cognium-dev 3.202.0 → 3.203.0

package/dist/cli.js

@@ -45953,6 +45953,19 @@ function parseNpmDependencies(packageJson) {
   }
   return out2;
 }
+function parsePep508(spec) {
+  let s = spec.trim();
+  s = s.split(";")[0].trim();
+  if (!s)
+    return null;
+  const m = s.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
+  if (!m)
+    return null;
+  const rest = m[2].trim();
+  const verMatch = rest.replace(/^\(/, "").match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s)]+)/);
+  const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
+  return { name: m[1], version };
+}
 function parsePypiDependencies(requirementsTxt) {
   if (!requirementsTxt)
     return [];
@@ -45964,17 +45977,101 @@ function parsePypiDependencies(requirementsTxt) {
     if (line.startsWith("-") || /^[a-z]+:\/\//i.test(line))
       continue;
     line = line.split("#")[0].trim();
-    line = line.split(";")[0].trim();
     if (!line)
       continue;
-    const m = line.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
-    if (!m)
+    const parsed = parsePep508(line);
+    if (parsed)
+      out2.push(dep("pypi", parsed.name, parsed.version, "required"));
+  }
+  return out2;
+}
+function parsePyprojectDependencies(pyprojectToml) {
+  if (!pyprojectToml)
+    return [];
+  const out2 = [];
+  const lines = pyprojectToml.split(/\r?\n/);
+  let table = "";
+  let poetryScope = null;
+  let inArray = false;
+  let arrayScope = "required";
+  const pushReq = (raw, scope) => {
+    const cleaned = raw.trim().replace(/^["']|["'],?$/g, "").replace(/,$/, "").trim();
+    if (!cleaned)
+      return;
+    const parsed = parsePep508(cleaned);
+    if (parsed && parsed.name.toLowerCase() !== "python")
+      out2.push(dep("pypi", parsed.name, parsed.version, scope));
+  };
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
       continue;
-    const name2 = m[1];
-    const rest = m[2].trim();
-    const verMatch = rest.match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s]+)/);
-    const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
-    out2.push(dep("pypi", name2, version, "required"));
+    if (inArray) {
+      if (line.startsWith("]")) {
+        inArray = false;
+        continue;
+      }
+      pushReq(line, arrayScope);
+      continue;
+    }
+    const header = line.match(/^\[([^\]]+)\]$/);
+    if (header) {
+      table = header[1];
+      if (table === "tool.poetry.dependencies")
+        poetryScope = "required";
+      else if (/^tool\.poetry\.(dev-dependencies|group\..+\.dependencies)$/.test(table))
+        poetryScope = "dev";
+      else
+        poetryScope = null;
+      continue;
+    }
+    const arrayOpen = line.match(/^(dependencies|[A-Za-z0-9._-]+)\s*=\s*\[(.*)$/);
+    if (arrayOpen && (arrayOpen[1] === "dependencies" || table === "project.optional-dependencies")) {
+      arrayScope = arrayOpen[1] === "dependencies" ? "required" : "optional";
+      const inline = arrayOpen[2];
+      if (inline.includes("]")) {
+        for (const item of inline.slice(0, inline.indexOf("]")).split(","))
+          pushReq(item, arrayScope);
+      } else {
+        inArray = true;
+        if (inline.trim())
+          pushReq(inline, arrayScope);
+      }
+      continue;
+    }
+    if (poetryScope) {
+      const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+      if (!kv || kv[1].toLowerCase() === "python")
+        continue;
+      let version = "unknown";
+      const strv = kv[2].match(/^["']([^"']+)["']/);
+      if (strv)
+        version = strv[1];
+      else {
+        const inlinev = kv[2].match(/version\s*=\s*["']([^"']+)["']/);
+        if (inlinev)
+          version = inlinev[1];
+      }
+      out2.push(dep("pypi", kv[1], version, poetryScope));
+    }
+  }
+  return out2;
+}
+function parseGradleDependencies(buildGradle) {
+  if (!buildGradle)
+    return [];
+  const out2 = [];
+  const re = /\b(implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|classpath)\s*[(\s]\s*['"]([\w.-]+:[\w.-]+(?::[\w.\-+]+)?)['"]/g;
+  let m;
+  while ((m = re.exec(buildGradle)) !== null) {
+    const config = m[1];
+    const coord = m[2].split(":");
+    if (coord.length < 2)
+      continue;
+    const name2 = `${coord[0]}:${coord[1]}`;
+    const version = coord[2] ?? "unknown";
+    const scope = config.startsWith("test") ? "dev" : "required";
+    out2.push(dep("maven", name2, version, scope));
   }
   return out2;
 }
@@ -46753,7 +46850,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.202.0";
+var version = "3.203.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -47411,7 +47508,8 @@ SBOM OPTIONS:
   --prod-only                Exclude dev/test dependencies
   --deterministic            Omit timestamp / serialNumber / namespace for reproducible output
   -o, --output <file>        Write the document to a file (default: stdout)
-                               Discovers package.json / requirements.txt / pom.xml / Cargo.toml / go.mod.
+                               Discovers package.json / requirements.txt / pyproject.toml /
+                               pom.xml / build.gradle(.kts) / Cargo.toml / go.mod.
                                CVE matching is out of scope (deterministic SAST — no network).
 
 EXAMPLES:
@@ -48452,7 +48550,10 @@ function parseCrossFileBudgetMs(raw) {
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
   "requirements.txt": parsePypiDependencies,
+  "pyproject.toml": parsePyprojectDependencies,
   "pom.xml": parseMavenDependencies,
+  "build.gradle": parseGradleDependencies,
+  "build.gradle.kts": parseGradleDependencies,
   "Cargo.toml": parseCargoDependencies,
   "go.mod": parseGoDependencies
 };
@@ -48489,7 +48590,7 @@ async function runSbom(targetPath, options) {
   }
   const manifests = await collectManifestFiles(absPath);
   if (manifests.length === 0) {
-    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pom.xml, Cargo.toml, go.mod)"));
+    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pyproject.toml, pom.xml, build.gradle, Cargo.toml, go.mod)"));
     process.exit(1);
   }
   let deps = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.202.0",
+  "version": "3.203.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.202.0"
+    "circle-ir": "^3.203.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",