@trustify-da/trustify-da-javascript-client 0.3.0-ea.a8c3942 → 0.3.0-ea.a9624b2

package/dist/src/providers/python_uv.d.ts

@@ -13,27 +13,18 @@ export function discoverUvWorkspaceMembers(workspaceRoot: string, opts?: {
 }): Promise<string[]>;
 export default class Python_uv extends Base_pyproject {
     /**
-     * @param {string} manifestDir - directory containing the target pyproject.toml
-     * @param {string} workspaceDir - workspace root (for resolving editable install paths)
-     * @param {object} parsed - parsed pyproject.toml
-     * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
      */
-    _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<{
-        directDeps: string[];
-        graph: Map<string, {
-            name: string;
-            version: string;
-            children: string[];
-        }>;
-    }>;
+    _attachHashesFromLockFile(lockFilePath: string, graph: Map<string, import("./base_pyproject.js").GraphEntry>): Promise<void>;
     /**
      * Get the uv export output, either from env var or by running the command.
      * @param {string} manifestDir
      * @param {Object} opts
      * @returns {string}
      */
-    _getUvExportOutput(manifestDir: string, opts: any): string;
+    _getUvExportOutput(manifestDir: string, opts: Object): string;
     /**
      * Parse uv export output into a dependency graph using tree-sitter-requirements
      * for package/version extraction and string parsing for "# via" comments.

package/dist/src/providers/python_uv.js

@@ -21,12 +21,54 @@ export default class Python_uv extends Base_pyproject {
      * @param {string} workspaceDir - workspace root (for resolving editable install paths)
      * @param {object} parsed - parsed pyproject.toml
      * @param {Object} opts
-     * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
+     * @returns {Promise<{directDeps: string[], graph: Map<string, import('./base_pyproject.js').GraphEntry>}>}
      */
     async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
         let projectName = this._getProjectName(parsed);
         let uvOutput = this._getUvExportOutput(manifestDir, opts);
-        return this._parseUvExport(uvOutput, projectName, workspaceDir);
+        let { directDeps, graph } = await this._parseUvExport(uvOutput, projectName, workspaceDir);
+        await this._attachHashesFromLockFile(path.join(workspaceDir, 'uv.lock'), graph);
+        return { directDeps, graph };
+    }
+    /**
+     * Parse uv.lock and attach SHA-256 hashes to graph entries.
+     * @param {string} lockFilePath - path to uv.lock
+     * @param {Map<string, import('./base_pyproject.js').GraphEntry>} graph
+     */
+    async _attachHashesFromLockFile(lockFilePath, graph) {
+        let lockContent;
+        try {
+            lockContent = await fs.promises.readFile(lockFilePath, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        let parsed;
+        try {
+            parsed = parseToml(lockContent);
+        }
+        catch {
+            return;
+        }
+        let packages = parsed.package;
+        if (!Array.isArray(packages)) {
+            return;
+        }
+        for (let pkg of packages) {
+            if (!pkg.name) {
+                continue;
+            }
+            let hashStr = pkg.sdist?.hash || pkg.wheels?.[0]?.hash;
+            if (!hashStr || !hashStr.startsWith('sha256:')) {
+                continue;
+            }
+            let key = this._canonicalize(pkg.name);
+            let entry = graph.get(key);
+            if (!entry || entry.hashes) {
+                continue;
+            }
+            entry.hashes = [{ alg: "SHA-256", content: hashStr.slice(7) }];
+        }
     }
     /**
      * Get the uv export output, either from env var or by running the command.

package/dist/src/providers/rust_cargo.d.ts

@@ -4,9 +4,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
@@ -46,7 +47,10 @@ declare function provideStack(manifest: string, opts?: {}): Provided;
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-declare function readLicenseFromManifest(manifestPath: string): string | null;
+declare function readLicenseFromManifest(manifestPath: string, metadata?: object): string | null;

package/dist/src/providers/rust_cargo.js

@@ -5,7 +5,7 @@ import { parse as parseToml } from 'smol-toml';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from '../tools.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'cargo'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -71,15 +71,22 @@ function isSupported(manifestName) {
  * Read project license from Cargo.toml, with fallback to LICENSE file.
  * Supports the `license` field under `[package]` (single crate / workspace
  * with root) and under `[workspace.package]` (virtual workspaces).
+ * When a member crate uses `license = { workspace = true }`, the actual
+ * license is resolved from the workspace root Cargo.toml.
  * @param {string} manifestPath - path to Cargo.toml
+ * @param {object} [metadata] - cargo metadata output (needed for workspace license resolution)
  * @returns {string|null} SPDX identifier or null
  */
-function readLicenseFromManifest(manifestPath) {
+function readLicenseFromManifest(manifestPath, metadata) {
     let fromManifest = null;
     try {
         let content = fs.readFileSync(manifestPath, 'utf-8');
         let parsed = parseToml(content);
-        fromManifest = parsed.package?.license
+        let packageLicense = parsed.package?.license;
+        if (typeof packageLicense === 'object' && packageLicense?.workspace === true) {
+            packageLicense = resolveWorkspaceLicense(parsed, metadata);
+        }
+        fromManifest = packageLicense
             || parsed.workspace?.package?.license
             || null;
     }
@@ -88,6 +95,26 @@ function readLicenseFromManifest(manifestPath) {
     }
     return getLicense(fromManifest, manifestPath);
 }
+/**
+ * Resolve a workspace-inherited license from the workspace root Cargo.toml.
+ * @param {object} parsed - the parsed member crate Cargo.toml
+ * @param {object} [metadata] - cargo metadata output with workspace_root
+ * @returns {string|null} resolved license string or null
+ */
+function resolveWorkspaceLicense(parsed, metadata) {
+    if (metadata?.workspace_root) {
+        let cargoTomlPath = path.join(metadata.workspace_root, 'Cargo.toml');
+        try {
+            let content = fs.readFileSync(cargoTomlPath, 'utf-8');
+            let workspaceParsed = parseToml(content);
+            return workspaceParsed.workspace?.package?.license || null;
+        }
+        catch (_) {
+            // fall through
+        }
+    }
+    return parsed.workspace?.package?.license || null;
+}
 /**
  * Validates that Cargo.lock exists in the manifest directory or in a parent
  * workspace root directory.  In Cargo workspaces the lock file always lives at
@@ -173,7 +200,7 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
     let metadata = executeCargoMetadata(cargoBin, manifestDir);
     let ignoredDeps = getIgnoredDeps(manifest, metadata);
     let crateType = detectCrateType(metadata);
-    let license = readLicenseFromManifest(manifest);
+    let license = readLicenseFromManifest(manifest, metadata);
     let sbom;
     if (crateType === CrateType.WORKSPACE_VIRTUAL) {
         sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license);

package/dist/src/tools.d.ts

@@ -100,13 +100,13 @@ export function invokeCommand(bin: string, args: Array<string>, opts?: import("c
  * @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
  * @returns {RequestInit} The fetch options with proxy agent if applicable
  */
-export function addProxyAgent(options: RequestInit, opts: import("index.js").Options): RequestInit;
+export function addProxyAgent(options: RequestInit, opts: any): RequestInit;
 /**
  * Utility function for fetching vendor tokens
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function getTokenHeaders(opts?: import("index.js").Options): {};
+export function getTokenHeaders(opts?: any): {};
 export const RegexNotToBeLogged: RegExp;
 export const TRUSTIFY_DA_TOKEN_HEADER: "trust-da-token";
 export const TRUSTIFY_DA_TELEMETRY_ID_HEADER: "telemetry-anonymous-id";

package/dist/src/updaters/maven_updater.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
+ *   list of version changes to apply
+ * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent: string, versionChanges: Array<{
+    groupId: string;
+    artifactId: string;
+    newVersion: string;
+}>): {
+    content: string;
+    applied: any[];
+    skipped: any[];
+};

package/dist/src/updaters/maven_updater.js

@@ -0,0 +1,322 @@
+import { XMLParser } from 'fast-xml-parser';
+/**
+ * Extracts the trimmed text content of a simple XML element from a string block.
+ * @param {string} block - the XML text to search within
+ * @param {string} tagName - the element name whose content to extract
+ * @returns {string|null} the trimmed text content, or null if not found
+ */
+function extractTagContent(block, tagName) {
+    const openTag = `<${tagName}>`;
+    const closeTag = `</${tagName}>`;
+    const start = block.indexOf(openTag);
+    if (start === -1) {
+        return null;
+    }
+    const contentStart = start + openTag.length;
+    const end = block.indexOf(closeTag, contentStart);
+    if (end === -1) {
+        return null;
+    }
+    return block.substring(contentStart, end).trim();
+}
+/**
+ * Finds the character positions of an XML element's text content within the raw file.
+ * Returns the start (inclusive) and end (exclusive) offsets of the text between the
+ * opening and closing tags.
+ * @param {string} content - full raw XML content
+ * @param {number} searchStart - start offset to search from
+ * @param {number} searchEnd - end offset to search within
+ * @param {string} tagName - the element name whose content position to locate
+ * @returns {{start: number, end: number}|null} character offsets, or null if not found
+ */
+function findTagContentPosition(content, searchStart, searchEnd, tagName) {
+    const openTag = `<${tagName}>`;
+    const closeTag = `</${tagName}>`;
+    const tagStart = content.indexOf(openTag, searchStart);
+    if (tagStart === -1 || tagStart >= searchEnd) {
+        return null;
+    }
+    const contentStart = tagStart + openTag.length;
+    const tagEnd = content.indexOf(closeTag, contentStart);
+    if (tagEnd === -1 || tagEnd > searchEnd) {
+        return null;
+    }
+    return { start: contentStart, end: tagEnd };
+}
+/**
+ * Checks whether the character immediately following a tag prefix indicates
+ * that the prefix is the complete tag name (e.g. `<dependency>` vs `<dependencyManagement>`).
+ * @param {string} char - the character after the tag prefix
+ * @returns {boolean} true if the character terminates the tag name
+ */
+function isTagBoundary(char) {
+    return char === '>' || char === ' ' || char === '\t'
+        || char === '\n' || char === '\r' || char === '/';
+}
+/**
+ * Finds the text content position of a `<version>` element within the first
+ * `<dependency>` block matching the given groupId and artifactId.
+ * Searches through all `<dependency>` elements in the file, covering both
+ * `<dependencies>` and `<dependencyManagement>` sections.
+ * @param {string} content - full raw pom.xml content
+ * @param {string} groupId - the dependency's groupId to match
+ * @param {string} artifactId - the dependency's artifactId to match
+ * @returns {{start: number, end: number}|null} version content offsets, or null
+ */
+function findDependencyVersionPosition(content, groupId, artifactId) {
+    let searchStart = 0;
+    const TAG_PREFIX = '<dependency';
+    const CLOSE_TAG = '</dependency>';
+    while (searchStart < content.length) {
+        const start = content.indexOf(TAG_PREFIX, searchStart);
+        if (start === -1) {
+            break;
+        }
+        // Verify this is exactly <dependency> and not <dependencyManagement> etc.
+        const charAfterTag = content.charAt(start + TAG_PREFIX.length);
+        if (!isTagBoundary(charAfterTag)) {
+            searchStart = start + 1;
+            continue;
+        }
+        // Find closing </dependency>
+        const end = content.indexOf(CLOSE_TAG, start + TAG_PREFIX.length);
+        if (end === -1) {
+            break;
+        }
+        const blockEnd = end + CLOSE_TAG.length;
+        const block = content.substring(start, blockEnd);
+        const gid = extractTagContent(block, 'groupId');
+        const aid = extractTagContent(block, 'artifactId');
+        if (gid === groupId && aid === artifactId) {
+            const pos = findTagContentPosition(content, start, blockEnd, 'version');
+            if (pos) {
+                return pos;
+            }
+            // Matching dependency but no <version> element; continue searching
+            // (the version may be in <dependencyManagement>)
+        }
+        searchStart = blockEnd;
+    }
+    return null;
+}
+/**
+ * Finds the text content position of a property element inside a `<properties>` block.
+ * Searches through all `<properties>` blocks in the file.
+ * @param {string} content - full raw pom.xml content
+ * @param {string} propName - the property element name to locate
+ * @returns {{start: number, end: number}|null} property value offsets, or null
+ */
+function findPropertyPosition(content, propName) {
+    let searchStart = 0;
+    const TAG_PREFIX = '<properties';
+    const CLOSE_TAG = '</properties>';
+    while (searchStart < content.length) {
+        const propsStart = content.indexOf(TAG_PREFIX, searchStart);
+        if (propsStart === -1) {
+            break;
+        }
+        // Verify this is exactly <properties> and not some other tag
+        const charAfter = content.charAt(propsStart + TAG_PREFIX.length);
+        if (!isTagBoundary(charAfter)) {
+            searchStart = propsStart + 1;
+            continue;
+        }
+        const propsCloseStart = content.indexOf(CLOSE_TAG, propsStart);
+        if (propsCloseStart === -1) {
+            break;
+        }
+        const propsBlockEnd = propsCloseStart + CLOSE_TAG.length;
+        const result = findTagContentPosition(content, propsStart, propsBlockEnd, propName);
+        if (result) {
+            return result;
+        }
+        searchStart = propsBlockEnd;
+    }
+    return null;
+}
+/**
+ * Resolves a Maven property chain, following `${propName}` references through
+ * the properties map until a concrete (non-reference) value is reached.
+ * Detects circular references via a visited set.
+ * @param {string} propName - the initial property name to resolve
+ * @param {Object} properties - properties map from the parsed XML
+ * @param {Set<string>} [visited] - visited property names (for cycle detection)
+ * @returns {{terminalPropName: string, resolvedValue: string}|{error: string}}
+ */
+function resolvePropertyChain(propName, properties, visited = new Set()) {
+    if (visited.has(propName)) {
+        const chain = [...visited, propName].join(' -> ');
+        return { error: `Circular property reference detected: ${chain}` };
+    }
+    visited.add(propName);
+    const value = properties[propName];
+    if (value == null) {
+        return { error: `Property '${propName}' not found in <properties>` };
+    }
+    const valueStr = String(value);
+    const propMatch = valueStr.match(/^\$\{(.+)\}$/);
+    if (propMatch) {
+        return resolvePropertyChain(propMatch[1], properties, visited);
+    }
+    return { terminalPropName: propName, resolvedValue: valueStr };
+}
+/**
+ * Updates dependency versions in a Maven pom.xml while preserving file formatting.
+ *
+ * Uses `fast-xml-parser` to understand the XML structure (dependencies and properties),
+ * then performs position-based string splice to replace version strings without altering
+ * any other formatting, comments, whitespace, or indentation.
+ *
+ * Supports `${property}` indirection: when a dependency's `<version>` is a property
+ * reference, the updater resolves the property chain (including recursive references)
+ * and updates the terminal property value in `<properties>` instead.
+ *
+ * @param {string} pomContent - the raw pom.xml file content
+ * @param {Array<{groupId: string, artifactId: string, newVersion: string}>} versionChanges -
+ *   list of version changes to apply
+ * @returns {{content: string, applied: Array, skipped: Array}} the updated content and
+ *   lists of applied and skipped changes
+ */
+export function updateMavenVersions(pomContent, versionChanges) {
+    if (!versionChanges || versionChanges.length === 0) {
+        return { content: pomContent, applied: [], skipped: [] };
+    }
+    const parser = new XMLParser({
+        parseTagValue: false,
+        commentPropName: '#comment',
+    });
+    let parsed;
+    try {
+        parsed = parser.parse(pomContent);
+    }
+    catch (e) {
+        return {
+            content: pomContent,
+            applied: [],
+            skipped: versionChanges.map(vc => ({
+                groupId: vc.groupId,
+                artifactId: vc.artifactId,
+                newVersion: vc.newVersion,
+                reason: `Failed to parse pom.xml: ${e.message}`,
+            })),
+        };
+    }
+    const project = parsed?.project;
+    if (!project) {
+        return {
+            content: pomContent,
+            applied: [],
+            skipped: versionChanges.map(vc => ({
+                groupId: vc.groupId,
+                artifactId: vc.artifactId,
+                newVersion: vc.newVersion,
+                reason: 'No <project> element found in pom.xml',
+            })),
+        };
+    }
+    const properties = project.properties || {};
+    const applied = [];
+    const skipped = [];
+    /** @type {Map<number, {start: number, end: number, newValue: string}>} */
+    const replacementsByPosition = new Map();
+    for (const change of versionChanges) {
+        const versionPos = findDependencyVersionPosition(pomContent, change.groupId, change.artifactId);
+        if (!versionPos) {
+            skipped.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                reason: 'Dependency not found in pom.xml or has no <version> element',
+            });
+            continue;
+        }
+        const currentVersion = pomContent.substring(versionPos.start, versionPos.end);
+        const propMatch = currentVersion.match(/^\$\{(.+)\}$/);
+        if (propMatch) {
+            const resolved = resolvePropertyChain(propMatch[1], properties);
+            if (resolved.error) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: resolved.error,
+                });
+                continue;
+            }
+            const propPos = findPropertyPosition(pomContent, resolved.terminalPropName);
+            if (!propPos) {
+                skipped.push({
+                    groupId: change.groupId,
+                    artifactId: change.artifactId,
+                    newVersion: change.newVersion,
+                    reason: `Could not locate property '${resolved.terminalPropName}' in pom.xml`,
+                });
+                continue;
+            }
+            // Deduplicate: multiple deps may share the same property
+            const existing = replacementsByPosition.get(propPos.start);
+            if (existing) {
+                if (existing.newValue !== change.newVersion) {
+                    skipped.push({
+                        groupId: change.groupId,
+                        artifactId: change.artifactId,
+                        newVersion: change.newVersion,
+                        reason: `Property '${resolved.terminalPropName}' already targeted `
+                            + `with a different version '${existing.newValue}'`,
+                    });
+                    continue;
+                }
+                // Same replacement already queued; record as applied without duplicating
+            }
+            else {
+                replacementsByPosition.set(propPos.start, {
+                    start: propPos.start,
+                    end: propPos.end,
+                    newValue: change.newVersion,
+                });
+            }
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                type: 'property',
+                property: resolved.terminalPropName,
+            });
+        }
+        else {
+            const existing = replacementsByPosition.get(versionPos.start);
+            if (existing) {
+                if (existing.newValue !== change.newVersion) {
+                    skipped.push({
+                        groupId: change.groupId,
+                        artifactId: change.artifactId,
+                        newVersion: change.newVersion,
+                        reason: `Version already targeted with a different version '${existing.newValue}'`,
+                    });
+                    continue;
+                }
+            }
+            else {
+                replacementsByPosition.set(versionPos.start, {
+                    start: versionPos.start,
+                    end: versionPos.end,
+                    newValue: change.newVersion,
+                });
+            }
+            applied.push({
+                groupId: change.groupId,
+                artifactId: change.artifactId,
+                newVersion: change.newVersion,
+                type: 'direct',
+            });
+        }
+    }
+    // Sort replacements by position descending to preserve offsets during splice
+    const sortedReplacements = [...replacementsByPosition.values()]
+        .sort((a, b) => b.start - a.start);
+    let result = pomContent;
+    for (const r of sortedReplacements) {
+        result = result.substring(0, r.start) + r.newValue + result.substring(r.end);
+    }
+    return { content: result, applied, skipped };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.a8c3942",
+	"version": "0.3.0-ea.a9624b2",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -35,31 +35,33 @@
 		"config/**/*"
 	],
 	"scripts": {
-		"lint": "eslint src test --ext js",
-		"lint:fix": "eslint src test --ext js --fix",
+		"lint": "eslint src test",
+		"lint:fix": "eslint src test --fix",
 		"test": "c8 npm run tests",
 		"tests": "mocha --config .mocharc.json",
 		"tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
-		"pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm src/providers/tree-sitter-gomod.wasm",
+		"pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm src/providers/tree-sitter-containerfile.wasm",
 		"precompile": "rm -rf dist",
 		"compile": "tsc -p tsconfig.json",
 		"compile:dev": "tsc -p tsconfig.dev.json",
-		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm"
+		"postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm dist/src/providers/tree-sitter-containerfile.wasm"
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^6.13.0",
+		"@cyclonedx/cyclonedx-library": "^10.0.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",
 		"help": "^3.0.2",
-		"https-proxy-agent": "^7.0.6",
+		"https-proxy-agent": "^9.0.0",
 		"js-yaml": "^4.1.1",
+		"jsonc-parser": "^3.3.1",
 		"micromatch": "^4.0.8",
 		"node-fetch": "^3.3.2",
-		"p-limit": "^4.0.0",
+		"p-limit": "^7.3.0",
 		"packageurl-js": "~1.0.2",
 		"smol-toml": "^1.6.0",
+		"tree-sitter-containerfile": "^0.8.1",
 		"tree-sitter-gomod": "github:strum355/tree-sitter-go-mod#56326f2ad478892ace58ff247a97d492a3cbcdda",
 		"tree-sitter-requirements": "github:Strum355/tree-sitter-requirements#d0261ee76b84253997fe70d7d397e78c006c3801",
 		"web-tree-sitter": "^0.26.7",
@@ -67,23 +69,24 @@
 	},
 	"devDependencies": {
 		"@babel/core": "^7.23.2",
-		"@trustify-da/trustify-da-api-model": "^2.0.7",
-		"@types/node": "^20.17.30",
+		"@eslint/js": "^10.0.0",
+		"@trustify-da/trustify-da-api-model": "^2.0.12",
+		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
 		"babel-plugin-rewire": "^1.2.0",
 		"c8": "^11.0.0",
-		"chai": "^4.3.7",
-		"eslint": "^8.42.0",
+		"chai": "^6.2.2",
+		"eslint": "^10.4.1",
 		"eslint-import-resolver-typescript": "^4.4.4",
-		"eslint-plugin-editorconfig": "^4.0.3",
-		"eslint-plugin-import": "^2.29.1",
+		"eslint-plugin-import-x": "^4.16.2",
 		"esmock": "^2.6.2",
-		"mocha": "^10.2.0",
+		"globals": "^17.6.0",
+		"mocha": "^11.7.6",
 		"msw": "^2.12.7",
-		"sinon": "^15.1.2",
-		"sinon-chai": "^3.7.0",
-		"typescript": "^5.1.3",
-		"which": "^5.0.0"
+		"sinon": "^22.0.0",
+		"sinon-chai": "^4.0.1",
+		"typescript": "^6.0.3",
+		"which": "^7.0.0"
 	},
 	"mocha": {
 		"check-leaks": false,
@@ -111,12 +114,13 @@
 		"reporter": [
 			"html",
 			"json",
+			"lcov",
 			"text"
 		]
 	},
-	"eslintIgnore": [
-		"index.js"
-	],
+	"overrides": {
+		"tree-sitter": "0.22.4"
+	},
 	"resolutions": {
 		"@hapi/joi": "17.1.1"
 	}