@pnpm/deps.compliance.commands 1101.3.4 → 1101.4.0

package/lib/audit/audit.js

@@ -401,6 +401,11 @@ async function interactiveAuditFix(auditReport) {
                 flatChoices.push({
                     name: choice.message,
                     value: choice.value,
+                    // Same shape as the update prompt: `name` is the rendered table
+                    // row, but the post-submission line uses `short` per choice.
+                    // Without this, every selected row's full table dump is comma-
+                    // joined back to stdout.
+                    short: choice.value,
                 });
             }
         }

package/lib/sbom/sbom.d.ts

@@ -6,11 +6,14 @@ export type SbomCommandOptions = {
     lockfileOnly?: boolean;
     sbomAuthors?: string;
     sbomSupplier?: string;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
+    out?: string;
+    split?: boolean;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjectsGraph' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
+export declare const recursiveByDefault = true;
 export declare function help(): string;
 export declare function handler(opts: SbomCommandOptions, _params?: string[]): Promise<{
     output: string;

package/lib/sbom/sbom.js

@@ -1,13 +1,16 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { FILTERING } from '@pnpm/cli.common-cli-options-help';
 import { packageManager } from '@pnpm/cli.meta';
 import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { isSpdxLicenseExpression, resolveLicenseFromDir } from '@pnpm/deps.compliance.license-resolver';
-import { collectSbomComponents, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
+import { collectSbomComponents, resolveWorkspaceDeps, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
 import { PnpmError } from '@pnpm/error';
 import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { getStorePath } from '@pnpm/store.path';
+import pLimit from 'p-limit';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 export function rcOptionsTypes() {
@@ -22,12 +25,15 @@ export const cliOptionsTypes = () => ({
     'sbom-authors': String,
     'sbom-supplier': String,
     'lockfile-only': Boolean,
+    out: String,
+    split: Boolean,
 });
 export const shorthands = {
     D: '--dev',
     P: '--production',
 };
 export const commandNames = ['sbom'];
+export const recursiveByDefault = true;
 export function help() {
     return renderHelp({
         description: 'Generate a Software Bill of Materials (SBOM) for the project.',
@@ -73,6 +79,14 @@ export function help() {
                         description: 'Don\'t include "optionalDependencies"',
                         name: '--no-optional',
                     },
+                    {
+                        description: 'Write SBOM to a file instead of stdout. Use %s for the package name and %v for the version.',
+                        name: '--out <path>',
+                    },
+                    {
+                        description: 'Generate a separate SBOM for each matched workspace package. Outputs NDJSON to stdout, or files when combined with --out.',
+                        name: '--split',
+                    },
                 ],
             },
             FILTERING,
@@ -83,6 +97,9 @@ export function help() {
             'pnpm sbom --sbom-format spdx',
             'pnpm sbom --sbom-format cyclonedx --lockfile-only',
             'pnpm sbom --sbom-format spdx --prod',
+            'pnpm sbom --sbom-format cyclonedx --filter ./apps/my-app',
+            'pnpm sbom --sbom-format cyclonedx --out out/%s.cdx.json',
+            'pnpm sbom --sbom-format cyclonedx --split',
         ],
     });
 }
@@ -96,73 +113,179 @@ export async function handler(opts, _params = []) {
     }
     const sbomType = validateSbomType(opts.sbomType);
     const sbomSpecVersion = validateSbomSpecVersion(opts.sbomSpecVersion, format);
+    const ctx = await buildSharedContext(opts);
+    const serialOpts = { format, sbomType, sbomSpecVersion };
+    // `%s` in --out only implies per-package output inside a workspace; in a
+    // single-project repo it is interpolated from the root component on the
+    // single-output path below.
+    const hasWorkspaceGraph = opts.selectedProjectsGraph != null || opts.allProjectsGraph != null;
+    const shouldSplit = opts.split || (opts.out != null && opts.out.includes('%s') && hasWorkspaceGraph);
+    if (shouldSplit) {
+        return handleSplit(opts, serialOpts, ctx);
+    }
+    const { output, rootName, rootVersion } = await generateSbomForProject(opts, serialOpts, ctx);
+    if (opts.out) {
+        const filePath = opts.out
+            .replaceAll('%s', sanitizePathSegment(sanitizePackageName(rootName)))
+            .replaceAll('%v', sanitizePathSegment(rootVersion));
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, output);
+        return { output: filePath, exitCode: 0 };
+    }
+    return { output, exitCode: 0 };
+}
+async function handleSplit(opts, serialOpts, ctx) {
+    const projectsGraph = opts.selectedProjectsGraph ?? opts.allProjectsGraph;
+    if (!projectsGraph) {
+        throw new PnpmError('SBOM_NO_PROJECTS', 'No workspace projects found. --split requires a workspace.');
+    }
+    if (opts.out && !opts.out.includes('%s')) {
+        throw new PnpmError('SBOM_OUT_MISSING_PLACEHOLDER', 'When using --split with --out, the path must contain %s as a placeholder for the package name.');
+    }
+    const entries = Object.entries(projectsGraph);
+    const ndjsonLines = [];
+    const files = [];
+    const writtenPaths = new Set();
+    const compact = !opts.out;
+    const createdDirs = new Set();
+    for (const [dir, entry] of entries) {
+        const manifest = entry.package.manifest;
+        if (!manifest.name)
+            continue;
+        const singleProjectGraph = { [dir]: entry };
+        // eslint-disable-next-line no-await-in-loop
+        const { output } = await generateSbomForProject({ ...opts, selectedProjectsGraph: singleProjectGraph, allProjectsGraph: undefined, split: false, out: undefined }, serialOpts, ctx, compact);
+        if (opts.out) {
+            const filePath = opts.out
+                .replaceAll('%s', sanitizePathSegment(sanitizePackageName(manifest.name)))
+                .replaceAll('%v', sanitizePathSegment(manifest.version ?? '0.0.0'));
+            // Sanitizing package names is lossy (e.g. "@a/b" and "a-b" both map to "a-b"),
+            // so two packages can resolve to the same path. Fail loudly instead of letting
+            // one SBOM silently overwrite another.
+            if (writtenPaths.has(filePath)) {
+                throw new PnpmError('SBOM_OUT_PATH_COLLISION', `Multiple workspace packages resolve to the same output path "${filePath}". Include %v in the --out pattern to disambiguate.`);
+            }
+            writtenPaths.add(filePath);
+            const fileDir = path.dirname(filePath);
+            if (!createdDirs.has(fileDir)) {
+                fs.mkdirSync(fileDir, { recursive: true });
+                createdDirs.add(fileDir);
+            }
+            fs.writeFileSync(filePath, output);
+            files.push(filePath);
+        }
+        else {
+            ndjsonLines.push(output);
+        }
+    }
+    if (opts.out) {
+        return {
+            output: `Generated ${files.length} SBOMs:\n${files.map((f) => `  ${f}`).join('\n')}`,
+            exitCode: 0,
+        };
+    }
+    return { output: ndjsonLines.join('\n'), exitCode: 0 };
+}
+async function buildSharedContext(opts) {
     const lockfile = await readWantedLockfile(opts.lockfileDir ?? opts.dir, {
         ignoreIncompatible: true,
     });
     if (lockfile == null) {
         throw new PnpmError('SBOM_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot generate SBOM without a lockfile`);
     }
+    const rootManifestDir = opts.rootProjectManifestDir ?? opts.dir;
+    const rootManifest = opts.rootProjectManifest ?? await readProjectManifestOnly(rootManifestDir);
+    let storeDir;
+    if (!opts.lockfileOnly) {
+        storeDir = await getStorePath({
+            pkgRoot: opts.dir,
+            storePath: opts.storeDir,
+            pnpmHomeDir: opts.pnpmHomeDir,
+        });
+    }
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    const workspaceManifestsByImporterId = new Map();
+    for (const graph of [opts.allProjectsGraph, opts.selectedProjectsGraph]) {
+        if (!graph)
+            continue;
+        for (const [dir, entry] of Object.entries(graph)) {
+            workspaceManifestsByImporterId.set(getLockfileImporterId(lockfileDir, dir), entry.package.manifest);
+        }
+    }
+    const rootLicense = await resolveRootLicense(rootManifest, rootManifestDir);
+    return { lockfile, rootManifest, rootManifestDir, rootLicense, storeDir, workspaceManifestsByImporterId };
+}
+async function generateSbomForProject(opts, serialOpts, ctx, compact) {
+    const { lockfile, rootManifest, rootManifestDir, rootLicense: cachedRootLicense } = ctx;
     const include = {
         dependencies: opts.production !== false,
         devDependencies: opts.dev !== false,
         optionalDependencies: opts.optional !== false,
     };
-    const manifest = await readProjectManifestOnly(opts.dir);
+    const selectedEntries = opts.selectedProjectsGraph
+        ? Object.entries(opts.selectedProjectsGraph)
+        : undefined;
+    const singleProject = selectedEntries?.length === 1
+        ? selectedEntries[0]
+        : undefined;
+    const manifest = singleProject
+        ? singleProject[1].package.manifest
+        : rootManifest;
+    const projectDir = singleProject
+        ? singleProject[0]
+        : rootManifestDir;
     const rootName = manifest.name ?? 'unknown';
     const rootVersion = manifest.version ?? '0.0.0';
-    // Keep the root in sync with transitive deps: consult manifest `license` /
-    // legacy `licenses` first, then fall back to an on-disk LICENSE file. Drop
-    // file-scanned values that aren't SPDX-valid to avoid non-compliant output.
-    const rootLicenseInfo = await resolveLicenseFromDir({ manifest, dir: opts.dir });
-    const rootLicense = rootLicenseInfo && rootLicenseInfo.name !== 'Unknown' &&
-        (!rootLicenseInfo.licenseFile || isSpdxLicenseExpression(rootLicenseInfo.name))
-        ? rootLicenseInfo.name
-        : undefined;
-    const rootAuthor = typeof manifest.author === 'string'
-        ? manifest.author
-        : manifest.author?.name;
-    const rootRepository = typeof manifest.repository === 'string'
-        ? manifest.repository
-        : manifest.repository?.url;
+    const rootLicense = singleProject
+        ? (await resolveRootLicense(manifest, projectDir) ?? cachedRootLicense)
+        : cachedRootLicense;
+    const rootAuthor = extractAuthor(manifest)
+        ?? (singleProject ? extractAuthor(rootManifest) : undefined);
+    const rootRepository = extractRepository(manifest)
+        ?? (singleProject ? extractRepository(rootManifest) : undefined);
+    const rootDescription = manifest.description
+        ?? (singleProject ? rootManifest.description : undefined);
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
     const includedImporterIds = opts.selectedProjectsGraph
         ? Object.keys(opts.selectedProjectsGraph)
-            .map((p) => getLockfileImporterId(opts.lockfileDir ?? opts.dir, p))
+            .map((p) => getLockfileImporterId(lockfileDir, p))
+        : undefined;
+    const resolvedWorkspaceDeps = opts.lockfileOnly
+        ? undefined
+        : resolveWorkspaceDeps(lockfile, includedImporterIds ?? Object.keys(lockfile.importers), include);
+    const workspacePackages = resolvedWorkspaceDeps
+        ? await buildWorkspacePackagesMap(resolvedWorkspaceDeps.additionalImporterIds, lockfileDir, ctx.workspaceManifestsByImporterId)
         : undefined;
-    let storeDir;
-    if (!opts.lockfileOnly) {
-        storeDir = await getStorePath({
-            pkgRoot: opts.dir,
-            storePath: opts.storeDir,
-            pnpmHomeDir: opts.pnpmHomeDir,
-        });
-    }
     const result = await collectSbomComponents({
         lockfile,
         rootName,
         rootVersion,
         rootLicense,
-        rootDescription: manifest.description,
+        rootDescription,
         rootAuthor,
         rootRepository,
-        sbomType,
+        sbomType: serialOpts.sbomType,
         include,
         registries: opts.registries,
-        lockfileDir: opts.lockfileDir ?? opts.dir,
+        lockfileDir,
         includedImporterIds,
         lockfileOnly: opts.lockfileOnly,
-        storeDir,
+        storeDir: ctx.storeDir,
         virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+        workspacePackages,
+        resolvedWorkspaceDeps,
     });
-    const output = format === 'cyclonedx'
+    const output = serialOpts.format === 'cyclonedx'
         ? serializeCycloneDx(result, {
             pnpmVersion: packageManager.version,
             lockfileOnly: opts.lockfileOnly,
             sbomAuthors: opts.sbomAuthors?.split(',').map((s) => s.trim()).filter(Boolean),
             sbomSupplier: opts.sbomSupplier,
-            specVersion: sbomSpecVersion,
+            specVersion: serialOpts.sbomSpecVersion,
+            compact,
         })
-        : serializeSpdx(result);
-    return { output, exitCode: 0 };
+        : serializeSpdx(result, { compact });
+    return { output, exitCode: 0, rootName, rootVersion };
 }
 function validateSbomType(value) {
     if (!value || value === 'library')
@@ -171,8 +294,6 @@ function validateSbomType(value) {
         return 'application';
     throw new PnpmError('SBOM_INVALID_TYPE', `Invalid SBOM type "${value}". Use "library" or "application".`);
 }
-// Versions whose schema is fully covered by what we currently emit
-// (e.g. metadata.lifecycles requires CycloneDX 1.5+).
 const SUPPORTED_CYCLONEDX_SPEC_VERSIONS = ['1.5', '1.6', '1.7'];
 function validateSbomSpecVersion(value, format) {
     if (value == null)
@@ -186,4 +307,76 @@ function validateSbomSpecVersion(value, format) {
     }
     return normalized;
 }
+async function resolveRootLicense(manifest, dir) {
+    // Skip the on-disk LICENSE probing when the manifest already declares a usable
+    // SPDX license; resolveLicenseFromDir would return the same value after the scan.
+    if (typeof manifest.license === 'string' && isSpdxLicenseExpression(manifest.license)) {
+        return manifest.license;
+    }
+    const info = await resolveLicenseFromDir({ manifest, dir });
+    if (info && info.name !== 'Unknown' && (!info.licenseFile || isSpdxLicenseExpression(info.name))) {
+        return info.name;
+    }
+    return undefined;
+}
+function extractAuthor(manifest) {
+    if (typeof manifest.author === 'string')
+        return manifest.author;
+    return manifest.author?.name;
+}
+function extractRepository(manifest) {
+    if (typeof manifest.repository === 'string')
+        return manifest.repository;
+    return manifest.repository?.url;
+}
+const WORKSPACE_MANIFEST_READ_CONCURRENCY = 8;
+async function buildWorkspacePackagesMap(reachableImporterIds, lockfileDir, manifestsByImporterId) {
+    if (reachableImporterIds.length === 0)
+        return {};
+    const readManifest = pLimit(WORKSPACE_MANIFEST_READ_CONCURRENCY);
+    const entries = await Promise.all(reachableImporterIds.map((importerId) => readManifest(async () => {
+        const known = manifestsByImporterId.get(importerId);
+        const manifest = known
+            ? known
+            : isInsideDir(lockfileDir, importerId)
+                ? await readManifestSafe(path.join(lockfileDir, importerId))
+                : undefined;
+        if (!manifest?.name)
+            return null;
+        return [importerId, {
+                name: manifest.name,
+                version: manifest.version ?? '0.0.0',
+                license: typeof manifest.license === 'string' ? manifest.license : undefined,
+                description: manifest.description,
+                author: extractAuthor(manifest),
+                repository: extractRepository(manifest),
+            }];
+    })));
+    return Object.fromEntries(entries.filter((e) => e !== null));
+}
+async function readManifestSafe(dir) {
+    try {
+        return await readProjectManifestOnly(dir);
+    }
+    catch {
+        return undefined;
+    }
+}
+function sanitizePackageName(name) {
+    return name.replace(/^@/, '').replace(/\//g, '-');
+}
+function sanitizePathSegment(value) {
+    // Control characters (e.g. newlines) would produce confusing filenames and could
+    // inject extra lines into the printed `--split --out` summary; filesystem
+    // metacharacters are replaced so the value stays a single path segment.
+    // eslint-disable-next-line no-control-regex
+    const sanitized = value.replace(/[/\\:*?"<>|\x00-\x1F\x7F]/g, '-');
+    // `.`, `..`, or a blank value would let a crafted name/version escape or replace
+    // the intended output directory once interpolated into an `--out` template.
+    return sanitized === '.' || sanitized === '..' || sanitized.trim() === '' ? '-' : sanitized;
+}
+function isInsideDir(parentDir, childRelativePath) {
+    const rel = path.relative(parentDir, path.resolve(parentDir, childRelativePath));
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
 //# sourceMappingURL=sbom.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1101.3.4",
+  "version": "1101.4.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -33,56 +33,56 @@
     "@inquirer/prompts": "^8.4.3",
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.2",
-    "memoize": "^10.2.0",
+    "memoize": "^11.0.0",
+    "p-limit": "^7.3.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/config.reader": "1101.8.0",
-    "@pnpm/cli.utils": "1101.0.11",
     "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/cli.meta": "1100.0.7",
-    "@pnpm/config.writer": "1100.0.12",
-    "@pnpm/deps.compliance.audit": "1101.0.15",
-    "@pnpm/deps.security.signatures": "1101.2.1",
-    "@pnpm/installing.commands": "1100.8.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.18",
-    "@pnpm/lockfile.walker": "1100.0.10",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/object.key-sorting": "1100.0.0",
-    "@pnpm/store.path": "1100.0.1",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.12",
+    "@pnpm/cli.meta": "1100.0.8",
+    "@pnpm/config.reader": "1101.10.0",
+    "@pnpm/config.writer": "1100.0.13",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/deps.compliance.sbom": "1100.1.8"
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.compliance.audit": "1101.0.17",
+    "@pnpm/cli.utils": "1101.0.12",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.20",
+    "@pnpm/deps.security.signatures": "1101.2.2",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/deps.compliance.sbom": "1100.2.0",
+    "@pnpm/installing.commands": "1100.10.0",
+    "@pnpm/lockfile.fs": "1100.1.6",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/lockfile.walker": "1100.0.11",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/object.key-sorting": "1100.0.1",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/store.path": "1100.0.1"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@types/zkochan__table": "npm:@types/table@6.0.0",
+    "@types/zkochan__table": "npm:@types/table@6.3.2",
     "load-json-file": "^7.0.1",
-    "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/deps.compliance.commands": "1101.3.4",
-    "@pnpm/prepare": "1100.0.15",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.5",
-    "@pnpm/testing.command-defaults": "1100.0.5",
-    "@pnpm/workspace.projects-filter": "1100.0.20",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.2"
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/deps.compliance.commands": "1101.4.0",
+    "@pnpm/prepare": "1100.0.16",
+    "@pnpm/testing.command-defaults": "1100.0.6",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/workspace.projects-filter": "1100.0.22",
+    "@pnpm/testing.mock-agent": "1101.0.3"
   },
   "engines": {
     "node": ">=22.13"