@pnpm/deps.compliance.sbom 1100.3.0 → 1100.3.2

package/CHANGELOG.md

@@ -0,0 +1,306 @@
+# @pnpm/deps.compliance.sbom
+
+## 1100.3.2
+
+### Patch Changes
+
+- @pnpm/lockfile.utils@1100.1.2
+
+## 1100.3.1
+
+### Patch Changes
+
+- Updated dependencies [dcabb78]
+  - @pnpm/resolving.resolver-base@1100.5.1
+  - @pnpm/lockfile.types@1100.0.13
+  - @pnpm/lockfile.utils@1100.1.1
+  - @pnpm/store.pkg-finder@1100.0.19
+  - @pnpm/lockfile.detect-dep-types@1100.0.13
+  - @pnpm/lockfile.walker@1100.0.13
+
+## 1100.3.0
+
+### Minor Changes
+
+- 6c35a43: Added `--exclude-peers` to `pnpm sbom`. With `auto-install-peers` (the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matches `pnpm list --exclude-peers`; note the SBOM flag prunes a peer's exclusive subtree, which is stricter than `pnpm list` (which only hides leaf peers).
+
+### Patch Changes
+
+- 17e7f2c: `pnpm sbom` now emits a CycloneDX `issue-tracker` external reference for components (and the root) whose `package.json` declares a `bugs` URL. Email-only `bugs` entries are skipped, since the reference requires a URL.
+- Updated dependencies [bae694f]
+- Updated dependencies [a84d2a1]
+  - @pnpm/resolving.resolver-base@1100.5.0
+  - @pnpm/lockfile.utils@1100.1.0
+  - @pnpm/lockfile.types@1100.0.12
+  - @pnpm/store.pkg-finder@1100.0.18
+  - @pnpm/pkg-manifest.reader@1100.0.9
+  - @pnpm/store.index@1100.2.1
+  - @pnpm/lockfile.detect-dep-types@1100.0.12
+  - @pnpm/lockfile.walker@1100.0.12
+
+## 1100.2.0
+
+### Minor Changes
+
+- dcededc: `pnpm sbom` now marks components reachable only through `devDependencies` with CycloneDX `scope: "excluded"` and the `cdx:npm:package:development` property. The `excluded` scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by `@cyclonedx/cyclonedx-npm`, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed `optionalDependencies`) omit `scope` and default to `required`.
+- 1495cb0: Added per-package SBOM generation with `--out` and `--split` flags. Use `--out out/%s.cdx.json` to write one SBOM per workspace package to individual files, or `--split` for NDJSON output to stdout. When `--filter` selects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (`workspace:` protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.
+
+## 1100.1.9
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [61810aa]
+- Updated dependencies [f20ad8f]
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/store.index@1100.2.0
+  - @pnpm/lockfile.utils@1100.0.13
+  - @pnpm/types@1101.3.2
+  - @pnpm/store.pkg-finder@1100.0.17
+  - @pnpm/lockfile.detect-dep-types@1100.0.11
+  - @pnpm/lockfile.types@1100.0.11
+  - @pnpm/lockfile.walker@1100.0.11
+  - @pnpm/pkg-manifest.reader@1100.0.8
+  - @pnpm/resolving.resolver-base@1100.4.2
+
+## 1100.1.8
+
+### Patch Changes
+
+- @pnpm/store.pkg-finder@1100.0.16
+
+## 1100.1.7
+
+### Patch Changes
+
+- Updated dependencies [bf1b731]
+  - @pnpm/types@1101.3.1
+  - @pnpm/lockfile.detect-dep-types@1100.0.10
+  - @pnpm/lockfile.types@1100.0.10
+  - @pnpm/lockfile.utils@1100.0.12
+  - @pnpm/lockfile.walker@1100.0.10
+  - @pnpm/pkg-manifest.reader@1100.0.7
+  - @pnpm/resolving.resolver-base@1100.4.1
+  - @pnpm/store.pkg-finder@1100.0.15
+
+## 1100.1.6
+
+### Patch Changes
+
+- Updated dependencies [a017bf3]
+- Updated dependencies [6d17b66]
+  - @pnpm/types@1101.3.0
+  - @pnpm/resolving.resolver-base@1100.4.0
+  - @pnpm/lockfile.detect-dep-types@1100.0.9
+  - @pnpm/lockfile.types@1100.0.9
+  - @pnpm/lockfile.utils@1100.0.11
+  - @pnpm/lockfile.walker@1100.0.9
+  - @pnpm/pkg-manifest.reader@1100.0.6
+  - @pnpm/store.pkg-finder@1100.0.14
+
+## 1100.1.5
+
+### Patch Changes
+
+- Updated dependencies [e55f4b5]
+- Updated dependencies [35d2355]
+  - @pnpm/lockfile.utils@1100.0.10
+  - @pnpm/types@1101.2.0
+  - @pnpm/lockfile.detect-dep-types@1100.0.8
+  - @pnpm/lockfile.types@1100.0.8
+  - @pnpm/lockfile.walker@1100.0.8
+  - @pnpm/pkg-manifest.reader@1100.0.5
+  - @pnpm/resolving.resolver-base@1100.3.1
+  - @pnpm/store.pkg-finder@1100.0.13
+
+## 1100.1.4
+
+### Patch Changes
+
+- @pnpm/store.pkg-finder@1100.0.12
+
+## 1100.1.3
+
+### Patch Changes
+
+- Updated dependencies [1627943]
+- Updated dependencies [64afc92]
+  - @pnpm/resolving.resolver-base@1100.3.0
+  - @pnpm/types@1101.1.1
+  - @pnpm/lockfile.types@1100.0.7
+  - @pnpm/lockfile.utils@1100.0.9
+  - @pnpm/store.pkg-finder@1100.0.11
+  - @pnpm/lockfile.detect-dep-types@1100.0.7
+  - @pnpm/lockfile.walker@1100.0.7
+  - @pnpm/pkg-manifest.reader@1100.0.4
+
+## 1100.1.2
+
+### Patch Changes
+
+- Updated dependencies [4195766]
+- Updated dependencies [31538bf]
+  - @pnpm/resolving.resolver-base@1100.2.0
+  - @pnpm/lockfile.types@1100.0.6
+  - @pnpm/lockfile.utils@1100.0.8
+  - @pnpm/store.pkg-finder@1100.0.10
+  - @pnpm/lockfile.detect-dep-types@1100.0.6
+  - @pnpm/lockfile.walker@1100.0.6
+
+## 1100.1.1
+
+### Patch Changes
+
+- @pnpm/store.pkg-finder@1100.0.9
+
+## 1100.1.0
+
+### Minor Changes
+
+- 87b4bac: Allow setting sbom spec version using `--sbom-spec-version` [#11389](https://github.com/pnpm/pnpm/pull/11389).
+
+### Patch Changes
+
+- Updated dependencies [b61e268]
+  - @pnpm/types@1101.1.0
+  - @pnpm/lockfile.detect-dep-types@1100.0.5
+  - @pnpm/lockfile.types@1100.0.5
+  - @pnpm/lockfile.utils@1100.0.7
+  - @pnpm/lockfile.walker@1100.0.5
+  - @pnpm/pkg-manifest.reader@1100.0.3
+  - @pnpm/resolving.resolver-base@1100.1.3
+  - @pnpm/store.pkg-finder@1100.0.8
+
+## 1100.0.9
+
+### Patch Changes
+
+- Updated dependencies [0c67cb5]
+  - @pnpm/store.index@1100.1.0
+  - @pnpm/store.pkg-finder@1100.0.7
+
+## 1100.0.8
+
+### Patch Changes
+
+- Updated dependencies [cfa271b]
+  - @pnpm/lockfile.utils@1100.0.6
+
+## 1100.0.7
+
+### Patch Changes
+
+- Updated dependencies [27425d7]
+  - @pnpm/lockfile.types@1100.0.4
+  - @pnpm/lockfile.utils@1100.0.5
+  - @pnpm/resolving.resolver-base@1100.1.2
+  - @pnpm/store.pkg-finder@1100.0.6
+  - @pnpm/lockfile.detect-dep-types@1100.0.4
+  - @pnpm/lockfile.walker@1100.0.4
+
+## 1100.0.6
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+- Updated dependencies [6b891a5]
+  - @pnpm/resolving.resolver-base@1100.1.1
+  - @pnpm/pkg-manifest.reader@1100.0.2
+  - @pnpm/lockfile.utils@1100.0.4
+  - @pnpm/store.pkg-finder@1100.0.5
+  - @pnpm/lockfile.types@1100.0.3
+  - @pnpm/lockfile.detect-dep-types@1100.0.3
+  - @pnpm/lockfile.walker@1100.0.3
+
+## 1100.0.5
+
+### Patch Changes
+
+- f9afe81: Populate download location for git-sourced dependencies in SBOM output. Previously `pnpm sbom` emitted `NOASSERTION` (SPDX) and omitted the distribution reference (CycloneDX) for git dependencies. Now emits the git URL with commit hash, e.g. `git+https://github.com/user/repo.git#commit`.
+
+## 1100.0.4
+
+### Patch Changes
+
+- @pnpm/store.pkg-finder@1100.0.4
+- @pnpm/lockfile.utils@1100.0.3
+
+## 1100.0.3
+
+### Patch Changes
+
+- 61952c2: `pnpm sbom` now detects licenses declared via the deprecated `licenses` array in `package.json` (e.g. `busboy`, `streamsearch`, `limiter`) and falls back to scanning on-disk `LICENSE` files — mirroring the resolution logic of `pnpm licenses`. Previously these packages were reported as `NOASSERTION`. Shared license resolution (manifest parsing + LICENSE-file fallback) lives in the new `@pnpm/deps.compliance.license-resolver` package. When a manifest sets both `license` and `licenses`, the modern `license` field now takes precedence for both commands (previously `pnpm licenses` preferred `licenses`) [#11248](https://github.com/pnpm/pnpm/issues/11248).
+- Updated dependencies [bcc88a1]
+- Updated dependencies [61952c2]
+  - @pnpm/store.pkg-finder@1100.0.3
+  - @pnpm/deps.compliance.license-resolver@1100.0.0
+  - @pnpm/lockfile.types@1100.0.2
+  - @pnpm/lockfile.utils@1100.0.2
+  - @pnpm/lockfile.detect-dep-types@1100.0.2
+  - @pnpm/lockfile.walker@1100.0.2
+
+## 1100.0.2
+
+### Patch Changes
+
+- @pnpm/store.pkg-finder@1100.0.2
+
+## 1100.0.1
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/lockfile.detect-dep-types@1100.0.1
+  - @pnpm/lockfile.types@1100.0.1
+  - @pnpm/lockfile.utils@1100.0.1
+  - @pnpm/lockfile.walker@1100.0.1
+  - @pnpm/pkg-manifest.reader@1100.0.1
+  - @pnpm/store.pkg-finder@1100.0.1
+
+## 1000.0.0
+
+### Minor Changes
+
+- f92ac24: Added `pnpm sbom` command for generating Software Bill of Materials in CycloneDX 1.7 and SPDX 2.3 JSON formats [#9088](https://github.com/pnpm/pnpm/issues/9088).
+
+### Patch Changes
+
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [606f53e]
+- Updated dependencies [491a84f]
+- Updated dependencies [f92ac24]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [efb48dc]
+- Updated dependencies [50fbeca]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [6f806be]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [38b8e35]
+- Updated dependencies [394d88c]
+- Updated dependencies [b7f0f21]
+- Updated dependencies [2df8b71]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+  - @pnpm/types@1001.0.0
+  - @pnpm/lockfile.types@1003.0.0
+  - @pnpm/lockfile.utils@1004.0.0
+  - @pnpm/pkg-manifest.reader@1001.0.0
+  - @pnpm/lockfile.detect-dep-types@1002.0.0
+  - @pnpm/lockfile.walker@1002.0.0
+  - @pnpm/store.pkg-finder@1000.0.0
+  - @pnpm/store.index@1000.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.3.0",
+  "version": "1100.3.2",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -31,28 +31,28 @@
   ],
   "dependencies": {
     "@cyclonedx/cyclonedx-library": "10.1.0",
-    "p-limit": "^7.3.0",
-    "ssri": "13.0.1",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.12",
-    "@pnpm/lockfile.utils": "1100.1.0",
-    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.13",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.2",
+    "@pnpm/lockfile.walker": "1100.0.13",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/resolving.resolver-base": "1100.5.0",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
     "@pnpm/store.index": "1100.2.1",
-    "@pnpm/store.pkg-finder": "1100.0.18",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/store.pkg-finder": "1100.0.19",
+    "@pnpm/types": "1101.3.2",
+    "p-limit": "^7.3.0",
+    "ssri": "13.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@types/ssri": "^7.1.5",
+    "@pnpm/deps.compliance.sbom": "1100.3.2",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.11",
-    "@pnpm/deps.compliance.sbom": "1100.3.0"
+    "@pnpm/store.cafs": "1100.1.12",
+    "@types/ssri": "^7.1.5"
   },
   "engines": {
     "node": ">=22.13"