cognium-dev 3.202.0 → 3.204.0

package/dist/cli.js

@@ -45953,6 +45953,112 @@ function parseNpmDependencies(packageJson) {
   }
   return out2;
 }
+function parsePep508(spec) {
+  let s = spec.trim();
+  s = s.split(";")[0].trim();
+  if (!s)
+    return null;
+  const m = s.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
+  if (!m)
+    return null;
+  const rest = m[2].trim();
+  const verMatch = rest.replace(/^\(/, "").match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s)]+)/);
+  const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
+  return { name: m[1], version };
+}
+function parseNpmLockDependencies(packageLock) {
+  if (!packageLock)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(packageLock);
+  } catch {
+    return [];
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const root = parsed;
+  const out2 = [];
+  const scopeOf = (info2) => info2.dev === true ? "dev" : info2.optional === true ? "optional" : "required";
+  const packages = root.packages;
+  if (packages && typeof packages === "object") {
+    for (const [path, raw] of Object.entries(packages)) {
+      if (!path || !raw || typeof raw !== "object")
+        continue;
+      const info2 = raw;
+      const marker = "node_modules/";
+      const idx = path.lastIndexOf(marker);
+      const name2 = idx >= 0 ? path.slice(idx + marker.length) : typeof info2.name === "string" ? info2.name : path;
+      if (!name2)
+        continue;
+      const version = typeof info2.version === "string" ? info2.version : "unknown";
+      out2.push(dep("npm", name2, version, scopeOf(info2)));
+    }
+  } else if (root.dependencies && typeof root.dependencies === "object") {
+    const walk = (deps) => {
+      for (const [name2, raw] of Object.entries(deps)) {
+        if (!raw || typeof raw !== "object")
+          continue;
+        const info2 = raw;
+        const version = typeof info2.version === "string" ? info2.version : "unknown";
+        out2.push(dep("npm", name2, version, scopeOf(info2)));
+        if (info2.dependencies && typeof info2.dependencies === "object") {
+          walk(info2.dependencies);
+        }
+      }
+    };
+    walk(root.dependencies);
+  }
+  const seen = new Set;
+  return out2.filter((d) => {
+    const key = `${d.name}|${d.version}|${d.scope}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseTomlPackageArray(content, ecosystem) {
+  const out2 = [];
+  let name2 = null;
+  let version = null;
+  let inPackage = false;
+  const flush = () => {
+    if (inPackage && name2 && version)
+      out2.push(dep(ecosystem, name2, version, "required"));
+    name2 = null;
+    version = null;
+  };
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") {
+      flush();
+      inPackage = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      flush();
+      inPackage = false;
+      continue;
+    }
+    if (!inPackage)
+      continue;
+    const nm = line.match(/^name\s*=\s*"([^"]+)"/);
+    if (nm)
+      name2 = nm[1];
+    const vm = line.match(/^version\s*=\s*"([^"]+)"/);
+    if (vm)
+      version = vm[1];
+  }
+  flush();
+  return out2;
+}
+function parseCargoLockDependencies(cargoLock) {
+  return cargoLock ? parseTomlPackageArray(cargoLock, "cargo") : [];
+}
+function parsePoetryLockDependencies(poetryLock) {
+  return poetryLock ? parseTomlPackageArray(poetryLock, "pypi") : [];
+}
 function parsePypiDependencies(requirementsTxt) {
   if (!requirementsTxt)
     return [];
@@ -45964,17 +46070,101 @@ function parsePypiDependencies(requirementsTxt) {
     if (line.startsWith("-") || /^[a-z]+:\/\//i.test(line))
       continue;
     line = line.split("#")[0].trim();
-    line = line.split(";")[0].trim();
     if (!line)
       continue;
-    const m = line.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
-    if (!m)
+    const parsed = parsePep508(line);
+    if (parsed)
+      out2.push(dep("pypi", parsed.name, parsed.version, "required"));
+  }
+  return out2;
+}
+function parsePyprojectDependencies(pyprojectToml) {
+  if (!pyprojectToml)
+    return [];
+  const out2 = [];
+  const lines = pyprojectToml.split(/\r?\n/);
+  let table = "";
+  let poetryScope = null;
+  let inArray = false;
+  let arrayScope = "required";
+  const pushReq = (raw, scope) => {
+    const cleaned = raw.trim().replace(/^["']|["'],?$/g, "").replace(/,$/, "").trim();
+    if (!cleaned)
+      return;
+    const parsed = parsePep508(cleaned);
+    if (parsed && parsed.name.toLowerCase() !== "python")
+      out2.push(dep("pypi", parsed.name, parsed.version, scope));
+  };
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
       continue;
-    const name2 = m[1];
-    const rest = m[2].trim();
-    const verMatch = rest.match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s]+)/);
-    const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
-    out2.push(dep("pypi", name2, version, "required"));
+    if (inArray) {
+      if (line.startsWith("]")) {
+        inArray = false;
+        continue;
+      }
+      pushReq(line, arrayScope);
+      continue;
+    }
+    const header = line.match(/^\[([^\]]+)\]$/);
+    if (header) {
+      table = header[1];
+      if (table === "tool.poetry.dependencies")
+        poetryScope = "required";
+      else if (/^tool\.poetry\.(dev-dependencies|group\..+\.dependencies)$/.test(table))
+        poetryScope = "dev";
+      else
+        poetryScope = null;
+      continue;
+    }
+    const arrayOpen = line.match(/^(dependencies|[A-Za-z0-9._-]+)\s*=\s*\[(.*)$/);
+    if (arrayOpen && (arrayOpen[1] === "dependencies" || table === "project.optional-dependencies")) {
+      arrayScope = arrayOpen[1] === "dependencies" ? "required" : "optional";
+      const inline = arrayOpen[2];
+      if (inline.includes("]")) {
+        for (const item of inline.slice(0, inline.indexOf("]")).split(","))
+          pushReq(item, arrayScope);
+      } else {
+        inArray = true;
+        if (inline.trim())
+          pushReq(inline, arrayScope);
+      }
+      continue;
+    }
+    if (poetryScope) {
+      const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+      if (!kv || kv[1].toLowerCase() === "python")
+        continue;
+      let version = "unknown";
+      const strv = kv[2].match(/^["']([^"']+)["']/);
+      if (strv)
+        version = strv[1];
+      else {
+        const inlinev = kv[2].match(/version\s*=\s*["']([^"']+)["']/);
+        if (inlinev)
+          version = inlinev[1];
+      }
+      out2.push(dep("pypi", kv[1], version, poetryScope));
+    }
+  }
+  return out2;
+}
+function parseGradleDependencies(buildGradle) {
+  if (!buildGradle)
+    return [];
+  const out2 = [];
+  const re = /\b(implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|classpath)\s*[(\s]\s*['"]([\w.-]+:[\w.-]+(?::[\w.\-+]+)?)['"]/g;
+  let m;
+  while ((m = re.exec(buildGradle)) !== null) {
+    const config = m[1];
+    const coord = m[2].split(":");
+    if (coord.length < 2)
+      continue;
+    const name2 = `${coord[0]}:${coord[1]}`;
+    const version = coord[2] ?? "unknown";
+    const scope = config.startsWith("test") ? "dev" : "required";
+    out2.push(dep("maven", name2, version, scope));
   }
   return out2;
 }
@@ -46753,7 +46943,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.202.0";
+var version = "3.204.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -47411,7 +47601,10 @@ SBOM OPTIONS:
   --prod-only                Exclude dev/test dependencies
   --deterministic            Omit timestamp / serialNumber / namespace for reproducible output
   -o, --output <file>        Write the document to a file (default: stdout)
-                               Discovers package.json / requirements.txt / pom.xml / Cargo.toml / go.mod.
+                               Discovers package.json / requirements.txt / pyproject.toml /
+                               pom.xml / build.gradle(.kts) / Cargo.toml / go.mod.
+                               A package-lock.json supersedes its package.json
+                               (exact + transitive versions).
                                CVE matching is out of scope (deterministic SAST — no network).
 
 EXAMPLES:
@@ -48451,11 +48644,24 @@ function parseCrossFileBudgetMs(raw) {
 }
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
+  "package-lock.json": parseNpmLockDependencies,
+  "npm-shrinkwrap.json": parseNpmLockDependencies,
   "requirements.txt": parsePypiDependencies,
+  "pyproject.toml": parsePyprojectDependencies,
+  "poetry.lock": parsePoetryLockDependencies,
   "pom.xml": parseMavenDependencies,
+  "build.gradle": parseGradleDependencies,
+  "build.gradle.kts": parseGradleDependencies,
   "Cargo.toml": parseCargoDependencies,
+  "Cargo.lock": parseCargoLockDependencies,
   "go.mod": parseGoDependencies
 };
+var SBOM_SUPERSEDES = {
+  "package-lock.json": "package.json",
+  "npm-shrinkwrap.json": "package.json",
+  "poetry.lock": "pyproject.toml",
+  "Cargo.lock": "Cargo.toml"
+};
 var SBOM_SKIP_DIRS = /^(node_modules|vendor|target|dist|build|out|coverage)$/;
 async function collectManifestFiles(targetPath) {
   const found = [];
@@ -48489,22 +48695,31 @@ async function runSbom(targetPath, options) {
   }
   const manifests = await collectManifestFiles(absPath);
   if (manifests.length === 0) {
-    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pom.xml, Cargo.toml, go.mod)"));
+    console.error(colors.red("Error: no supported manifests found (package.json/-lock, requirements.txt, pyproject.toml, poetry.lock, pom.xml, build.gradle, Cargo.toml/.lock, go.mod)"));
     process.exit(1);
   }
-  let deps = [];
-  let projectName = options.name;
+  const supersededInDir = new Set;
   for (const m of manifests) {
-    const content = readFileSync(m, "utf-8");
-    deps.push(...SBOM_MANIFESTS[basename(m)](content));
-    if (!projectName && basename(m) === "package.json") {
+    const superseded = SBOM_SUPERSEDES[basename(m)];
+    if (superseded)
+      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
+  }
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
+  let projectName = options.name;
+  if (!projectName) {
+    const pkg = manifests.find((m) => basename(m) === "package.json");
+    if (pkg) {
       try {
-        const n = JSON.parse(content).name;
+        const n = JSON.parse(readFileSync(pkg, "utf-8")).name;
         if (typeof n === "string" && n)
           projectName = n;
       } catch {}
     }
   }
+  let deps = [];
+  for (const m of effective) {
+    deps.push(...SBOM_MANIFESTS[basename(m)](readFileSync(m, "utf-8")));
+  }
   const seen = new Set;
   deps = deps.filter((d) => {
     const key = `${d.ecosystem}|${d.name}|${d.version}|${d.scope}`;
@@ -48528,10 +48743,10 @@ async function runSbom(targetPath, options) {
   const out2 = JSON.stringify(doc, null, 2);
   if (options.output) {
     writeFileSync(options.output, out2);
-    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${effective.length} manifest(s)`));
   } else {
     console.log(out2);
-    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${effective.length} manifest(s)`));
   }
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.202.0",
+  "version": "3.204.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.202.0"
+    "circle-ir": "^3.204.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",