@pnpm/deps.compliance.sbom 1000.0.0-0 → 1100.0.1

package/lib/license.js

@@ -1,18 +1,23 @@
 // Sub-path import to pull only the SPDX module — avoids dragging in the
 // validation/serialize layers with optional native deps that break esbuild bundling.
-import { isSupportedSpdxId, isValidSpdxLicenseExpression } from '@cyclonedx/cyclonedx-library/SPDX';
+import { fixupSpdxId, isSupportedSpdxId } from '@cyclonedx/cyclonedx-library/SPDX';
 // Classifies a license string into the appropriate CycloneDX representation.
 // Uses the CycloneDX library's own SPDX list rather than spdx-license-ids,
 // since CycloneDX maintains its own subset of recognized IDs.
 // Order matters: check ID first because "MIT" matches both isSupportedSpdxId
-// and isValidSpdxLicenseExpression, but we prefer the more specific license.id form.
+// and isSpdxExpression, but we prefer the more specific license.id form.
 export function classifyLicense(license) {
-    if (isSupportedSpdxId(license)) {
-        return { license: { id: license } };
+    const fixedId = fixupSpdxId(license);
+    if (fixedId != null && isSupportedSpdxId(fixedId)) {
+        return { license: { id: fixedId } };
     }
-    if (isValidSpdxLicenseExpression(license)) {
+    if (isSpdxExpression(license)) {
         return { expression: license };
     }
     return { license: { name: license } };
 }
+// Checks if a string looks like an SPDX license expression (compound with operators).
+function isSpdxExpression(license) {
+    return /\b(?:AND|OR|WITH)\b/.test(license);
+}
 //# sourceMappingURL=license.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1000.0.0-0",
+  "version": "1100.0.1",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -27,26 +27,26 @@
     "!*.map"
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "9.4.1",
+    "@cyclonedx/cyclonedx-library": "10.0.0",
     "p-limit": "^7.1.0",
-    "ssri": "13.0.0",
-    "@pnpm/lockfile.detect-dep-types": "1001.0.16",
-    "@pnpm/lockfile.utils": "1003.0.3",
-    "@pnpm/lockfile.types": "1002.0.2",
-    "@pnpm/pkg-manifest.reader": "1000.1.2",
-    "@pnpm/types": "1000.9.0",
-    "@pnpm/lockfile.walker": "1001.0.16",
-    "@pnpm/store.index": "1000.0.0-0",
-    "@pnpm/store.pkg-finder": "1000.0.0-0"
+    "ssri": "13.0.1",
+    "@pnpm/lockfile.types": "1100.0.1",
+    "@pnpm/lockfile.utils": "1100.0.1",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.1",
+    "@pnpm/store.index": "1100.0.0",
+    "@pnpm/lockfile.walker": "1100.0.1",
+    "@pnpm/store.pkg-finder": "1100.0.1",
+    "@pnpm/types": "1101.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.0.5",
+    "@jest/globals": "30.3.0",
     "@types/ssri": "^7.1.5",
-    "@pnpm/deps.compliance.sbom": "1000.0.0-0",
-    "@pnpm/logger": "1001.0.1"
+    "@pnpm/deps.compliance.sbom": "1100.0.1",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"
@@ -55,9 +55,9 @@
     "preset": "@pnpm/jest-config"
   },
   "scripts": {
-    "test": "pnpm run compile && pnpm run _test",
+    "test": "pn compile && pn .test",
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
-    "compile": "tsgo --build && pnpm run lint --fix"
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }