cra-audit 2.1.1 → 2.3.0

package/src/core/project-source.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { parseLockfile } = require('./lockfile-parser');
+const { readSbom } = require('./sbom-reader');
+const { readManifests, hasManifests } = require('./manifest-reader');
+
+/**
+ * Decides where the components of a project come from:
+ *
+ *  - `sbom`:          an input SBOM (`-i`), any ecosystem
+ *  - `npm`:           the npm/Yarn/pnpm lockfile (native, richest data)
+ *  - `manifest`:      requirements.txt / poetry.lock / go.mod / pom.xml… when
+ *                     there is no npm lockfile
+ *  - `npm+manifest`:  both in the same folder (e.g. a JS front end next to a
+ *                     Python service); vulnerabilities cover both
+ *
+ * `parsed` is what the scanner, license check, VEX and SARIF consume; it is
+ * null for plain npm projects, which keep their existing code paths.
+ *
+ * @param {string} projectRoot
+ * @param {{ input?: string|null }} [options]
+ */
+function loadProject(projectRoot, { input = null } = {}) {
+  if (input) {
+    const parsed = readSbom(input);
+    return { mode: 'sbom', parsed, manifests: null };
+  }
+
+  const lock = parseLockfile(projectRoot);
+  const manifests = hasManifests(projectRoot) ? readManifests(projectRoot) : null;
+
+  if (lock.ok && manifests) {
+    // npm components keep their name-based lookups; manifest ones use purls.
+    const parsed = {
+      ...lock,
+      purlBased: false,
+      components: [...lock.components, ...manifests.components],
+      root: { ...lock.root, dependsOn: [...lock.root.dependsOn, ...manifests.root.dependsOn] },
+    };
+    return { mode: 'npm+manifest', parsed, manifests };
+  }
+  if (!lock.ok && manifests) return { mode: 'manifest', parsed: manifests, manifests };
+  return { mode: 'npm', parsed: null, manifests: null };
+}
+
+/**
+ * The nearest folder, walking up from `start`, with a package.json or a
+ * supported manifest of another ecosystem. Null when there is none.
+ */
+function findAnyProjectRoot(start) {
+  let dir = path.resolve(start);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json')) || hasManifests(dir)) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+module.exports = { loadProject, findAnyProjectRoot };

package/src/core/readiness.js

@@ -5,6 +5,7 @@ const path = require('node:path');
 const { readJson } = require('../utils/fs');
 const { parseLockfile } = require('./lockfile-parser');
 const { repositoryUrl } = require('./installed-metadata');
+const { readManifests } = require('./manifest-reader');
 
 /**
  * Organisational CRA duties that can be checked from the repository itself:
@@ -102,9 +103,17 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
   }
 
   // --- SBOM ---------------------------------------------------------------------
+  // npm projects: a lockfile cra-audit builds the SBOM from. Other ecosystems:
+  // an SBOM produced by their own tooling (Syft, cdxgen…) kept in the repo.
   const parsed = parseLockfile(projectRoot);
-  add('sbom', 'A lockfile to generate the SBOM from', 'required', parsed.ok,
-    parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)` : parsed.error, 'CRA Annex I Part II (1)');
+  const sbomFile = parsed.ok ? null : findSbomFile(projectRoot);
+  const manifests = parsed.ok || sbomFile ? null : readManifests(projectRoot);
+  add('sbom', 'Dependency inventory for the SBOM (lockfile, manifest or SBOM file)', 'required', parsed.ok || sbomFile || manifests,
+    parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)`
+      : sbomFile ? `Found ${sbomFile}`
+        : manifests ? `${manifests.files.join(', ')} (${manifests.components.length} components)`
+          : 'No lockfile, supported manifest or SBOM file found.',
+    'CRA Annex I Part II (1)');
 
   add('package-repository', 'package.json links the source repository', 'recommended', Boolean(repositoryUrl(pkg.repository)),
     repositoryUrl(pkg.repository) || 'No "repository" field', 'TR-03183-2 §5.2.4');
@@ -216,6 +225,21 @@ function securityTxtTemplate({ advisories, repo, expires }) {
   return lines.join('\n');
 }
 
+/** An SBOM file at the root or in sbom/: *.cdx.json, *.spdx.json, bom.json… */
+function findSbomFile(root) {
+  for (const dir of ['', 'sbom']) {
+    let names = [];
+    try {
+      names = fs.readdirSync(path.join(root, dir));
+    } catch {
+      continue;
+    }
+    const match = names.find((n) => /(\.cdx\.json|\.spdx\.json|^bom\.json|^sbom\.json)$/i.test(n));
+    if (match) return dir ? `${dir}/${match}` : match;
+  }
+  return null;
+}
+
 function firstExisting(root, candidates) {
   return candidates.find((rel) => fs.existsSync(path.join(root, rel))) || null;
 }

package/src/core/sbom-reader.js

@@ -0,0 +1,297 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Reads an existing SBOM (CycloneDX JSON, SPDX 2.x JSON or SPDX 3.0 JSON-LD)
+ * into the same shape parseLockfile() returns, so the vulnerability scan, the
+ * license check, the VEX and the SARIF work for any ecosystem: Python, Java,
+ * Go, Rust, .NET, PHP, Ruby… Each component is identified by its Package URL
+ * (purl), which OSV.dev resolves directly.
+ *
+ * Generate the SBOM with the ecosystem's tooling (Syft, cdxgen, Trivy,
+ * cyclonedx-py, the CycloneDX Maven/Gradle plugins…) and pass it with `-i`.
+ *
+ * @param {string} file
+ * @returns {{
+ *   ok: boolean, error?: string, manager: 'sbom', format: 'cyclonedx'|'spdx',
+ *   lockfileName: string, sourceFile: string, document: object,
+ *   root: { name: string, version: string, dependsOn: string[] },
+ *   components: Array<object>, unidentified: number, dependencyGraphComplete: boolean
+ * }}
+ */
+function readSbom(file) {
+  let document;
+  try {
+    document = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (err) {
+    return fail(file, `Could not read the SBOM ${file}: ${err.code === 'ENOENT' ? 'file not found' : err.message}`);
+  }
+
+  let result;
+  if (document && (document.bomFormat === 'CycloneDX' || Array.isArray(document.components))) {
+    result = fromCycloneDx(document);
+  } else if (document && document.spdxVersion) {
+    result = fromSpdx2(document);
+  } else if (document && Array.isArray(document['@graph'])) {
+    result = fromSpdx3(document);
+  } else {
+    return fail(file, `${file} is not a CycloneDX or SPDX JSON document.`);
+  }
+
+  // Only components with a purl can be looked up; keep the count visible.
+  const identified = result.components.filter((c) => c.purl);
+  return {
+    ok: true,
+    manager: 'sbom',
+    purlBased: true,
+    format: result.format,
+    lockfileName: path.basename(file),
+    sourceFile: file,
+    document,
+    root: result.root,
+    components: dedupe(identified),
+    unidentified: result.components.length - identified.length,
+    dependencyGraphComplete: result.complete,
+  };
+}
+
+// --- CycloneDX ---------------------------------------------------------------
+
+function fromCycloneDx(doc) {
+  const byRef = new Map();
+  const components = [];
+  const visit = (list) => {
+    for (const c of list || []) {
+      if (!c || typeof c !== 'object') continue;
+      if (c.type !== 'file' && c.type !== 'operating-system') {
+        const comp = component({
+          purl: c.purl,
+          name: c.group ? `${c.group}/${c.name}` : c.name,
+          version: c.version,
+          license: cdxLicense(c.licenses),
+          optional: c.scope === 'optional' || c.scope === 'excluded',
+        });
+        components.push(comp);
+        if (c['bom-ref']) byRef.set(c['bom-ref'], comp);
+      }
+      visit(c.components); // nested components (assemblies)
+    }
+  };
+  visit(doc.components);
+
+  const meta = (doc.metadata && doc.metadata.component) || {};
+  const root = rootInfo(meta.name, meta.version, meta.purl);
+  const rootRef = meta['bom-ref'];
+
+  let complete = Array.isArray(doc.dependencies) && doc.dependencies.length > 0;
+  for (const dep of doc.dependencies || []) {
+    const targets = (dep.dependsOn || []).map((ref) => byRef.get(ref)).filter(Boolean).map((c) => c.key);
+    if (dep.ref === rootRef) root.dependsOn.push(...targets);
+    const from = byRef.get(dep.ref);
+    if (from) from.dependsOn.push(...targets);
+  }
+  if ((doc.compositions || []).some((c) => c && c.aggregate && c.aggregate !== 'complete')) complete = false;
+  return { format: 'cyclonedx', components, root, complete };
+}
+
+function cdxLicense(licenses) {
+  if (!Array.isArray(licenses) || !licenses.length) return null;
+  const ids = licenses.map((l) => l.expression || (l.license && (l.license.id || l.license.name))).filter(Boolean);
+  return ids.length ? [...new Set(ids)].join(' AND ') : null;
+}
+
+// --- SPDX 2.x ----------------------------------------------------------------
+
+function fromSpdx2(doc) {
+  const byId = new Map();
+  const components = [];
+  const described = new Set(doc.documentDescribes || []);
+  for (const r of doc.relationships || []) {
+    if (r.relationshipType === 'DESCRIBES' && r.spdxElementId === 'SPDXRef-DOCUMENT') described.add(r.relatedSpdxElement);
+  }
+
+  let rootPkg = null;
+  for (const pkg of doc.packages || []) {
+    const ref = (pkg.externalRefs || []).find((r) => r.referenceType === 'purl');
+    if (described.has(pkg.SPDXID) && !rootPkg) {
+      rootPkg = pkg;
+      continue;
+    }
+    const comp = component({
+      purl: ref && ref.referenceLocator,
+      name: pkg.name,
+      version: pkg.versionInfo,
+      license: spdxLicense(pkg.licenseConcluded) || spdxLicense(pkg.licenseDeclared),
+    });
+    components.push(comp);
+    byId.set(pkg.SPDXID, comp);
+  }
+
+  const rootRef = rootPkg && (rootPkg.externalRefs || []).find((r) => r.referenceType === 'purl');
+  const root = rootInfo((rootPkg && rootPkg.name) || doc.name, rootPkg && rootPkg.versionInfo, rootRef && rootRef.referenceLocator);
+  const rootId = rootPkg && rootPkg.SPDXID;
+
+  let edges = 0;
+  for (const r of doc.relationships || []) {
+    // A DEPENDS_ON B; B DEPENDENCY_OF A; A CONTAINS B.
+    let from = r.spdxElementId;
+    let to = r.relatedSpdxElement;
+    if (r.relationshipType === 'DEPENDENCY_OF') [from, to] = [to, from];
+    else if (!['DEPENDS_ON', 'CONTAINS', 'RUNTIME_DEPENDENCY_OF', 'DEV_DEPENDENCY_OF'].includes(r.relationshipType)) continue;
+    if (r.relationshipType.endsWith('_DEPENDENCY_OF')) [from, to] = [to, from];
+    const target = byId.get(to);
+    if (!target) continue;
+    edges++;
+    if (from === rootId) root.dependsOn.push(target.key);
+    else if (byId.has(from)) byId.get(from).dependsOn.push(target.key);
+    if (r.relationshipType === 'DEV_DEPENDENCY_OF') target.optional = true;
+  }
+  return { format: 'spdx', components, root, complete: edges > 0 };
+}
+
+function spdxLicense(value) {
+  return value && value !== 'NOASSERTION' && value !== 'NONE' ? value : null;
+}
+
+// --- SPDX 3.0 (JSON-LD) ----------------------------------------------------------
+
+function fromSpdx3(doc) {
+  const byId = new Map();
+  const components = [];
+  let rootId = null;
+
+  for (const el of doc['@graph']) {
+    if (el.type === 'SpdxDocument' && Array.isArray(el.rootElement)) rootId = rootId || el.rootElement[0];
+  }
+  let root = rootInfo(doc.name);
+
+  for (const el of doc['@graph']) {
+    if (el.type !== 'software_Package') continue;
+    const id = el.spdxId || el['@id'];
+    if (id && id === rootId) {
+      root = rootInfo(el.name || root.name, el.software_packageVersion, el.software_packageUrl);
+      continue;
+    }
+    const comp = component({
+      purl: el.software_packageUrl,
+      name: el.name,
+      version: el.software_packageVersion,
+      license: null,
+    });
+    components.push(comp);
+    if (id) byId.set(id, comp);
+  }
+
+  let edges = 0;
+  for (const el of doc['@graph']) {
+    if (el.type !== 'Relationship' || !['dependsOn', 'contains'].includes(el.relationshipType)) continue;
+    for (const to of el.to || []) {
+      const target = byId.get(to);
+      if (!target) continue;
+      edges++;
+      if (el.from === rootId) root.dependsOn.push(target.key);
+      else if (byId.has(el.from)) byId.get(el.from).dependsOn.push(target.key);
+    }
+  }
+  return { format: 'spdx', components, root, complete: edges > 0 };
+}
+
+/**
+ * The product the SBOM describes. Without a purl in the SBOM it gets a
+ * `pkg:generic` one, so VEX statements still name the product unambiguously.
+ */
+function rootInfo(name, version, purl) {
+  const n = name || 'unknown';
+  const v = version || '0.0.0';
+  const parsed = parsePurl(purl);
+  return { name: n, version: v, purl: parsed ? parsed.canonical : `pkg:generic/${encodeURIComponent(n)}@${encodeURIComponent(v)}`, dependsOn: [] };
+}
+
+// --- Components -------------------------------------------------------------------
+
+/**
+ * Normalizes an SBOM component. The name and version come from the purl when
+ * there is one (it is what OSV understands), else from the SBOM fields.
+ */
+function component({ purl, name, version, license, optional = false }) {
+  const parsed = parsePurl(purl);
+  const clean = parsed ? parsed.canonical : null;
+  const displayName = parsed ? parsed.displayName : name || 'unknown';
+  const ver = (parsed && parsed.version) || version || null;
+  return {
+    key: clean || `${displayName}@${ver}`,
+    name: displayName,
+    version: ver,
+    purl: clean,
+    ecosystem: parsed ? parsed.type : null,
+    osvName: parsed ? parsed.osvName : displayName,
+    license: license || null,
+    scope: optional ? 'optional' : 'required',
+    dev: optional,
+    optional,
+    dependsOn: [],
+  };
+}
+
+/**
+ * Minimal Package URL parser (https://github.com/package-url/purl-spec).
+ * Returns the canonical purl without qualifiers/subpath and the name in the
+ * form each ecosystem uses (OSV naming): Maven `group:artifact`, npm
+ * `@scope/name`, Go/Composer `namespace/name`.
+ */
+function parsePurl(purl) {
+  if (typeof purl !== 'string' || !purl.startsWith('pkg:')) return null;
+  let rest = purl.slice(4).split('#')[0].split('?')[0];
+  // The version separator is the last `@` after the last `/` (an unencoded
+  // npm scope, `pkg:npm/@scope/name`, is not a version).
+  const at = rest.lastIndexOf('@');
+  let version = null;
+  let rawVersion = '';
+  if (at > rest.lastIndexOf('/')) {
+    rawVersion = rest.slice(at + 1);
+    version = decodeURIComponent(rawVersion);
+    rest = rest.slice(0, at);
+  }
+  const parts = rest.split('/');
+  const type = parts.shift().toLowerCase();
+  if (!type || !parts.length) return null;
+  const name = decodeURIComponent(parts.pop());
+  const namespace = parts.map(decodeURIComponent).join('/');
+
+  let osvName = name;
+  if (type === 'maven') osvName = namespace ? `${namespace}:${name}` : name;
+  else if (namespace) osvName = `${namespace}/${name}`;
+
+  return {
+    type,
+    namespace,
+    name,
+    version,
+    osvName,
+    displayName: osvName,
+    canonical: `pkg:${rest}${rawVersion ? `@${rawVersion}` : ''}`,
+  };
+}
+
+function dedupe(components) {
+  const seen = new Map();
+  for (const c of components) {
+    const existing = seen.get(c.key);
+    if (!existing) seen.set(c.key, c);
+    else existing.dependsOn.push(...c.dependsOn);
+  }
+  for (const c of seen.values()) c.dependsOn = [...new Set(c.dependsOn)].sort();
+  return [...seen.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+function fail(file, error) {
+  return {
+    ok: false, error, manager: 'sbom', format: null, lockfileName: path.basename(file), sourceFile: file,
+    document: null, root: rootInfo(), components: [], unidentified: 0,
+    dependencyGraphComplete: false,
+  };
+}
+
+module.exports = { readSbom, parsePurl };

package/src/core/sbom-validator.js

@@ -118,9 +118,15 @@ function validateSpdx(doc) {
   pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
 
   const relationships = toArray(doc.relationships);
+  // Dependency edges as written by SPDX tools (Syft uses CONTAINS and
+  // DEPENDENCY_OF); the described package is the product, not a component.
+  const graphTypes = /^(DEPENDS_ON|CONTAINS|DEPENDENCY_OF|[A-Z_]+_DEPENDENCY_OF)$/;
+  const described = new Set(toArray(doc.documentDescribes));
   const inGraph = new Set();
   for (const r of relationships) {
-    if (r && r.relationshipType === 'DEPENDS_ON') {
+    if (!r) continue;
+    if (r.relationshipType === 'DESCRIBES' && r.spdxElementId === 'SPDXRef-DOCUMENT') described.add(r.relatedSpdxElement);
+    if (graphTypes.test(r.relationshipType)) {
       inGraph.add(r.spdxElementId);
       inGraph.add(r.relatedSpdxElement);
     }
@@ -138,7 +144,7 @@ function validateSpdx(doc) {
   };
   for (const pkg of packages) {
     const label = pkg.name || pkg.SPDXID || 'unknown';
-    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
+    if (pkg.SPDXID === 'SPDXRef-Package-root' || described.has(pkg.SPDXID)) continue;
     if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
     if (!isAssertion(pkg.originator) && !isAssertion(pkg.supplier)) { stats.missingCreator++; issues.push(`Package without an originator: ${label}`); }
     if (!pkg.packageFileName) { stats.missingFilename++; issues.push(`Package without a filename: ${label}`); }
@@ -158,7 +164,7 @@ function validateSpdx(doc) {
   pushCheck(checks, 'componentHashes', 'All packages have a SHA-512 checksum', stats.missingHash === 0);
   pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
   pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
-  pushCheck(checks, 'dependencyGraph', 'Dependency relationships (DEPENDS_ON) declared', stats.missingDependencies === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency relationships declared for every package', stats.missingDependencies === 0);
 
   return summarize('spdx', checks, issues, stats);
 }

package/src/core/vex.js

@@ -106,18 +106,18 @@ function acceptance(finding, policy) {
 /**
  * Builds a VEX document for the vulnerability findings of an audit.
  *
- * @param {{ name: string, version: string }} product
+ * @param {{ name: string, version: string, purl?: string }} product
  * @param {object} vulnSection Result of scanVulnerabilities().
  * @param {object} policy
  * @param {{ format?: 'cyclonedx'|'openvex', author?: string|null }} [options]
  */
 function buildVex(product, vulnSection, policy, { format = 'cyclonedx', author = null } = {}) {
   const entries = normalizeAllowlist(policy);
-  const productPurl = buildPurl(product.name, product.version);
+  const productPurl = product.purl || buildPurl(product.name, product.version);
   const statements = [];
 
   for (const finding of vulnSection.vulnerabilities || []) {
-    const purl = buildPurl(finding.name, finding.version);
+    const purl = finding.purl || buildPurl(finding.name, finding.version);
     for (const source of finding.sources) {
       const assessment = finding.malicious ? null : assessmentFor(finding, source, entries);
       statements.push({ finding, source, purl, assessment });

package/src/core/vuln-scanner.js

@@ -5,7 +5,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { runJson } = require('../utils/exec');
 const { exists, readJson } = require('../utils/fs');
-const { parseLockfile, toNpmLockfile, componentKey } = require('./lockfile-parser');
+const { parseLockfile, toNpmLockfile, componentKey, buildPurl } = require('./lockfile-parser');
 const {
   queryOsv, osvSeverity, cvssScore, isMalicious, fixedVersion, compareSemver,
 } = require('./osv');
@@ -25,20 +25,34 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  *    CVEs found are cross-checked with the CISA KEV catalogue.
  *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
+ * Other ecosystems are scanned by passing, as `parsed`, the result of
+ * readSbom() (an input SBOM) or readManifests() (requirements.txt, go.mod,
+ * pom.xml…); their components are looked up in OSV.dev by Package URL.
+ *
  * @param {string} projectRoot
- * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean }} [options]
+ * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean, parsed?: object }} [options]
  * @returns {Promise<object>}
  */
-async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true } = {}) {
-  if (source === 'npm') return npmAuditSection(projectRoot, { production });
+async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true, parsed: given } = {}) {
+  const fromSbom = Boolean(given && given.purlBased);
+  if (source === 'npm') {
+    if (fromSbom) {
+      return { ok: false, error: '`npm audit` only scans npm projects; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
+    }
+    return npmAuditSection(projectRoot, { production });
+  }
 
-  const parsed = parseLockfile(projectRoot);
+  const parsed = given || parseLockfile(projectRoot);
   if (!parsed.ok) {
     return { ok: false, error: parsed.error, counts: emptyCounts(), vulnerabilities: [] };
   }
 
-  const rootPkg = readJson(path.join(projectRoot, 'package.json')) || {};
-  const components = production ? productionComponents(parsed, rootPkg) : parsed.components;
+  let components = parsed.components;
+  if (production) {
+    components = fromSbom
+      ? components.filter((c) => !c.optional)
+      : productionComponents(parsed, readJson(path.join(projectRoot, 'package.json')) || {});
+  }
   const scannable = components.filter((c) => c.name && c.version);
 
   const [osv, catalogue] = await Promise.all([
@@ -47,6 +61,7 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
   ]);
 
   if (!osv.ok) {
+    if (fromSbom) return { ok: false, error: osv.error, counts: emptyCounts(), vulnerabilities: [] };
     const fallback = npmAuditSection(projectRoot, { production });
     fallback.warnings = [`${osv.error}; fell back to \`npm audit\` (no malicious-package or KEV check).`];
     return fallback;
@@ -55,7 +70,7 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
   const direct = new Set(parsed.root.dependsOn);
   const vulnerabilities = [];
   for (const c of scannable) {
-    const key = componentKey(c.name, c.version);
+    const key = c.key || componentKey(c.name, c.version);
     const records = osv.byComponent.get(key);
     if (!records || !records.length) continue;
     vulnerabilities.push(toFinding(c, records, direct.has(key), catalogue));
@@ -73,6 +88,10 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
     ok: true,
     source: 'osv',
     scanned: scannable.length,
+    input: fromSbom
+      ? { file: parsed.sourceFile || parsed.lockfileName, format: parsed.format, unidentified: parsed.unidentified, notes: parsed.notes || [] }
+      : null,
+    ecosystems: [...new Set(scannable.map((c) => c.ecosystem || 'npm'))].sort(),
     kev: catalogue
       ? (catalogue.ok
         ? { checked: true, catalogVersion: catalogue.catalogVersion, entries: catalogue.count }
@@ -100,7 +119,7 @@ function toFinding(component, records, isDirect, catalogue) {
       cvss: cvssScore(record),
       cwe: (record.database_specific && record.database_specific.cwe_ids) || [],
       malicious: isMalicious(record),
-      fixed: fixedVersion(record, component.name, component.version),
+      fixed: fixedVersion(record, component.osvName || component.name, component.version),
       kev: kevEntry,
     };
   });
@@ -116,6 +135,9 @@ function toFinding(component, records, isDirect, catalogue) {
   return {
     name: component.name,
     version: component.version,
+    purl: component.purl || buildPurl(component.name, component.version),
+    ecosystem: component.ecosystem || 'npm',
+    location: component.location || null,
     severity,
     direct: isDirect,
     range: null,
@@ -150,7 +172,8 @@ function productionComponents(parsed, rootPkg) {
       if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
     }
   }
-  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+  // Components of other ecosystems (npm+manifest projects) use their own scope.
+  return parsed.components.filter((c) => (c.ecosystem ? !c.optional : seen.has(componentKey(c.name, c.version))));
 }
 
 function severityRank(severity) {
@@ -158,7 +181,7 @@ function severityRank(severity) {
 }
 
 function major(version) {
-  return parseInt(String(version).split('.')[0], 10);
+  return parseInt(String(version).replace(/^v/i, '').split('.')[0], 10);
 }
 
 /** `npm audit` source, used on request or as the OSV fallback. */

package/src/reporters/console.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 
 const SEVERITY_COLORS = {
@@ -37,6 +38,7 @@ function renderVulnerabilities(section) {
   }
   logger.detail(describeSources(section));
   for (const warning of section.warnings || []) logger.warn(warning);
+  for (const note of (section.input && section.input.notes) || []) logger.detail(note);
 
   const c = section.counts;
   if (c.total === 0) {
@@ -87,7 +89,11 @@ function describeSources(section) {
   const kev = section.kev && section.kev.checked
     ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
     : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
-  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${section.scanned} components`;
+  const scope = section.input
+    ? `${section.scanned} components from ${section.input.format === 'manifest' ? section.input.file : shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
+      (section.input.unidentified ? ` · ${section.input.unidentified} ${section.input.format === 'manifest' ? 'not pinned, skipped' : 'without purl skipped'}` : '')
+    : `${section.scanned} components${(section.ecosystems || []).length > 1 ? ` (${section.ecosystems.join(', ')})` : ''}`;
+  return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${scope}`;
 }
 
 /** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
@@ -116,7 +122,13 @@ function renderSbom(section) {
     logger.error(section.error);
     return;
   }
-  logger.detail(`Format: ${section.format} · Components: ${section.componentCount}`);
+  if (section.manifest) {
+    logger.detail(`Components read from ${section.files.join(', ')} (${section.ecosystems.join(', ')}): ${section.componentCount}`);
+    logger.warn('cra-audit builds TR-03183 SBOMs from npm lockfiles. For these ecosystems, commit the SBOM your');
+    logger.detail('build tooling produces (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and audit it with -i.');
+    return;
+  }
+  logger.detail(`${section.input ? `Input SBOM: ${shortPath(section.input)} · ` : ''}Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {
     const v = section.validation;
@@ -176,4 +188,10 @@ function renderSummary(report) {
   logger.log('');
 }
 
+/** A path relative to the working directory when it is inside it. */
+function shortPath(file) {
+  const rel = path.relative(process.cwd(), file);
+  return rel && !rel.startsWith('..') && !path.isAbsolute(rel) ? rel : file;
+}
+
 module.exports = { reportConsole };