cognium-dev 3.203.0 → 3.205.0

package/dist/cli.js

@@ -13632,7 +13632,13 @@ var SAFE_RECEIVERS_BY_METHOD = {
     "graphql",
     "apollo",
     "querybuilder",
-    "criteria"
+    "criteria",
+    "logger",
+    "logging",
+    "winston",
+    "pino",
+    "bunyan",
+    "console"
   ]),
   authenticate: new Set([
     "auth",
@@ -45966,6 +45972,102 @@ function parsePep508(spec) {
   const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
   return { name: m[1], version };
 }
+function parseNpmLockDependencies(packageLock) {
+  if (!packageLock)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(packageLock);
+  } catch {
+    return [];
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const root = parsed;
+  const out2 = [];
+  const scopeOf = (info2) => info2.dev === true ? "dev" : info2.optional === true ? "optional" : "required";
+  const packages = root.packages;
+  if (packages && typeof packages === "object") {
+    for (const [path, raw] of Object.entries(packages)) {
+      if (!path || !raw || typeof raw !== "object")
+        continue;
+      const info2 = raw;
+      const marker = "node_modules/";
+      const idx = path.lastIndexOf(marker);
+      const name2 = idx >= 0 ? path.slice(idx + marker.length) : typeof info2.name === "string" ? info2.name : path;
+      if (!name2)
+        continue;
+      const version = typeof info2.version === "string" ? info2.version : "unknown";
+      const entry = dep("npm", name2, version, scopeOf(info2));
+      if (typeof info2.license === "string" && info2.license)
+        entry.license = info2.license;
+      out2.push(entry);
+    }
+  } else if (root.dependencies && typeof root.dependencies === "object") {
+    const walk = (deps) => {
+      for (const [name2, raw] of Object.entries(deps)) {
+        if (!raw || typeof raw !== "object")
+          continue;
+        const info2 = raw;
+        const version = typeof info2.version === "string" ? info2.version : "unknown";
+        out2.push(dep("npm", name2, version, scopeOf(info2)));
+        if (info2.dependencies && typeof info2.dependencies === "object") {
+          walk(info2.dependencies);
+        }
+      }
+    };
+    walk(root.dependencies);
+  }
+  const seen = new Set;
+  return out2.filter((d) => {
+    const key = `${d.name}|${d.version}|${d.scope}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseTomlPackageArray(content, ecosystem) {
+  const out2 = [];
+  let name2 = null;
+  let version = null;
+  let inPackage = false;
+  const flush = () => {
+    if (inPackage && name2 && version)
+      out2.push(dep(ecosystem, name2, version, "required"));
+    name2 = null;
+    version = null;
+  };
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") {
+      flush();
+      inPackage = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      flush();
+      inPackage = false;
+      continue;
+    }
+    if (!inPackage)
+      continue;
+    const nm = line.match(/^name\s*=\s*"([^"]+)"/);
+    if (nm)
+      name2 = nm[1];
+    const vm = line.match(/^version\s*=\s*"([^"]+)"/);
+    if (vm)
+      version = vm[1];
+  }
+  flush();
+  return out2;
+}
+function parseCargoLockDependencies(cargoLock) {
+  return cargoLock ? parseTomlPackageArray(cargoLock, "cargo") : [];
+}
+function parsePoetryLockDependencies(poetryLock) {
+  return poetryLock ? parseTomlPackageArray(poetryLock, "pypi") : [];
+}
 function parsePypiDependencies(requirementsTxt) {
   if (!requirementsTxt)
     return [];
@@ -46187,7 +46289,8 @@ function toCycloneDx(deps, meta = {}) {
     metadata2.component = {
       type: "application",
       name: meta.name,
-      ...meta.version ? { version: meta.version } : {}
+      ...meta.version ? { version: meta.version } : {},
+      ...meta.license ? { licenses: [{ license: { name: meta.license } }] } : {}
     };
   }
   bom.metadata = metadata2;
@@ -46197,6 +46300,7 @@ function toCycloneDx(deps, meta = {}) {
     version: d.version,
     purl: d.purl,
     scope: d.scope === "dev" ? "excluded" : d.scope === "optional" ? "optional" : "required",
+    ...d.license ? { licenses: [{ license: { name: d.license } }] } : {},
     "bom-ref": d.purl
   }));
   return bom;
@@ -46212,6 +46316,8 @@ function toSpdx(deps, meta = {}) {
     versionInfo: d.version,
     downloadLocation: "NOASSERTION",
     filesAnalyzed: false,
+    licenseConcluded: "NOASSERTION",
+    licenseDeclared: d.license ?? "NOASSERTION",
     externalRefs: [
       {
         referenceCategory: "PACKAGE-MANAGER",
@@ -46850,7 +46956,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.203.0";
+var version = "3.205.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -47510,6 +47616,8 @@ SBOM OPTIONS:
   -o, --output <file>        Write the document to a file (default: stdout)
                                Discovers package.json / requirements.txt / pyproject.toml /
                                pom.xml / build.gradle(.kts) / Cargo.toml / go.mod.
+                               A package-lock.json supersedes its package.json
+                               (exact + transitive versions).
                                CVE matching is out of scope (deterministic SAST — no network).
 
 EXAMPLES:
@@ -48549,14 +48657,24 @@ function parseCrossFileBudgetMs(raw) {
 }
 var SBOM_MANIFESTS = {
   "package.json": parseNpmDependencies,
+  "package-lock.json": parseNpmLockDependencies,
+  "npm-shrinkwrap.json": parseNpmLockDependencies,
   "requirements.txt": parsePypiDependencies,
   "pyproject.toml": parsePyprojectDependencies,
+  "poetry.lock": parsePoetryLockDependencies,
   "pom.xml": parseMavenDependencies,
   "build.gradle": parseGradleDependencies,
   "build.gradle.kts": parseGradleDependencies,
   "Cargo.toml": parseCargoDependencies,
+  "Cargo.lock": parseCargoLockDependencies,
   "go.mod": parseGoDependencies
 };
+var SBOM_SUPERSEDES = {
+  "package-lock.json": "package.json",
+  "npm-shrinkwrap.json": "package.json",
+  "poetry.lock": "pyproject.toml",
+  "Cargo.lock": "Cargo.toml"
+};
 var SBOM_SKIP_DIRS = /^(node_modules|vendor|target|dist|build|out|coverage)$/;
 async function collectManifestFiles(targetPath) {
   const found = [];
@@ -48590,22 +48708,34 @@ async function runSbom(targetPath, options) {
   }
   const manifests = await collectManifestFiles(absPath);
   if (manifests.length === 0) {
-    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pyproject.toml, pom.xml, build.gradle, Cargo.toml, go.mod)"));
+    console.error(colors.red("Error: no supported manifests found (package.json/-lock, requirements.txt, pyproject.toml, poetry.lock, pom.xml, build.gradle, Cargo.toml/.lock, go.mod)"));
     process.exit(1);
   }
-  let deps = [];
-  let projectName = options.name;
+  const supersededInDir = new Set;
   for (const m of manifests) {
-    const content = readFileSync(m, "utf-8");
-    deps.push(...SBOM_MANIFESTS[basename(m)](content));
-    if (!projectName && basename(m) === "package.json") {
+    const superseded = SBOM_SUPERSEDES[basename(m)];
+    if (superseded)
+      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
+  }
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
+  let projectName = options.name;
+  let projectLicense;
+  {
+    const pkg = manifests.find((m) => basename(m) === "package.json");
+    if (pkg) {
       try {
-        const n = JSON.parse(content).name;
-        if (typeof n === "string" && n)
-          projectName = n;
+        const parsed = JSON.parse(readFileSync(pkg, "utf-8"));
+        if (!projectName && typeof parsed.name === "string" && parsed.name)
+          projectName = parsed.name;
+        if (typeof parsed.license === "string" && parsed.license)
+          projectLicense = parsed.license;
       } catch {}
     }
   }
+  let deps = [];
+  for (const m of effective) {
+    deps.push(...SBOM_MANIFESTS[basename(m)](readFileSync(m, "utf-8")));
+  }
   const seen = new Set;
   deps = deps.filter((d) => {
     const key = `${d.ecosystem}|${d.name}|${d.version}|${d.scope}`;
@@ -48619,6 +48749,8 @@ async function runSbom(targetPath, options) {
   if (!projectName)
     projectName = basename(absPath) || "project";
   const meta = { name: projectName, tool: "cognium-dev" };
+  if (projectLicense)
+    meta.license = projectLicense;
   if (!options.deterministic) {
     meta.timestamp = new Date().toISOString();
     const { randomUUID } = await import("crypto");
@@ -48629,10 +48761,10 @@ async function runSbom(targetPath, options) {
   const out2 = JSON.stringify(doc, null, 2);
   if (options.output) {
     writeFileSync(options.output, out2);
-    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${effective.length} manifest(s)`));
   } else {
     console.log(out2);
-    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${effective.length} manifest(s)`));
   }
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.203.0",
+  "version": "3.205.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.203.0"
+    "circle-ir": "^3.205.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",