@pnpm/deps.compliance.sbom 1100.1.9 → 1100.3.0

package/lib/collectComponents.d.ts

@@ -2,6 +2,14 @@ import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { Resolution } from '@pnpm/resolving.resolver-base';
 import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
 import type { SbomComponentType, SbomResult } from './types.js';
+export interface WorkspacePackageInfo {
+    name: string;
+    version: string;
+    license?: string;
+    description?: string;
+    author?: string;
+    repository?: string;
+}
 export interface CollectSbomComponentsOptions {
     lockfile: LockfileObject;
     rootName: string;
@@ -10,6 +18,7 @@ export interface CollectSbomComponentsOptions {
     rootDescription?: string;
     rootAuthor?: string;
     rootRepository?: string;
+    rootBugsUrl?: string;
     sbomType?: SbomComponentType;
     include?: {
         [dependenciesField in DependenciesField]: boolean;
@@ -20,6 +29,22 @@ export interface CollectSbomComponentsOptions {
     lockfileOnly?: boolean;
     storeDir?: string;
     virtualStoreDirMaxLength?: number;
+    workspacePackages?: Record<ProjectId, WorkspacePackageInfo>;
+    resolvedWorkspaceDeps?: ReturnType<typeof resolveWorkspaceDeps>;
+    excludePeerNamesByImporter?: Map<string, Set<string>>;
 }
 export declare function collectSbomComponents(opts: CollectSbomComponentsOptions): Promise<SbomResult>;
 export declare function gitDownloadUrl(resolution: Resolution): string | undefined;
+interface WorkspaceLink {
+    sourceImporterId: ProjectId;
+    targetImporterId: ProjectId;
+    depName: string;
+    devOnly: boolean;
+}
+export declare function resolveWorkspaceDeps(lockfile: LockfileObject, importerIds: ProjectId[], include?: {
+    [dependenciesField in DependenciesField]: boolean;
+}): {
+    links: WorkspaceLink[];
+    additionalImporterIds: ProjectId[];
+};
+export {};

package/lib/collectComponents.js

@@ -1,16 +1,75 @@
+import path from 'node:path';
 import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
 import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
 import { lockfileWalkerGroupImporterSteps, } from '@pnpm/lockfile.walker';
 import { StoreIndex } from '@pnpm/store.index';
+import pLimit from 'p-limit';
 import { getPkgMetadata } from './getPkgMetadata.js';
 import { buildPurl, encodePurlName } from './purl.js';
+const IMPORTER_WALK_CONCURRENCY = 8;
 export async function collectSbomComponents(opts) {
     const depTypes = detectDepTypes(opts.lockfile);
     const importerIds = opts.includedImporterIds ?? Object.keys(opts.lockfile.importers);
-    const importerWalkers = lockfileWalkerGroupImporterSteps(opts.lockfile, importerIds, { include: opts.include });
     const componentsMap = new Map();
     const relationships = [];
     const rootPurl = `pkg:npm/${encodePurlName(opts.rootName)}@${opts.rootVersion}`;
+    const workspaceDeps = opts.resolvedWorkspaceDeps
+        ?? (opts.lockfileOnly
+            ? { links: [], additionalImporterIds: [] }
+            : resolveWorkspaceDeps(opts.lockfile, importerIds, opts.include));
+    const allImporterIds = [...importerIds, ...workspaceDeps.additionalImporterIds];
+    // When excluding peers, walk each importer with its own `walked` set so one
+    // importer's peer can't suppress another's real dependency.
+    const importerWalkers = opts.excludePeerNamesByImporter
+        ? allImporterIds.flatMap((importerId) => lockfileWalkerGroupImporterSteps(opts.lockfile, [importerId], { include: opts.include }))
+        : lockfileWalkerGroupImporterSteps(opts.lockfile, allImporterIds, { include: opts.include });
+    const importerIdSet = new Set(importerIds);
+    if (opts.workspacePackages) {
+        const workspaceDepTypes = new Map();
+        for (const dep of workspaceDeps.links) {
+            const info = opts.workspacePackages[dep.targetImporterId];
+            if (!info)
+                continue;
+            const purl = buildPurl({ name: info.name, version: info.version });
+            const current = workspaceDepTypes.get(purl);
+            if (!dep.devOnly) {
+                workspaceDepTypes.set(purl, DepType.ProdOnly);
+            }
+            else if (current === undefined) {
+                workspaceDepTypes.set(purl, DepType.DevOnly);
+            }
+        }
+        for (const dep of workspaceDeps.links) {
+            const info = opts.workspacePackages[dep.targetImporterId];
+            if (!info)
+                continue;
+            const purl = buildPurl({ name: info.name, version: info.version });
+            let parentPurl;
+            if (importerIdSet.has(dep.sourceImporterId)) {
+                parentPurl = rootPurl;
+            }
+            else {
+                const sourceInfo = opts.workspacePackages[dep.sourceImporterId];
+                parentPurl = sourceInfo
+                    ? buildPurl({ name: sourceInfo.name, version: sourceInfo.version })
+                    : rootPurl;
+            }
+            relationships.push({ from: parentPurl, to: purl });
+            if (!componentsMap.has(purl)) {
+                componentsMap.set(purl, {
+                    name: info.name,
+                    version: info.version,
+                    purl,
+                    depPath: `link:${dep.targetImporterId}`,
+                    depType: workspaceDepTypes.get(purl) ?? DepType.ProdOnly,
+                    license: info.license,
+                    description: info.description,
+                    author: info.author,
+                    repository: info.repository,
+                });
+            }
+        }
+    }
     const storeIndex = (!opts.lockfileOnly && opts.storeDir)
         ? new StoreIndex(opts.storeDir)
         : undefined;
@@ -22,9 +81,33 @@ export async function collectSbomComponents(opts) {
             virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength ?? 120,
         }
         : undefined;
-    await Promise.all(importerWalkers.map(async ({ step }) => {
-        await walkStep(step, rootPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
-    }));
+    const walkImporter = pLimit(IMPORTER_WALK_CONCURRENCY);
+    await Promise.all(importerWalkers.map(({ importerId, step }) => walkImporter(async () => {
+        let parentPurl = rootPurl;
+        if (!importerIdSet.has(importerId)) {
+            const info = opts.workspacePackages?.[importerId];
+            // A reachable workspace importer with no resolved package info (e.g. its
+            // manifest could not be read) is skipped entirely; walking it would
+            // misattribute its dependencies to the root component.
+            if (!info)
+                return;
+            parentPurl = buildPurl({ name: info.name, version: info.version });
+        }
+        // Drop this importer's peer entries before walking. With the per-importer
+        // walk above, this prunes a peer's exclusive subtree without hiding a
+        // package that is also a real dependency here or in another importer.
+        const peerNames = opts.excludePeerNamesByImporter?.get(importerId);
+        const filteredStep = (peerNames?.size)
+            ? {
+                ...step,
+                dependencies: step.dependencies.filter((dep) => {
+                    const { name } = nameVerFromPkgSnapshot(dep.depPath, dep.pkgSnapshot);
+                    return !name || !peerNames.has(name);
+                }),
+            }
+            : step;
+        await walkStep(filteredStep, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
+    })));
     storeIndex?.close();
     return {
         rootComponent: {
@@ -35,6 +118,7 @@ export async function collectSbomComponents(opts) {
             description: opts.rootDescription,
             author: opts.rootAuthor,
             repository: opts.rootRepository,
+            bugsUrl: opts.rootBugsUrl,
         },
         components: Array.from(componentsMap.values()),
         relationships,
@@ -79,4 +163,47 @@ export function gitDownloadUrl(resolution) {
     const prefix = needsGitPlusPrefix ? 'git+' : '';
     return `${prefix}${resolution.repo}#${resolution.commit}`;
 }
+export function resolveWorkspaceDeps(lockfile, importerIds, include) {
+    const links = [];
+    const visited = new Set(importerIds);
+    const queue = [...importerIds];
+    const additionalImporterIds = [];
+    for (let head = 0; head < queue.length; head++) {
+        const importerId = queue[head];
+        const snapshot = lockfile.importers[importerId];
+        if (!snapshot)
+            continue;
+        const devDepNames = new Set(Object.keys(snapshot.devDependencies ?? {}));
+        const prodDeps = {
+            ...(include?.dependencies !== false ? snapshot.dependencies : {}),
+            ...(include?.optionalDependencies !== false ? snapshot.optionalDependencies : {}),
+        };
+        const allDeps = {
+            ...prodDeps,
+            ...(include?.devDependencies !== false ? snapshot.devDependencies : {}),
+        };
+        for (const [depName, reference] of Object.entries(allDeps)) {
+            if (!reference.startsWith('link:'))
+                continue;
+            const linkPath = reference.slice(5);
+            const targetId = path.posix.normalize(importerId === '.' ? linkPath : path.posix.join(importerId, linkPath));
+            // A crafted lockfile can point a `link:` target outside the workspace root;
+            // such importer IDs must never be followed, as they later become filesystem reads.
+            if (path.posix.isAbsolute(targetId) || targetId === '..' || targetId.startsWith('../'))
+                continue;
+            // `in` would also match inherited keys (e.g. "toString"); a crafted lockfile
+            // must not be able to enqueue importer IDs that are not actually present.
+            if (!Object.prototype.hasOwnProperty.call(lockfile.importers, targetId))
+                continue;
+            const devOnly = devDepNames.has(depName) && !(depName in prodDeps);
+            links.push({ sourceImporterId: importerId, targetImporterId: targetId, depName, devOnly });
+            if (!visited.has(targetId)) {
+                visited.add(targetId);
+                additionalImporterIds.push(targetId);
+                queue.push(targetId);
+            }
+        }
+    }
+    return { links, additionalImporterIds };
+}
 //# sourceMappingURL=collectComponents.js.map

package/lib/getPkgMetadata.d.ts

@@ -7,6 +7,7 @@ export interface PkgMetadata {
     author?: string;
     homepage?: string;
     repository?: string;
+    bugsUrl?: string;
 }
 export interface GetPkgMetadataOptions {
     storeDir: string;
@@ -15,3 +16,4 @@ export interface GetPkgMetadataOptions {
     virtualStoreDirMaxLength: number;
 }
 export declare function getPkgMetadata(depPath: DepPath, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;
+export declare function bugsUrlFromField(field: unknown): string | undefined;

package/lib/getPkgMetadata.js

@@ -34,6 +34,7 @@ async function extractMetadata(manifest, files) {
         author: parseAuthorField(manifest.author),
         homepage: manifest.homepage,
         repository: parseRepositoryField(manifest.repository),
+        bugsUrl: bugsUrlFromField(manifest.bugs),
     };
 }
 // Drop:
@@ -68,4 +69,41 @@ function parseRepositoryField(field) {
     }
     return undefined;
 }
+// `bugs` may be a URL string, a bare email, or `{ url, email }`. The CycloneDX
+// issue-tracker reference expects a URL, so parse the candidate and keep it only
+// when it is a well-formed http(s) URL — dropping email-only bug contacts and
+// malformed values like "https://". Exported so the command's root-package
+// handling uses the same rule.
+export function bugsUrlFromField(field) {
+    let candidate;
+    if (typeof field === 'string') {
+        candidate = field.trim();
+    }
+    else if (field && typeof field === 'object' && 'url' in field) {
+        const value = field.url;
+        if (typeof value === 'string')
+            candidate = value.trim();
+    }
+    if (!candidate)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(candidate);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return undefined;
+    // Drop any embedded credentials: an SBOM is a shareable/published artifact,
+    // so a `bugs` URL like `https://user:token@tracker/...` must not leak the
+    // secret into externalReferences[].url. The tracker URL itself is still useful.
+    parsed.username = '';
+    parsed.password = '';
+    // Emit the normalized URL, not the raw input: `new URL` strips CR/LF/tab and
+    // percent-encodes spaces and control characters, so a crafted `bugs` value
+    // can't push raw whitespace or control chars into the CycloneDX
+    // `externalReferences[].url` (whose format is an `iri-reference`).
+    return parsed.href;
+}
 //# sourceMappingURL=getPkgMetadata.js.map

package/lib/index.d.ts

@@ -1,4 +1,5 @@
-export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl } from './collectComponents.js';
+export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl, resolveWorkspaceDeps, type WorkspacePackageInfo } from './collectComponents.js';
+export { bugsUrlFromField } from './getPkgMetadata.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { type CycloneDxOptions, serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/index.js

@@ -1,4 +1,5 @@
-export { collectSbomComponents, gitDownloadUrl } from './collectComponents.js';
+export { collectSbomComponents, gitDownloadUrl, resolveWorkspaceDeps } from './collectComponents.js';
+export { bugsUrlFromField } from './getPkgMetadata.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/serializeCycloneDx.d.ts

@@ -5,5 +5,6 @@ export interface CycloneDxOptions {
     sbomAuthors?: string[];
     sbomSupplier?: string;
     specVersion?: string;
+    compact?: boolean;
 }
 export declare function serializeCycloneDx(result: SbomResult, opts?: CycloneDxOptions): string;

package/lib/serializeCycloneDx.js

@@ -1,4 +1,5 @@
 import crypto from 'node:crypto';
+import { DepType } from '@pnpm/lockfile.detect-dep-types';
 import { integrityToHashes } from './integrity.js';
 import { classifyLicense } from './license.js';
 import { encodePurlName } from './purl.js';
@@ -14,6 +15,19 @@ export function serializeCycloneDx(result, opts) {
             purl: comp.purl,
             'bom-ref': comp.purl,
         };
+        // CycloneDX `excluded` scope (valid in every exported spec version):
+        // "component usage for test and other non-runtime purposes", which is the
+        // semantics of a devDependency.
+        // Components reachable through prod (ProdOnly/DevAndProd) omit scope and
+        // default to `required`. Installed optionalDependencies are runtime-reachable,
+        // so they stay `required` too, not `optional`.
+        if (comp.depType === DepType.DevOnly) {
+            cdxComp.scope = 'excluded';
+            // Also emit the CycloneDX npm-taxonomy marker. `scope` is the modern
+            // signal; `cdx:npm:package:development` is what @cyclonedx/cyclonedx-npm
+            // emits and what older consumers read, so we provide both.
+            cdxComp.properties = [{ name: 'cdx:npm:package:development', value: 'true' }];
+        }
         if (group) {
             cdxComp.group = group;
         }
@@ -56,6 +70,12 @@ export function serializeCycloneDx(result, opts) {
                 url: comp.repository,
             });
         }
+        if (comp.bugsUrl) {
+            externalRefs.push({
+                type: 'issue-tracker',
+                url: comp.bugsUrl,
+            });
+        }
         if (externalRefs.length > 0) {
             cdxComp.externalReferences = externalRefs;
         }
@@ -97,11 +117,15 @@ export function serializeCycloneDx(result, opts) {
     if (rootComponent.description) {
         rootCdxComponent.description = rootComponent.description;
     }
+    const rootExternalRefs = [];
     if (rootComponent.repository) {
-        rootCdxComponent.externalReferences = [{
-                type: 'vcs',
-                url: rootComponent.repository,
-            }];
+        rootExternalRefs.push({ type: 'vcs', url: rootComponent.repository });
+    }
+    if (rootComponent.bugsUrl) {
+        rootExternalRefs.push({ type: 'issue-tracker', url: rootComponent.bugsUrl });
+    }
+    if (rootExternalRefs.length > 0) {
+        rootCdxComponent.externalReferences = rootExternalRefs;
     }
     const toolComponents = [];
     if (opts?.pnpmVersion) {
@@ -136,7 +160,7 @@ export function serializeCycloneDx(result, opts) {
         components: bomComponents,
         dependencies: bomDependencies,
     };
-    return JSON.stringify(bom, null, 2);
+    return JSON.stringify(bom, null, opts?.compact ? undefined : 2);
 }
 function splitScopedName(fullName) {
     if (fullName.startsWith('@')) {

package/lib/serializeSpdx.d.ts

@@ -1,2 +1,5 @@
 import type { SbomResult } from './types.js';
-export declare function serializeSpdx(result: SbomResult): string;
+export interface SpdxOptions {
+    compact?: boolean;
+}
+export declare function serializeSpdx(result: SbomResult, opts?: SpdxOptions): string;

package/lib/serializeSpdx.js

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto';
 import { integrityToHashes } from './integrity.js';
 import { encodePurlName } from './purl.js';
-export function serializeSpdx(result) {
+export function serializeSpdx(result, opts) {
     const { rootComponent, components, relationships } = result;
     const rootSpdxId = 'SPDXRef-RootPackage';
     const documentNamespace = `https://spdx.org/spdxdocs/${sanitizeSpdxId(rootComponent.name)}-${rootComponent.version}-${crypto.randomUUID()}`;
@@ -123,7 +123,7 @@ export function serializeSpdx(result) {
         packages: [rootPackage, ...spdxPackages],
         relationships: spdxRelationships,
     };
-    return JSON.stringify(doc, null, 2);
+    return JSON.stringify(doc, null, opts?.compact ? undefined : 2);
 }
 function sanitizeSpdxId(value) {
     return value.replace(/[^a-z0-9.-]/gi, '-');

package/lib/types.d.ts

@@ -12,6 +12,7 @@ export interface SbomComponent {
     author?: string;
     homepage?: string;
     repository?: string;
+    bugsUrl?: string;
 }
 export interface SbomRelationship {
     from: string;
@@ -26,6 +27,7 @@ export interface SbomResult {
         description?: string;
         author?: string;
         repository?: string;
+        bugsUrl?: string;
     };
     components: SbomComponent[];
     relationships: SbomRelationship[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.1.9",
+  "version": "1100.3.0",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -13,9 +13,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/sbom"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/sbom#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -34,14 +34,14 @@
     "p-limit": "^7.3.0",
     "ssri": "13.0.1",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.11",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/store.index": "1100.2.0",
-    "@pnpm/store.pkg-finder": "1100.0.17",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.12",
+    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/lockfile.utils": "1100.1.0",
+    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/resolving.resolver-base": "1100.5.0",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/store.pkg-finder": "1100.0.18",
     "@pnpm/types": "1101.3.2"
   },
   "peerDependencies": {
@@ -50,9 +50,9 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@types/ssri": "^7.1.5",
-    "@pnpm/deps.compliance.sbom": "1100.1.9",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.10"
+    "@pnpm/store.cafs": "1100.1.11",
+    "@pnpm/deps.compliance.sbom": "1100.3.0"
   },
   "engines": {
     "node": ">=22.13"