@cyclonedx/cdxgen 9.9.6 → 9.9.7

package/README.md

@@ -51,6 +51,7 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 | Docker compose                  | docker-compose\*.yml. Images would also be scanned.                                                               | N/A                                                                                               |          |
 | Dockerfile                      | `*Dockerfile*` Images would also be scanned.                                                                      | N/A                                                                                               |          |
 | Containerfile                   | `*Containerfile*`. Images would also be scanned.                                                                  | N/A                                                                                               |          |
+| Bitbucket Pipelines             | `bitbucket-pipelines.yml` images and pipes would also be scanned.                                                 | N/A                                                                                               |          |
 | Google CloudBuild configuration | cloudbuild.yaml                                                                                                   | N/A                                                                                               |          |
 | OpenAPI                         | openapi\*.json, openapi\*.yaml                                                                                    | N/A                                                                                               |          |
 

package/index.js

@@ -106,7 +106,8 @@ import {
   getNugetMetadata,
   frameworksList,
   parseContainerFile,
-  parseBitbucketPipelinesFile
+  parseBitbucketPipelinesFile,
+  getPyMetadata
 } from "./utils.js";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -2575,6 +2576,9 @@ export const createPythonBom = async (path, options) => {
   if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
     rmSync(tempDir, { recursive: true, force: true });
   }
+  if (FETCH_LICENSE) {
+    pkgList = await getPyMetadata(pkgList, false);
+  }
   return buildBomNSData(options, pkgList, "pypi", {
     allImports,
     src: path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.9.6",
+  "version": "9.9.7",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -19,8 +19,7 @@ import {
   readFileSync,
   rmSync,
   unlinkSync,
-  writeFileSync,
-  readdirSync
+  writeFileSync
 } from "node:fs";
 import got from "got";
 import Arborist from "@npmcli/arborist";
@@ -6683,30 +6682,13 @@ export const encodeForPurl = (s) => {
 export const getPomPropertiesFromMavenDir = function (mavenDir) {
   let pomProperties = {};
   if (existsSync(mavenDir) && lstatSync(mavenDir).isDirectory()) {
-    let mavenDirEntries = readdirSync(mavenDir, { withFileTypes: true });
-    mavenDirEntries.forEach((mavenDirEntry) => {
-      if (mavenDirEntry.isDirectory()) {
-        let groupDirEntries = readdirSync(
-          join(mavenDirEntry.path, mavenDirEntry.name),
-          { withFileTypes: true }
-        );
-        groupDirEntries.forEach((groupDirEntry) => {
-          if (groupDirEntry.isDirectory()) {
-            let pomPropertiesFile = join(
-              groupDirEntry.path,
-              groupDirEntry.name,
-              "pom.properties"
-            );
-            if (existsSync(pomPropertiesFile)) {
-              const pomPropertiesString = readFileSync(pomPropertiesFile, {
-                encoding: "utf-8"
-              });
-              pomProperties = parsePomProperties(pomPropertiesString);
-            }
-          }
-        });
-      }
-    });
+    const pomPropertiesFiles = getAllFiles(mavenDir, "**/pom.properties");
+    if (pomPropertiesFiles && pomPropertiesFiles.length) {
+      const pomPropertiesString = readFileSync(pomPropertiesFiles[0], {
+        encoding: "utf-8"
+      });
+      pomProperties = parsePomProperties(pomPropertiesString);
+    }
   }
   return pomProperties;
 };
@@ -6845,17 +6827,17 @@ export const extractJarArchive = function (
           if (!name || !version || name === "" || version === "") {
             confidence = 0.5;
             technique = "filename";
+            name = jarname.replace(".jar", "");
             const tmpA = jarname.split("-");
             if (tmpA && tmpA.length > 1) {
               const lastPart = tmpA[tmpA.length - 1];
-              if (!version || version === "") {
-                version = lastPart.replace(".jar", "");
-              }
-              if (!name || name === "") {
+              // Bug #768. Check if we have any number before simplifying the name.
+              if (/\d/.test(lastPart)) {
+                if (!version || version === "") {
+                  version = lastPart.replace(".jar", "");
+                }
                 name = jarname.replace("-" + lastPart, "") || "";
               }
-            } else {
-              name = jarname.replace(".jar", "");
             }
           }
           if (