@pnpm/deps.compliance.sbom 1100.0.2 → 1100.0.3

package/lib/getPkgMetadata.d.ts

@@ -1,6 +1,6 @@
 import { type PackageSnapshot } from '@pnpm/lockfile.utils';
 import type { StoreIndex } from '@pnpm/store.index';
-import type { Registries } from '@pnpm/types';
+import type { DepPath, Registries } from '@pnpm/types';
 export interface PkgMetadata {
     license?: string;
     description?: string;
@@ -14,4 +14,4 @@ export interface GetPkgMetadataOptions {
     lockfileDir: string;
     virtualStoreDirMaxLength: number;
 }
-export declare function getPkgMetadata(depPath: string, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;
+export declare function getPkgMetadata(depPath: DepPath, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;

package/lib/getPkgMetadata.js

@@ -1,4 +1,5 @@
-import { pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
+import { isSpdxLicenseExpression, resolveLicense } from '@pnpm/deps.compliance.license-resolver';
+import { packageIdFromSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
 import { readPackageJson } from '@pnpm/pkg-manifest.reader';
 import { readPackageFileMap } from '@pnpm/store.pkg-finder';
 import pLimit from 'p-limit';
@@ -7,7 +8,7 @@ export async function getPkgMetadata(depPath, snapshot, registries, opts) {
     return limitMetadataReads(() => getPkgMetadataUnclamped(depPath, snapshot, registries, opts));
 }
 async function getPkgMetadataUnclamped(depPath, snapshot, registries, opts) {
-    const id = snapshot.id ?? depPath;
+    const id = packageIdFromSnapshot(depPath, snapshot);
     const resolution = pkgSnapshotToResolution(depPath, snapshot, registries);
     let files;
     try {
@@ -23,30 +24,29 @@ async function getPkgMetadataUnclamped(depPath, snapshot, registries, opts) {
     if (!manifestPath)
         return {};
     const manifest = await readPackageJson(manifestPath);
-    return extractMetadata(manifest);
+    return extractMetadata(manifest, files);
 }
-function extractMetadata(manifest) {
+async function extractMetadata(manifest, files) {
+    const license = await resolveLicense({ manifest, files });
     return {
-        license: parseLicenseField(manifest.license),
+        license: serializableLicense(license),
         description: manifest.description,
         author: parseAuthorField(manifest.author),
         homepage: manifest.homepage,
         repository: parseRepositoryField(manifest.repository),
     };
 }
-function parseLicenseField(field) {
-    if (typeof field === 'string')
-        return field;
-    if (field && typeof field === 'object' && 'type' in field) {
-        return field.type;
-    }
-    if (Array.isArray(field)) {
-        return field
-            .map((l) => l.type)
-            .filter(Boolean)
-            .join(' OR ') || undefined;
-    }
-    return undefined;
+// Drop:
+//   - missing / "Unknown" — so serializers emit NOASSERTION / absence.
+//   - LICENSE-file-detected values that aren't SPDX-valid (e.g. "Eclipse Public
+//     License 1.0") — would produce non-compliant SPDX output. Manifest-declared
+//     licenses are trusted as-is; authors use SPDX expressions there.
+function serializableLicense(license) {
+    if (!license || license.name === 'Unknown')
+        return undefined;
+    if (license.licenseFile && !isSpdxLicenseExpression(license.name))
+        return undefined;
+    return license.name;
 }
 function parseAuthorField(field) {
     if (!field)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.0.2",
+  "version": "1100.0.3",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -30,14 +30,15 @@
     "@cyclonedx/cyclonedx-library": "10.0.0",
     "p-limit": "^7.1.0",
     "ssri": "13.0.1",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.1",
-    "@pnpm/lockfile.utils": "1100.0.1",
-    "@pnpm/lockfile.walker": "1100.0.1",
+    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.2",
+    "@pnpm/lockfile.utils": "1100.0.2",
+    "@pnpm/lockfile.walker": "1100.0.2",
+    "@pnpm/lockfile.types": "1100.0.2",
     "@pnpm/pkg-manifest.reader": "1100.0.1",
-    "@pnpm/store.index": "1100.0.0",
-    "@pnpm/store.pkg-finder": "1100.0.2",
-    "@pnpm/types": "1101.0.0"
+    "@pnpm/store.pkg-finder": "1100.0.3",
+    "@pnpm/types": "1101.0.0",
+    "@pnpm/store.index": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -45,8 +46,9 @@
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/ssri": "^7.1.5",
-    "@pnpm/deps.compliance.sbom": "1100.0.2",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/deps.compliance.sbom": "1100.0.3",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/store.cafs": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"