency tree from cmake
+      if (retMap.dependenciesList) {
+        if (dependencies.length) {
+          dependencies = mergeDependencies(
+            dependencies,
+            retMap.dependenciesList,
+            parentComponent
+          );
+        } else {
+          dependencies = retMap.dependenciesList;
+        }
+      }
     }
   }
   // The need for java >= 17 with atom is causing confusions since there could be C projects
@@ -3719,6 +3736,11 @@ export const createContainerSpecLikeBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "*Dockerfile*",
     options
   );
+  const bbPipelineFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "bitbucket-pipelines.yml",
+    options
+  );
   const cfFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*Containerfile*",
@@ -3747,27 +3769,35 @@ export const createContainerSpecLikeBom = async (path, options) => {
   }
   // Privado.ai json files
   const privadoFiles = getAllFiles(path, ".privado/" + "*.json", options);
-  // Parse yaml manifest files, dockerfiles or containerfiles
-  if (dcFiles.length || dfFiles.length || cfFiles.length) {
-    for (const f of [...dcFiles, ...dfFiles, ...cfFiles]) {
+
+  // Parse yaml manifest files, dockerfiles, containerfiles or bitbucket pipeline files
+  if (
+    dcFiles.length ||
+    dfFiles.length ||
+    cfFiles.length ||
+    bbPipelineFiles.length
+  ) {
+    for (const f of [...dcFiles, ...dfFiles, ...cfFiles, ...bbPipelineFiles]) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
 
       const dData = readFileSync(f, { encoding: "utf-8" });
-      let imglist = [];
+      let imgList = [];
       // parse yaml manifest files
-      if (f.endsWith(".yml") || f.endsWith(".yaml")) {
-        imglist = parseContainerSpecData(dData);
+      if (f.endsWith("bitbucket-pipelines.yml")) {
+        imgList = parseBitbucketPipelinesFile(dData);
+      } else if (f.endsWith(".yml") || f.endsWith(".yaml")) {
+        imgList = parseContainerSpecData(dData);
       } else {
-        imglist = parseContainerFile(dData);
+        imgList = parseContainerFile(dData);
       }
 
-      if (imglist && imglist.length) {
+      if (imgList && imgList.length) {
         if (DEBUG_MODE) {
-          console.log("Images identified in", f, "are", imglist);
+          console.log("Images identified in", f, "are", imgList);
         }
-        for (const img of imglist) {
+        for (const img of imgList) {
           const commonProperties = [
             {
               name: "SrcFile",
@@ -3832,20 +3862,26 @@ export const createContainerSpecLikeBom = async (path, options) => {
               console.log(`Parsing image ${img.image}`);
             }
             const imageObj = parseImageName(img.image);
+
             const pkg = {
-              name: imageObj.repo,
+              name: imageObj.name,
+              group: imageObj.group,
               version:
                 imageObj.tag ||
                 (imageObj.digest ? "sha256:" + imageObj.digest : "latest"),
               qualifiers: {},
-              properties: commonProperties
+              properties: commonProperties,
+              type: "container"
             };
             if (imageObj.registry) {
-              pkg["qualifiers"]["repository_url"] = imageObj.registry;
+              pkg["qualifiers"]["repository_url"] = img.image;
             }
             if (imageObj.platform) {
               pkg["qualifiers"]["platform"] = imageObj.platform;
             }
+            if (imageObj.tag) {
+              pkg["qualifiers"]["tag"] = imageObj.tag;
+            }
             // Create an entry for the oci image
             const imageBomData = buildBomNSData(options, [pkg], "oci", {
               src: img.image,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.9.5",
+  "version": "9.9.7",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -55,13 +55,13 @@
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.23.3",
-    "@babel/traverse": "^7.23.3",
+    "@babel/parser": "^7.23.5",
+    "@babel/traverse": "^7.23.5",
     "@npmcli/arborist": "7.2.0",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "cheerio": "^1.0.0-rc.12",
-    "edn-data": "^1.0.0",
+    "edn-data": "1.1.1",
     "find-up": "^6.3.0",
     "glob": "^10.3.10",
     "global-agent": "^3.0.0",
@@ -83,7 +83,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "1.6.4",
+    "@appthreat/atom": "1.7.2",
     "@cyclonedx/cdxgen-plugins-bin": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-ppc64": "^1.4.0",
@@ -91,7 +91,7 @@
     "compression": "^1.7.4",
     "connect": "^3.7.0",
     "jsonata": "^2.0.3",
-    "sequelize": "^6.35.0",
+    "sequelize": "^6.35.1",
     "sqlite3": "^5.1.6"
   },
   "files": [
@@ -102,7 +102,7 @@
   "devDependencies": {
     "caxa": "^3.0.1",
     "docsify-cli": "^4.4.4",
-    "eslint": "^8.53.0",
+    "eslint": "^8.54.0",
     "eslint-config-prettier": "^9.0.0",
     "eslint-plugin-prettier": "^5.0.1",
     "jest": "^29.7.0",

package/server.js

@@ -83,7 +83,8 @@ const parseQueryString = (q, body, options = {}) => {
     "filter",
     "only",
     "autoCompositions",
-    "gitBranch"
+    "gitBranch",
+    "active"
   ];
 
   for (const param of queryParams) {