cognium-dev 3.203.0 → 3.204.0

package/dist/cli.js

@@ -45966,6 +45966,99 @@ function parsePep508(spec) {
   const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
   return { name: m[1], version };
 }
+function parseNpmLockDependencies(packageLock) {
+  if (!packageLock)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(packageLock);
+  } catch {
+    return [];
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const root = parsed;
+  const out2 = [];
+  const scopeOf = (info2) => info2.dev === true ? "dev" : info2.optional === true ? "optional" : "required";
+  const packages = root.packages;
+  if (packages && typeof packages === "object") {
+    for (const [path, raw] of Object.entries(packages)) {
+      if (!path || !raw || typeof raw !== "object")
+        continue;
+      const info2 = raw;
+      const marker = "node_modules/";
+      const idx = path.lastIndexOf(marker);
+      const name2 = idx >= 0 ? path.slice(idx + marker.length) : typeof info2.name === "string" ? info2.name : path;
+      if (!name2)
+        continue;
+      const version = typeof info2.version === "string" ? info2.version : "unknown";
+      out2.push(dep("npm", name2, version, scopeOf(info2)));
+    }
+  } else if (root.dependencies && typeof root.dependencies === "object") {
+    const walk = (deps) => {
+      for (const [name2, raw] of Object.entries(deps)) {
+        if (!raw || typeof raw !== "object")
+          continue;
+        const info2 = raw;
+        const version = typeof info2.version === "string" ? info2.version : "unknown";
+        out2.push(dep("npm", name2, version, scopeOf(info2)));
+        if (info2.dependencies && typeof info2.dependencies === "object") {
+          walk(info2.dependencies);
+        }
+      }
+    };
+    walk(root.dependencies);
+  }
+  const seen = new Set;
+  return out2.filter((d) => {
+    const key = `${d.name}|${d.version}|${d.scope}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseTomlPackageArray(content, ecosystem) {
+  const out2 = [];
+  let name2 = null;
+  let version = null;
+  let inPackage = false;
+  const flush = () => {
+    if (inPackage && name2 && version)
+      out2.push(dep(ecosystem, name2, version, "required"));
+    name2 = null;
+    version = null;
+  };
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") {
+      flush();
+      inPackage = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      flush();
+      inPackage = false;
+      continue;
+    }
+    if (!inPackage)
+      continue;
+    const nm = line.match(/^name\s*=\s*"([^"]+)"/);
+    if (nm)
+      name2 = nm[1];
+    const vm = line.match(/^version\s*=\s*"([^"]+)"/);
+    if (vm)
+      version = vm[1];
+  }
+  flush();
+  return out2;
+}
+function parseCargoLockDependencies(cargoLock) {
+  return cargoLock ? parseTomlPackageArray(cargoLock, "cargo") : [];
+}
+function parsePoetryLockDependencies(poetryLock) {
+  return poetryLock ? parseTomlPackageArray(poetryLock, "pypi") : [];
+}
 function parsePypiDependencies(requirementsTxt) {
   if (!requirementsTxt)
     return [];
@@ -46850,7 +46943,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.203.0";
+var version = "3.204.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -47510,6 +47603,8 @@ SBOM OPTIONS:
   -o, --output <file>        Write the document to a file (default: stdout)
                                Discovers package.json / requirements.txt / pyproject.toml /
                                pom.xml / build.gradle(.kts) / Cargo.toml / go.mod.
+                               A package-lock.json supersedes its package.json
+                               (exact + transitive versions).
                                CVE matching is out of scope (deterministic SAST — no network).
 
 EXAMPLES:
@@ -48549,14 +48644,24 @@ function parseCrossFileBudgetMs(raw) {
 }
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
+  "package-lock.json": parseNpmLockDependencies,
+  "npm-shrinkwrap.json": parseNpmLockDependencies,
   "requirements.txt": parsePypiDependencies,
   "pyproject.toml": parsePyprojectDependencies,
+  "poetry.lock": parsePoetryLockDependencies,
   "pom.xml": parseMavenDependencies,
   "build.gradle": parseGradleDependencies,
   "build.gradle.kts": parseGradleDependencies,
   "Cargo.toml": parseCargoDependencies,
+  "Cargo.lock": parseCargoLockDependencies,
   "go.mod": parseGoDependencies
 };
+var SBOM_SUPERSEDES = {
+  "package-lock.json": "package.json",
+  "npm-shrinkwrap.json": "package.json",
+  "poetry.lock": "pyproject.toml",
+  "Cargo.lock": "Cargo.toml"
+};
 var SBOM_SKIP_DIRS = /^(node_modules|vendor|target|dist|build|out|coverage)$/;
 async function collectManifestFiles(targetPath) {
   const found = [];
@@ -48590,22 +48695,31 @@ async function runSbom(targetPath, options) {
   }
   const manifests = await collectManifestFiles(absPath);
   if (manifests.length === 0) {
-    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pyproject.toml, pom.xml, build.gradle, Cargo.toml, go.mod)"));
+    console.error(colors.red("Error: no supported manifests found (package.json/-lock, requirements.txt, pyproject.toml, poetry.lock, pom.xml, build.gradle, Cargo.toml/.lock, go.mod)"));
     process.exit(1);
   }
-  let deps = [];
-  let projectName = options.name;
+  const supersededInDir = new Set;
   for (const m of manifests) {
-    const content = readFileSync(m, "utf-8");
-    deps.push(...SBOM_MANIFESTS[basename(m)](content));
-    if (!projectName && basename(m) === "package.json") {
+    const superseded = SBOM_SUPERSEDES[basename(m)];
+    if (superseded)
+      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
+  }
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
+  let projectName = options.name;
+  if (!projectName) {
+    const pkg = manifests.find((m) => basename(m) === "package.json");
+    if (pkg) {
       try {
-        const n = JSON.parse(content).name;
+        const n = JSON.parse(readFileSync(pkg, "utf-8")).name;
         if (typeof n === "string" && n)
           projectName = n;
       } catch {}
     }
   }
+  let deps = [];
+  for (const m of effective) {
+    deps.push(...SBOM_MANIFESTS[basename(m)](readFileSync(m, "utf-8")));
+  }
   const seen = new Set;
   deps = deps.filter((d) => {
     const key = `${d.ecosystem}|${d.name}|${d.version}|${d.scope}`;
@@ -48629,10 +48743,10 @@ async function runSbom(targetPath, options) {
   const out2 = JSON.stringify(doc, null, 2);
   if (options.output) {
     writeFileSync(options.output, out2);
-    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${effective.length} manifest(s)`));
   } else {
     console.log(out2);
-    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${effective.length} manifest(s)`));
   }
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.203.0",
+  "version": "3.204.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.203.0"
+    "circle-ir": "^3.204.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",