cognium-dev 3.204.0 → 3.205.0

package/dist/cli.js

@@ -13632,7 +13632,13 @@ var SAFE_RECEIVERS_BY_METHOD = {
     "graphql",
     "apollo",
     "querybuilder",
-    "criteria"
+    "criteria",
+    "logger",
+    "logging",
+    "winston",
+    "pino",
+    "bunyan",
+    "console"
   ]),
   authenticate: new Set([
     "auth",
@@ -45992,7 +45998,10 @@ function parseNpmLockDependencies(packageLock) {
       if (!name2)
         continue;
       const version = typeof info2.version === "string" ? info2.version : "unknown";
-      out2.push(dep("npm", name2, version, scopeOf(info2)));
+      const entry = dep("npm", name2, version, scopeOf(info2));
+      if (typeof info2.license === "string" && info2.license)
+        entry.license = info2.license;
+      out2.push(entry);
     }
   } else if (root.dependencies && typeof root.dependencies === "object") {
     const walk = (deps) => {
@@ -46280,7 +46289,8 @@ function toCycloneDx(deps, meta = {}) {
     metadata2.component = {
       type: "application",
       name: meta.name,
-      ...meta.version ? { version: meta.version } : {}
+      ...meta.version ? { version: meta.version } : {},
+      ...meta.license ? { licenses: [{ license: { name: meta.license } }] } : {}
     };
   }
   bom.metadata = metadata2;
@@ -46290,6 +46300,7 @@ function toCycloneDx(deps, meta = {}) {
     version: d.version,
     purl: d.purl,
     scope: d.scope === "dev" ? "excluded" : d.scope === "optional" ? "optional" : "required",
+    ...d.license ? { licenses: [{ license: { name: d.license } }] } : {},
     "bom-ref": d.purl
   }));
   return bom;
@@ -46305,6 +46316,8 @@ function toSpdx(deps, meta = {}) {
     versionInfo: d.version,
     downloadLocation: "NOASSERTION",
     filesAnalyzed: false,
+    licenseConcluded: "NOASSERTION",
+    licenseDeclared: d.license ?? "NOASSERTION",
     externalRefs: [
       {
         referenceCategory: "PACKAGE-MANAGER",
@@ -46943,7 +46956,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.204.0";
+var version = "3.205.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -48706,13 +48719,16 @@ async function runSbom(targetPath, options) {
   }
   const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
   let projectName = options.name;
-  if (!projectName) {
+  let projectLicense;
+  {
     const pkg = manifests.find((m) => basename(m) === "package.json");
     if (pkg) {
       try {
-        const n = JSON.parse(readFileSync(pkg, "utf-8")).name;
-        if (typeof n === "string" && n)
-          projectName = n;
+        const parsed = JSON.parse(readFileSync(pkg, "utf-8"));
+        if (!projectName && typeof parsed.name === "string" && parsed.name)
+          projectName = parsed.name;
+        if (typeof parsed.license === "string" && parsed.license)
+          projectLicense = parsed.license;
       } catch {}
     }
   }
@@ -48733,6 +48749,8 @@ async function runSbom(targetPath, options) {
   if (!projectName)
     projectName = basename(absPath) || "project";
   const meta = { name: projectName, tool: "cognium-dev" };
+  if (projectLicense)
+    meta.license = projectLicense;
   if (!options.deterministic) {
     meta.timestamp = new Date().toISOString();
     const { randomUUID } = await import("crypto");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.204.0",
+  "version": "3.205.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.204.0"
+    "circle-ir": "^3.205.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",