@eclipse-scout/cli 25.1.3 → 25.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eclipse-scout/cli",
-  "version": "25.1.3",
+  "version": "25.1.6",
   "description": "CLI for Eclipse Scout",
   "author": "BSI Business Systems Integration AG",
   "homepage": "https://eclipse.dev/scout/",
@@ -45,8 +45,8 @@
     "karma-jasmine": "5.1.0",
     "karma-jasmine-ajax": "0.1.13",
     "@metahub/karma-jasmine-jquery": "4.0.1",
-    "@eclipse-scout/karma-jasmine-scout": "25.1.3",
-    "@eclipse-scout/tsconfig": "25.1.3",
+    "@eclipse-scout/karma-jasmine-scout": "25.1.6",
+    "@eclipse-scout/tsconfig": "25.1.6",
     "karma-jasmine-html-reporter": "2.1.0",
     "karma-junit-reporter": "2.0.1",
     "karma-webpack": "5.0.1",
@@ -58,7 +58,8 @@
     "webpack": "5.97.1",
     "yargs-parser": "21.1.1",
     "fork-ts-checker-webpack-plugin": "9.0.2",
-    "fork-ts-checker-notifier-webpack-plugin": "9.0.0"
+    "fork-ts-checker-notifier-webpack-plugin": "9.0.0",
+    "@cyclonedx/webpack-plugin": "5.0.1"
   },
   "devDependencies": {
     "@eclipse-scout/releng": "^25.1.0"

package/scripts/webpack-defaults.js

@@ -11,6 +11,7 @@ const fs = require('fs');
 const path = require('path');
 const scoutBuildConstants = require('./constants');
 const CopyPlugin = require('copy-webpack-plugin');
+const {CycloneDxWebpackPlugin} = require('@cyclonedx/webpack-plugin');
 const MiniCssExtractPlugin = require('mini-css-extract-plugin');
 const AfterEmitWebpackPlugin = require('./AfterEmitWebpackPlugin');
 const {SourceMapDevToolPlugin, WatchIgnorePlugin, ProgressPlugin} = require('webpack');
@@ -21,6 +22,8 @@ const {SourceMapDevToolPlugin, WatchIgnorePlugin, ProgressPlugin} = require('web
  * @param {boolean} args.progress true, to show build progress in percentage. Default is true.
  * @param {boolean} args.profile true, to show timing information for each build step. Default is false.
  * @param {boolean} args.watch true, if webpack runs in watch mode. Default is false.
+ * @param {boolean} args.cyclonedxSkip true, if no CycloneDX SBOM should be created. Default is false.
+ * @param {string} args.cyclonedxVersion CycloneDX version to use. Default is '1.5'.
  * @param {[]} args.resDirArray an array containing directories which should be copied to dist/res
  * @param {object} args.tsOptions a config object to be passed to the ts-loader
  * @param {boolean|'fork'} args.typeCheck
@@ -300,6 +303,19 @@ module.exports = (env, args) => {
         }
       })
     ];
+
+    const cyclonedxSkip = ('' + nvl(args.cyclonedxSkip, 'false')) === 'true';
+    if (!cyclonedxSkip) {
+      /** @type {import('@cyclonedx/webpack-plugin').CycloneDxWebpackPluginOptions} */
+      const cycloneDxWebpackPluginOptions = {
+        specVersion: nvl(args.cyclonedxVersion, '1.5'),
+        collectEvidence: true,
+        rootComponentType: 'application',
+        validateResults: false,
+        includeWellknown: false
+      };
+      config.plugins.push(new CycloneDxWebpackPlugin(cycloneDxWebpackPluginOptions));
+    }
   }
 
   return config;
@@ -350,6 +366,10 @@ function libraryConfig(config, options = {}) {
   const customExternals = options.externals || {};
   const allExternals = {...packageJsonExternals, ...config.externals, ...customExternals};
 
+  // Remove CycloneDxWebpackPlugin for libraries as dependencies are marked as externals anyway and are therefore not part of the build.
+  // The SBOM will be created for application level builds only.
+  config.plugins = config.plugins.filter(p => !(p instanceof CycloneDxWebpackPlugin));
+
   // FileList is not necessary in library mode
   let plugins = config.plugins.map(plugin => {
     if (plugin instanceof AfterEmitWebpackPlugin) {