@pnpm/deps.compliance.sbom 1100.2.0 → 1100.3.1

package/lib/collectComponents.d.ts

@@ -18,6 +18,7 @@ export interface CollectSbomComponentsOptions {
     rootDescription?: string;
     rootAuthor?: string;
     rootRepository?: string;
+    rootBugsUrl?: string;
     sbomType?: SbomComponentType;
     include?: {
         [dependenciesField in DependenciesField]: boolean;
@@ -30,6 +31,7 @@ export interface CollectSbomComponentsOptions {
     virtualStoreDirMaxLength?: number;
     workspacePackages?: Record<ProjectId, WorkspacePackageInfo>;
     resolvedWorkspaceDeps?: ReturnType<typeof resolveWorkspaceDeps>;
+    excludePeerNamesByImporter?: Map<string, Set<string>>;
 }
 export declare function collectSbomComponents(opts: CollectSbomComponentsOptions): Promise<SbomResult>;
 export declare function gitDownloadUrl(resolution: Resolution): string | undefined;

package/lib/collectComponents.js

@@ -18,7 +18,11 @@ export async function collectSbomComponents(opts) {
             ? { links: [], additionalImporterIds: [] }
             : resolveWorkspaceDeps(opts.lockfile, importerIds, opts.include));
     const allImporterIds = [...importerIds, ...workspaceDeps.additionalImporterIds];
-    const importerWalkers = lockfileWalkerGroupImporterSteps(opts.lockfile, allImporterIds, { include: opts.include });
+    // When excluding peers, walk each importer with its own `walked` set so one
+    // importer's peer can't suppress another's real dependency.
+    const importerWalkers = opts.excludePeerNamesByImporter
+        ? allImporterIds.flatMap((importerId) => lockfileWalkerGroupImporterSteps(opts.lockfile, [importerId], { include: opts.include }))
+        : lockfileWalkerGroupImporterSteps(opts.lockfile, allImporterIds, { include: opts.include });
     const importerIdSet = new Set(importerIds);
     if (opts.workspacePackages) {
         const workspaceDepTypes = new Map();
@@ -89,7 +93,20 @@ export async function collectSbomComponents(opts) {
                 return;
             parentPurl = buildPurl({ name: info.name, version: info.version });
         }
-        await walkStep(step, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
+        // Drop this importer's peer entries before walking. With the per-importer
+        // walk above, this prunes a peer's exclusive subtree without hiding a
+        // package that is also a real dependency here or in another importer.
+        const peerNames = opts.excludePeerNamesByImporter?.get(importerId);
+        const filteredStep = (peerNames?.size)
+            ? {
+                ...step,
+                dependencies: step.dependencies.filter((dep) => {
+                    const { name } = nameVerFromPkgSnapshot(dep.depPath, dep.pkgSnapshot);
+                    return !name || !peerNames.has(name);
+                }),
+            }
+            : step;
+        await walkStep(filteredStep, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
     })));
     storeIndex?.close();
     return {
@@ -101,6 +118,7 @@ export async function collectSbomComponents(opts) {
             description: opts.rootDescription,
             author: opts.rootAuthor,
             repository: opts.rootRepository,
+            bugsUrl: opts.rootBugsUrl,
         },
         components: Array.from(componentsMap.values()),
         relationships,

package/lib/getPkgMetadata.d.ts

@@ -7,6 +7,7 @@ export interface PkgMetadata {
     author?: string;
     homepage?: string;
     repository?: string;
+    bugsUrl?: string;
 }
 export interface GetPkgMetadataOptions {
     storeDir: string;
@@ -15,3 +16,4 @@ export interface GetPkgMetadataOptions {
     virtualStoreDirMaxLength: number;
 }
 export declare function getPkgMetadata(depPath: DepPath, snapshot: PackageSnapshot, registries: Registries, opts: GetPkgMetadataOptions): Promise<PkgMetadata>;
+export declare function bugsUrlFromField(field: unknown): string | undefined;

package/lib/getPkgMetadata.js

@@ -34,6 +34,7 @@ async function extractMetadata(manifest, files) {
         author: parseAuthorField(manifest.author),
         homepage: manifest.homepage,
         repository: parseRepositoryField(manifest.repository),
+        bugsUrl: bugsUrlFromField(manifest.bugs),
     };
 }
 // Drop:
@@ -68,4 +69,41 @@ function parseRepositoryField(field) {
     }
     return undefined;
 }
+// `bugs` may be a URL string, a bare email, or `{ url, email }`. The CycloneDX
+// issue-tracker reference expects a URL, so parse the candidate and keep it only
+// when it is a well-formed http(s) URL — dropping email-only bug contacts and
+// malformed values like "https://". Exported so the command's root-package
+// handling uses the same rule.
+export function bugsUrlFromField(field) {
+    let candidate;
+    if (typeof field === 'string') {
+        candidate = field.trim();
+    }
+    else if (field && typeof field === 'object' && 'url' in field) {
+        const value = field.url;
+        if (typeof value === 'string')
+            candidate = value.trim();
+    }
+    if (!candidate)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(candidate);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return undefined;
+    // Drop any embedded credentials: an SBOM is a shareable/published artifact,
+    // so a `bugs` URL like `https://user:token@tracker/...` must not leak the
+    // secret into externalReferences[].url. The tracker URL itself is still useful.
+    parsed.username = '';
+    parsed.password = '';
+    // Emit the normalized URL, not the raw input: `new URL` strips CR/LF/tab and
+    // percent-encodes spaces and control characters, so a crafted `bugs` value
+    // can't push raw whitespace or control chars into the CycloneDX
+    // `externalReferences[].url` (whose format is an `iri-reference`).
+    return parsed.href;
+}
 //# sourceMappingURL=getPkgMetadata.js.map

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl, resolveWorkspaceDeps, type WorkspacePackageInfo } from './collectComponents.js';
+export { bugsUrlFromField } from './getPkgMetadata.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { type CycloneDxOptions, serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/index.js

@@ -1,4 +1,5 @@
 export { collectSbomComponents, gitDownloadUrl, resolveWorkspaceDeps } from './collectComponents.js';
+export { bugsUrlFromField } from './getPkgMetadata.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/serializeCycloneDx.js

@@ -70,6 +70,12 @@ export function serializeCycloneDx(result, opts) {
                 url: comp.repository,
             });
         }
+        if (comp.bugsUrl) {
+            externalRefs.push({
+                type: 'issue-tracker',
+                url: comp.bugsUrl,
+            });
+        }
         if (externalRefs.length > 0) {
             cdxComp.externalReferences = externalRefs;
         }
@@ -111,11 +117,15 @@ export function serializeCycloneDx(result, opts) {
     if (rootComponent.description) {
         rootCdxComponent.description = rootComponent.description;
     }
+    const rootExternalRefs = [];
     if (rootComponent.repository) {
-        rootCdxComponent.externalReferences = [{
-                type: 'vcs',
-                url: rootComponent.repository,
-            }];
+        rootExternalRefs.push({ type: 'vcs', url: rootComponent.repository });
+    }
+    if (rootComponent.bugsUrl) {
+        rootExternalRefs.push({ type: 'issue-tracker', url: rootComponent.bugsUrl });
+    }
+    if (rootExternalRefs.length > 0) {
+        rootCdxComponent.externalReferences = rootExternalRefs;
     }
     const toolComponents = [];
     if (opts?.pnpmVersion) {

package/lib/types.d.ts

@@ -12,6 +12,7 @@ export interface SbomComponent {
     author?: string;
     homepage?: string;
     repository?: string;
+    bugsUrl?: string;
 }
 export interface SbomRelationship {
     from: string;
@@ -26,6 +27,7 @@ export interface SbomResult {
         description?: string;
         author?: string;
         repository?: string;
+        bugsUrl?: string;
     };
     components: SbomComponent[];
     relationships: SbomRelationship[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.2.0",
+  "version": "1100.3.1",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -13,9 +13,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/sbom"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/sbom#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/sbom#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -33,16 +33,16 @@
     "@cyclonedx/cyclonedx-library": "10.1.0",
     "p-limit": "^7.3.0",
     "ssri": "13.0.1",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.11",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/lockfile.utils": "1100.0.13",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/store.index": "1100.2.0",
-    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.13",
+    "@pnpm/lockfile.walker": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.pkg-finder": "1100.0.19",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/store.pkg-finder": "1100.0.17",
-    "@pnpm/pkg-manifest.reader": "1100.0.8"
+    "@pnpm/store.index": "1100.2.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -50,9 +50,9 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@types/ssri": "^7.1.5",
-    "@pnpm/store.cafs": "1100.1.10",
-    "@pnpm/deps.compliance.sbom": "1100.2.0",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/deps.compliance.sbom": "1100.3.1"
   },
   "engines": {
     "node": ">=22.13"