cra-audit 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -8,6 +8,16 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.3.0] — Python, Go and Java without an SBOM tool
+
+### Highlights
+
+- **Native manifests**: `npx cra-audit` in a Python, Go or Java project reads `poetry.lock`, `uv.lock`, `Pipfile.lock` or `requirements*.txt`, `go.mod`, `gradle.lockfile` and `pom.xml` directly — no Syft/cdxgen step and no package.json needed. Same checks as npm: OSV vulnerabilities, malicious packages, CISA KEV with the Art. 14 clock, VEX and SARIF.
+- Findings and SARIF alerts point at the exact line of the manifest.
+- Only exact versions are audited: unpinned requirements, parent/BOM-managed Maven versions and version ranges are skipped and reported, never guessed. `pom.xml` covers declared dependencies (transitive ones need a Maven-generated SBOM).
+- Folders with an npm lockfile *and* one of these manifests are audited as a whole.
+- For these ecosystems the audit warns (instead of failing) about the missing TR-03183 SBOM and undeclared licenses; `sbom generate` explains how to produce one.
+
 ## [2.2.0] — Any language through its SBOM
 
 ### Highlights

package/README.md

@@ -5,7 +5,7 @@
 > Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline — native for npm, Yarn and pnpm, and for **any language** through its SBOM.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. For **Python, Java, Go, Rust, .NET, PHP, Ruby…** pass the SBOM produced by your usual tooling with `-i` ([details](#8-any-language-input-sbom--i)).
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. **Python, Go and Java** projects are read directly from `requirements.txt` / `poetry.lock` / `uv.lock` / `Pipfile.lock`, `go.mod`, `pom.xml` and `gradle.lockfile`, and **any other language** through the SBOM your tooling produces (`-i`) — [details](#8-other-languages-manifests-and-input-sbom).
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -151,7 +151,25 @@ npx cra-audit readiness --init   # creates SECURITY.md and .well-known/security.
 
 `--init` prefills the templates from `package.json` (GitHub private vulnerability reporting link, supported major version, a coordinated disclosure process and the Art. 14 24 h / 72 h / 14 days reporting commitments); fill in the `TODO` placeholders and run it again.
 
-### 8. Any language: input SBOM (`-i`)
+### 8. Other languages: manifests and input SBOM
+
+**Read directly — just run `npx cra-audit` in the project folder (no package.json needed):**
+
+| Ecosystem | Files | Notes |
+| --- | --- | --- |
+| Python | `poetry.lock`, `uv.lock`, `Pipfile.lock` (exact); otherwise `requirements*.txt` | Only `==` pins are audited; ranges are skipped and reported, never guessed. `-r` includes, extras, markers and `--hash` lines are handled. |
+| Go | `go.mod` | Every required module (direct and `// indirect`), with `replace` directives applied. |
+| Java | `gradle.lockfile` (exact), `pom.xml` | `pom.xml`: declared dependencies with `${property}` and `<dependencyManagement>` resolution; transitive ones need a Maven-generated SBOM. |
+
+Findings point at the exact line of the manifest (in the console and in SARIF). A folder with both an npm lockfile and one of these manifests (e.g. a front end next to a Go API) is audited as a whole. Manifests do not carry licenses or hashes, so for these ecosystems the audit **warns** instead of generating a TR-03183 SBOM: commit the one your build produces and audit it with `-i`.
+
+```text
+  Sources: OSV.dev … · 4 components from requirements.txt, go.mod, pom.xml (golang, maven, pypi)
+  pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones
+  CRITICAL [KEV] org.apache.logging.log4j:log4j-core@2.14.1  (fix: org.apache.logging.log4j:log4j-core@2.25.4)
+```
+
+**Input SBOM (`-i`), any language:**
 
 `audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
 
@@ -346,7 +364,7 @@ Suitable for CI/CD: a non-`0` code blocks the pipeline.
 
 Available in the GitHub Marketplace as [CRA Compliance Audit](https://github.com/marketplace/actions/cra-compliance-audit).
 
-For a Python, Java, Go… project, generate the SBOM first and pass it with `sbom-input`:
+Python, Go and Java projects work as they are (the action reads `requirements.txt`, `go.mod`, `pom.xml`…). For other languages, or to include Maven's transitive dependencies, generate the SBOM first and pass it with `sbom-input`:
 
 ```yaml
       - uses: anchore/sbom-action@v0          # Syft

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/commands/audit.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const path = require('node:path');
-const { findProjectRoot } = require('../utils/fs');
+const { findAnyProjectRoot } = require('../core/project-source');
 const { logger } = require('../utils/logger');
 const { loadPolicy } = require('../core/policy');
 const { runAudit } = require('../core/auditor');
@@ -45,20 +45,24 @@ async function auditCommand(flags, only) {
 }
 
 /**
- * Project root: the nearest package.json, or with `-i <sbom>` the working
- * directory (any ecosystem, no package.json needed).
+ * Project root: with `-i <sbom>` the working directory; otherwise the nearest
+ * folder with a package.json or a supported manifest (requirements.txt,
+ * poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml, gradle.lockfile).
  */
 function resolveRoot(flags) {
   const start = flags.cwd || process.cwd();
   if (inputPath(flags)) return path.resolve(start);
-  const root = findProjectRoot(start);
+  const root = findAnyProjectRoot(start);
   if (!root) {
-    logger.error('No package.json found. Run the command inside an npm project.');
+    logger.error(NO_PROJECT);
     return null;
   }
   return root;
 }
 
+const NO_PROJECT = 'No project found: expected a package.json (npm/Yarn/pnpm), requirements.txt, ' +
+  'poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml or gradle.lockfile — or pass an SBOM with -i.';
+
 /** `-i/--input <sbom>` resolved against the working directory. */
 function inputPath(flags) {
   if (typeof flags.input !== 'string') return null;
@@ -78,4 +82,4 @@ function applyFlagOverrides(policy, flags) {
   return merged;
 }
 
-module.exports = { auditCommand, inputPath };
+module.exports = { auditCommand, inputPath, resolveRoot };

package/src/commands/sbom.js

@@ -1,111 +1,122 @@
-'use strict';
-
-const path = require('node:path');
-const { findProjectRoot, readJson, writeJson, exists } = require('../utils/fs');
-const { logger, color } = require('../utils/logger');
-const { generateSbom } = require('../core/sbom-generator');
-const { validateSbom } = require('../core/sbom-validator');
-const { loadPolicy } = require('../core/policy');
-
-/**
- * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
- *
- * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
- * - check:    generates (or reads) an SBOM and validates the data fields
- *             required by BSI TR-03183-2 v2.1.0 §5.2.
- */
-function sbomCommand(subcommand, flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
-
-  const action = subcommand || 'generate';
-  const format = flags.format || 'cyclonedx';
-
-  if (action === 'check') {
-    return sbomCheck(projectRoot, format, flags);
-  }
-  if (action === 'generate') {
-    return sbomGenerate(projectRoot, format, flags);
-  }
-
-  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
-  return 1;
-}
-
-function sbomGenerate(projectRoot, format, flags) {
-  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-  if (!result.ok) {
-    logger.error(result.error);
-    return 1;
-  }
-
-  if (flags.output) {
-    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
-    writeJson(outPath, result.document);
-    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
-  } else {
-    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
-  }
-  return 0;
-}
-
-function sbomCheck(projectRoot, format, flags) {
-  let document;
-
-  // If an SBOM file is provided, validate it directly; otherwise generate one.
-  if (flags.input) {
-    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
-    if (!exists(inPath)) {
-      logger.error(`The specified SBOM was not found: ${flags.input}`);
-      return 1;
-    }
-    document = readJson(inPath);
-  } else {
-    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-    if (!result.ok) {
-      logger.error(result.error);
-      return 1;
-    }
-    document = result.document;
-  }
-
-  const validation = validateSbom(document);
-  if (!validation.ok) {
-    logger.error(validation.error);
-    return 1;
-  }
-
-  if (flags.json) {
-    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
-    return validation.valid ? 0 : 1;
-  }
-
-  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
-  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
-  for (const check of validation.checks) {
-    const mark = check.passed ? color.green('✔') : color.red('✖');
-    logger.log(`  ${mark} ${check.label}`);
-  }
-  logger.log('');
-  if (validation.valid) {
-    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
-    return 0;
-  }
-  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
-  return 1;
-}
-
-/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
-function sbomCreator(projectRoot, flags) {
-  if (typeof flags.creator === 'string') return flags.creator;
-  try {
-    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
-  } catch {
-    return undefined; // A broken policy file must not block SBOM generation.
-  }
-}
-
-module.exports = { sbomCommand };
+'use strict';
+
+const path = require('node:path');
+const { readJson, writeJson, exists } = require('../utils/fs');
+const { logger, color } = require('../utils/logger');
+const { generateSbom } = require('../core/sbom-generator');
+const { validateSbom } = require('../core/sbom-validator');
+const { loadPolicy } = require('../core/policy');
+const { hasManifests } = require('../core/manifest-reader');
+const { findAnyProjectRoot } = require('../core/project-source');
+
+/**
+ * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
+ *
+ * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
+ * - check:    generates (or reads) an SBOM and validates the data fields
+ *             required by BSI TR-03183-2 v2.1.0 §5.2.
+ */
+function sbomCommand(subcommand, flags) {
+  const start = flags.cwd || process.cwd();
+  // The nearest project decides: a Python/Go/Java folder inside an npm repo is not npm.
+  const nearest = findAnyProjectRoot(start);
+  const npmProject = nearest && exists(path.join(nearest, 'package.json'));
+  const projectRoot = npmProject ? nearest : (flags.input ? path.resolve(start) : null);
+  if (!projectRoot) {
+    const other = nearest && hasManifests(nearest);
+    logger.error(other
+      ? 'cra-audit generates TR-03183 SBOMs for npm/Yarn/pnpm projects. For this ecosystem, generate the SBOM with ' +
+        'your build tooling (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and check it with `cra-audit sbom check -i <file>`; ' +
+        '`cra-audit` audits this project directly.'
+      : 'No package.json found. Run the command inside an npm project, or pass an SBOM with `sbom check -i <file>`.');
+    return 1;
+  }
+
+  const action = subcommand || 'generate';
+  const format = flags.format || 'cyclonedx';
+
+  if (action === 'check') {
+    return sbomCheck(projectRoot, format, flags);
+  }
+  if (action === 'generate') {
+    return sbomGenerate(projectRoot, format, flags);
+  }
+
+  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
+  return 1;
+}
+
+function sbomGenerate(projectRoot, format, flags) {
+  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+  if (!result.ok) {
+    logger.error(result.error);
+    return 1;
+  }
+
+  if (flags.output) {
+    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
+    writeJson(outPath, result.document);
+    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
+  } else {
+    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
+  }
+  return 0;
+}
+
+function sbomCheck(projectRoot, format, flags) {
+  let document;
+
+  // If an SBOM file is provided, validate it directly; otherwise generate one.
+  if (flags.input) {
+    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
+    if (!exists(inPath)) {
+      logger.error(`The specified SBOM was not found: ${flags.input}`);
+      return 1;
+    }
+    document = readJson(inPath);
+  } else {
+    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+    if (!result.ok) {
+      logger.error(result.error);
+      return 1;
+    }
+    document = result.document;
+  }
+
+  const validation = validateSbom(document);
+  if (!validation.ok) {
+    logger.error(validation.error);
+    return 1;
+  }
+
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
+    return validation.valid ? 0 : 1;
+  }
+
+  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
+  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
+  for (const check of validation.checks) {
+    const mark = check.passed ? color.green('✔') : color.red('✖');
+    logger.log(`  ${mark} ${check.label}`);
+  }
+  logger.log('');
+  if (validation.valid) {
+    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
+    return 0;
+  }
+  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
+  return 1;
+}
+
+/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
+function sbomCreator(projectRoot, flags) {
+  if (typeof flags.creator === 'string') return flags.creator;
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
+  } catch {
+    return undefined; // A broken policy file must not block SBOM generation.
+  }
+}
+
+module.exports = { sbomCommand };

package/src/commands/vex.js

@@ -1,14 +1,14 @@
 'use strict';
 
 const path = require('node:path');
-const { findProjectRoot, readJson, writeJson } = require('../utils/fs');
+const { readJson, writeJson } = require('../utils/fs');
 const { logger } = require('../utils/logger');
 const { loadPolicy } = require('../core/policy');
 const { scanVulnerabilities } = require('../core/vuln-scanner');
 const { buildVex } = require('../core/vex');
 const { creatorFromManifest } = require('../core/installed-metadata');
-const { readSbom } = require('../core/sbom-reader');
-const { inputPath } = require('./audit');
+const { loadProject } = require('../core/project-source');
+const { inputPath, resolveRoot } = require('./audit');
 
 /**
  * `cra-audit vex` — writes a VEX document (CycloneDX 1.6 or OpenVEX 0.2.0)
@@ -19,12 +19,8 @@ const { inputPath } = require('./audit');
  */
 async function vexCommand(flags) {
   const input = inputPath(flags);
-  const start = flags.cwd || process.cwd();
-  const projectRoot = input ? path.resolve(start) : findProjectRoot(start);
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
+  const projectRoot = resolveRoot(flags);
+  if (!projectRoot) return 1;
 
   let policy;
   try {
@@ -40,7 +36,7 @@ async function vexCommand(flags) {
     return 1;
   }
 
-  const parsed = input ? readSbom(input) : null;
+  const { mode, parsed } = loadProject(projectRoot, { input });
   if (parsed && !parsed.ok) {
     logger.error(parsed.error);
     return 1;
@@ -63,7 +59,7 @@ async function vexCommand(flags) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const creator = creatorFromManifest(pkg);
   const author = policy.sbomCreator || (creator && (creator.email || creator.url)) || null;
-  const product = parsed
+  const product = parsed && mode !== 'npm+manifest'
     ? { name: parsed.root.name, version: parsed.root.version, purl: parsed.root.purl }
     : { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
   const document = buildVex(product, vulns, policy, { format, author });

package/src/core/auditor.js

@@ -5,7 +5,7 @@ const { generateSbom } = require('./sbom-generator');
 const { validateSbom } = require('./sbom-validator');
 const { checkLicenses } = require('./license-checker');
 const { acceptance } = require('./vex');
-const { readSbom } = require('./sbom-reader');
+const { loadProject } = require('./project-source');
 
 /**
  * @typedef {object} AuditResult
@@ -19,12 +19,13 @@ const { readSbom } = require('./sbom-reader');
  * Runs the full CRA audit: vulnerabilities + SBOM + licenses, then evaluates
  * the result against the configured security policy.
  *
+ * The components come from the npm lockfile, an input SBOM (`input`, any
+ * ecosystem) or, without an npm lockfile, the manifests of other ecosystems
+ * (requirements.txt, poetry.lock, go.mod, pom.xml…). See ./project-source.js.
+ *
  * @param {string} projectRoot
  * @param {object} policy
  * @param {string|null} policySource
- * With `input` (path to a CycloneDX/SPDX JSON SBOM) the audit runs on that
- * SBOM instead of the npm lockfile, so it covers any ecosystem.
- *
  * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses', input?: string }} [options]
  * @returns {Promise<AuditResult>}
  */
@@ -32,7 +33,9 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   const { only, input } = options;
   const sections = {};
   const reasons = [];
-  const parsed = input ? readSbom(input) : null;
+  const project = loadProject(projectRoot, { input });
+  const parsed = project.parsed;
+  const fromManifests = project.mode === 'manifest';
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
@@ -62,7 +65,21 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   // --- 2. SBOM ------------------------------------------------------------
-  if ((!only || only === 'sbom') && parsed) {
+  if ((!only || only === 'sbom') && fromManifests) {
+    // TR-03183 SBOMs (hashes, creators, graph) are built from npm lockfiles;
+    // other ecosystems should commit the one their build tooling produces.
+    sections.sbom = {
+      ok: true, manifest: true, format: 'manifest', componentCount: parsed.components.length,
+      files: parsed.files, ecosystems: parsed.ecosystems,
+    };
+    if (policy.requireSbom) {
+      reasons.push({
+        label: `No SBOM generated for ${parsed.ecosystems.join(', ')}: commit one from your build tooling (Syft, cdxgen, CycloneDX plugins) and audit it with \`-i\``,
+        passed: true,
+        warning: true,
+      });
+    }
+  } else if ((!only || only === 'sbom') && project.mode === 'sbom') {
     // An input SBOM comes from third-party tooling that rarely carries the
     // manufacturer fields TR-03183 requires: report gaps without blocking.
     const sbom = parsed.ok
@@ -103,11 +120,18 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 3. Licenses --------------------------------------------------------
   if (!only || only === 'licenses') {
-    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed });
+    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed: project.mode === 'npm+manifest' ? null : parsed });
     sections.licenses = licenses;
 
     if (!licenses.ok) {
       reasons.push({ label: `Licenses could not be analyzed: ${licenses.error}`, passed: false });
+    } else if (fromManifests) {
+      // Manifests do not declare licenses: report the gap instead of failing.
+      reasons.push({
+        label: `Licenses are not declared in ${parsed.files.join(', ')}: ${licenses.summary.missing.length} component(s) to review in your SBOM`,
+        passed: true,
+        warning: licenses.summary.missing.length > 0,
+      });
     } else {
       const s = licenses.summary;
       const missingFails = policy.licenses.failOnMissing && s.missing.length > 0;
@@ -122,8 +146,8 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   return {
-    project: parsed && parsed.ok
-      ? { name: parsed.root.name, version: parsed.root.version, sbom: parsed.sourceFile }
+    project: parsed && parsed.ok && project.mode !== 'npm+manifest'
+      ? { name: parsed.root.name, version: parsed.root.version, ...(project.mode === 'sbom' ? { sbom: parsed.sourceFile } : { manifests: parsed.files }) }
       : getProject(projectRoot, sections),
     policySource,
     generatedAt: new Date().toISOString(),

package/src/core/license-checker.js

@@ -32,6 +32,7 @@ function checkLicenses(projectRoot, policy = {}, { parsed: given } = {}) {
       name: c.name,
       version: c.version,
       purl: c.purl || null,
+      location: c.location || null,
       license: normalized,
       status, // 'ok' | 'missing' | 'denied' | 'not-allowed'
     };

package/src/core/manifest-reader.js

@@ -0,0 +1,374 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Reads the dependency manifests of non-npm ecosystems straight from the
+ * repository, without an SBOM generator:
+ *
+ *  - Python: poetry.lock, uv.lock, Pipfile.lock (exact, preferred) or
+ *            requirements*.txt (only `==` pins; `-r` includes are followed)
+ *  - Go:     go.mod (every required module, direct and `// indirect`)
+ *  - Java:   gradle.lockfile (exact), pom.xml (declared dependencies with
+ *            `${property}` and dependencyManagement resolution)
+ *
+ * Returns the same shape as readSbom(), so the OSV/KEV scan, VEX and SARIF
+ * work unchanged. Every component records the file and line it came from.
+ * Versions that are not pinned cannot be audited reliably: they are skipped
+ * and reported, never guessed.
+ *
+ * @param {string} projectRoot
+ * @returns {null | {
+ *   ok: true, manager: 'manifest', purlBased: true, format: 'manifest',
+ *   lockfileName: string, sourceFile: null, files: string[],
+ *   root: { name: string, version: string, purl: string, dependsOn: string[] },
+ *   components: object[], unidentified: number, notes: string[],
+ *   dependencyGraphComplete: false, ecosystems: string[]
+ * }} null when no supported manifest exists.
+ */
+function readManifests(projectRoot) {
+  const found = [];
+  const notes = [];
+  let skipped = 0;
+
+  const collect = (result) => {
+    if (!result) return;
+    found.push(result);
+    skipped += result.skipped || 0;
+    if (result.note) notes.push(result.note);
+  };
+
+  // Python: an exact lockfile wins over requirements files.
+  const pyLock = firstExisting(projectRoot, ['poetry.lock', 'uv.lock', 'Pipfile.lock']);
+  if (pyLock) {
+    collect(pyLock === 'Pipfile.lock' ? readPipfileLock(projectRoot, pyLock) : readTomlLock(projectRoot, pyLock));
+  } else {
+    for (const file of requirementsFiles(projectRoot)) collect(readRequirements(projectRoot, file));
+  }
+
+  if (exists(projectRoot, 'go.mod')) collect(readGoMod(projectRoot, 'go.mod'));
+  if (exists(projectRoot, 'gradle.lockfile')) collect(readGradleLock(projectRoot, 'gradle.lockfile'));
+  if (exists(projectRoot, 'pom.xml')) collect(readPom(projectRoot, 'pom.xml'));
+
+  if (!found.length) return null;
+
+  const components = dedupe(found.flatMap((r) => r.components));
+  const files = found.map((r) => r.file);
+  const name = path.basename(path.resolve(projectRoot));
+  const rootName = found.map((r) => r.rootName).find(Boolean) || name;
+  const rootVersion = found.map((r) => r.rootVersion).find(Boolean) || '0.0.0';
+  return {
+    ok: true,
+    manager: 'manifest',
+    purlBased: true,
+    format: 'manifest',
+    lockfileName: files.join(', '),
+    sourceFile: null,
+    files,
+    root: {
+      name: rootName,
+      version: rootVersion,
+      purl: `pkg:generic/${encodeURIComponent(rootName)}@${encodeURIComponent(rootVersion)}`,
+      dependsOn: components.filter((c) => c.direct).map((c) => c.key),
+    },
+    components,
+    unidentified: skipped,
+    notes,
+    dependencyGraphComplete: false,
+    ecosystems: [...new Set(components.map((c) => c.ecosystem))].sort(),
+  };
+}
+
+/** True when the folder holds a manifest this reader understands. */
+function hasManifests(projectRoot) {
+  return ['poetry.lock', 'uv.lock', 'Pipfile.lock', 'go.mod', 'gradle.lockfile', 'pom.xml']
+    .some((f) => exists(projectRoot, f)) || requirementsFiles(projectRoot).length > 0;
+}
+
+// --- Python ------------------------------------------------------------------------
+
+function requirementsFiles(root) {
+  let names = [];
+  try {
+    names = fs.readdirSync(root);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => /^requirements([-_.][\w.-]+)?\.txt$/i.test(n)).sort();
+}
+
+/**
+ * pip requirements: `name==1.2.3`, extras, environment markers, `--hash`
+ * continuation lines and `-r other.txt` includes. Anything that is not an
+ * exact pin (ranges, URLs, editable installs) is skipped and counted.
+ */
+function readRequirements(root, file, seen = new Set()) {
+  const full = path.join(root, file);
+  if (seen.has(full)) return { file, components: [], skipped: 0 };
+  seen.add(full);
+  const components = [];
+  let skipped = 0;
+  const dev = /dev|test|lint|doc/i.test(path.basename(file));
+
+  lines(full).forEach((raw, index) => {
+    const line = raw.replace(/\s+#.*$/, '').replace(/\\$/, '').trim();
+    if (!line || line.startsWith('#') || line.startsWith('--hash')) return;
+    const include = line.match(/^(?:-r|--requirement)\s+(.+)$/);
+    if (include) {
+      const nested = readRequirements(root, path.join(path.dirname(file), include[1].trim()), seen);
+      components.push(...nested.components);
+      skipped += nested.skipped;
+      return;
+    }
+    if (line.startsWith('-')) return; // pip options: -c, -i, --index-url, -e…
+    const spec = line.split(';')[0].trim();
+    const m = spec.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s,]+)$/);
+    if (m) components.push(pypi(m[1], m[2], file, index + 1, { dev, direct: true }));
+    else skipped++;
+  });
+  const note = skipped ? `${file}: ${skipped} requirement(s) without an exact == pin were not audited` : null;
+  return { file, components, skipped, note };
+}
+
+/** poetry.lock / uv.lock: `[[package]]` tables with `name` and `version`. */
+function readTomlLock(root, file) {
+  const components = [];
+  let current = null;
+  let rootName = null;
+  let rootVersion = null;
+  const flush = () => {
+    if (!current || !current.name || !current.version) return;
+    if (current.local) {
+      rootName = rootName || current.name;
+      rootVersion = rootVersion || current.version;
+    } else {
+      components.push(pypi(current.name, current.version, file, current.line, { direct: false }));
+    }
+  };
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const line = raw.trim();
+    if (line === '[[package]]') {
+      flush();
+      current = { line: index + 1 };
+      return;
+    }
+    if (!current) return;
+    if (/^\[/.test(line)) { // a sub-table: [package.dependencies], [package.source]…
+      if (!line.startsWith('[package.')) { flush(); current = null; }
+      return;
+    }
+    const kv = line.match(/^(name|version)\s*=\s*"([^"]+)"/);
+    if (kv && !current[kv[1]]) current[kv[1]] = kv[2];
+    // uv marks the project itself with an editable/virtual source.
+    if (/^source\s*=\s*\{\s*(editable|virtual)\s*=/.test(line)) current.local = true;
+  });
+  flush();
+  return { file, components, rootName, rootVersion };
+}
+
+/** Pipfile.lock (JSON): `default` and `develop` maps of `"==version"`. */
+function readPipfileLock(root, file) {
+  let doc;
+  try {
+    doc = JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+  } catch {
+    return { file, components: [], skipped: 0, note: `${file} could not be parsed` };
+  }
+  const text = lines(path.join(root, file));
+  const components = [];
+  for (const [group, dev] of [['default', false], ['develop', true]]) {
+    for (const [name, info] of Object.entries(doc[group] || {})) {
+      const version = info && typeof info.version === 'string' ? info.version.replace(/^===?/, '') : null;
+      if (!version) continue;
+      const line = text.findIndex((l) => l.includes(`"${name}": {`)) + 1 || 1;
+      components.push(pypi(name, version, file, line, { dev, direct: true }));
+    }
+  }
+  return { file, components };
+}
+
+function pypi(name, version, file, line, { dev = false, direct = false } = {}) {
+  // PEP 503 normalisation, as purl and OSV use it.
+  const normalized = name.toLowerCase().replace(/[-_.]+/g, '-');
+  return component({
+    ecosystem: 'pypi', name: normalized, osvName: normalized, version,
+    purl: `pkg:pypi/${normalized}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Go ------------------------------------------------------------------------------
+
+/** go.mod `require` directives (single and block form); `replace` is applied. */
+function readGoMod(root, file) {
+  const text = lines(path.join(root, file));
+  const requires = [];
+  const replaces = new Map();
+  let block = null;
+  let moduleName = null;
+
+  text.forEach((raw, index) => {
+    const line = raw.replace(/\/\/(?!\s*indirect).*$/, '').trim();
+    const mod = line.match(/^module\s+(\S+)/);
+    if (mod) moduleName = mod[1];
+    if (/^(require|replace|exclude|retract)\s*\($/.test(line)) { block = line.split(/\s/)[0]; return; }
+    if (line === ')') { block = null; return; }
+    const single = line.match(/^(require|replace)\s+(.+)$/);
+    const kind = single ? single[1] : block;
+    const body = single ? single[2] : line;
+    if (kind === 'require') {
+      const m = body.match(/^(\S+)\s+(v\S+)(\s+\/\/\s*indirect)?/);
+      if (m) requires.push({ module: m[1], version: m[2], indirect: Boolean(m[3]), line: index + 1 });
+    } else if (kind === 'replace') {
+      const m = body.match(/^(\S+)(?:\s+v\S+)?\s+=>\s+(\S+)\s+(v\S+)/);
+      if (m) replaces.set(m[1], { module: m[2], version: m[3] });
+    }
+  });
+
+  const components = requires.map((r) => {
+    const target = replaces.get(r.module) || { module: r.module, version: r.version };
+    return component({
+      ecosystem: 'golang', name: target.module, osvName: target.module, version: target.version,
+      purl: `pkg:golang/${target.module}@${target.version}`, file, line: r.line, direct: !r.indirect,
+    });
+  });
+  return { file, components, rootName: moduleName ? moduleName.split('/').pop() : null };
+}
+
+// --- Java --------------------------------------------------------------------------------
+
+/** gradle.lockfile: `group:artifact:version=configurations`. */
+function readGradleLock(root, file) {
+  const components = [];
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const m = raw.trim().match(/^([^:#\s]+):([^:\s]+):([^=\s]+)=(.*)$/);
+    if (!m) return;
+    const configs = m[4];
+    const dev = configs && !/(runtimeClasspath|compileClasspath)/.test(configs);
+    components.push(maven(m[1], m[2], m[3], file, index + 1, { dev, direct: false }));
+  });
+  return { file, components };
+}
+
+/**
+ * pom.xml declared dependencies. Versions come from the dependency itself,
+ * `${property}` values in <properties> (and project.version) or the
+ * <dependencyManagement> section. Transitive dependencies need Maven to be
+ * resolved, so only the declared ones are audited.
+ */
+function readPom(root, file) {
+  const xml = fs.readFileSync(path.join(root, file), 'utf8');
+  const stripped = xml.replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
+
+  const tag = (block, name) => {
+    const m = block.match(new RegExp(`<${name}>\\s*([^<]*?)\\s*</${name}>`));
+    return m ? m[1] : null;
+  };
+  // Top-level project fields, ignoring <parent>, <dependencies> and the like.
+  const topLevel = stripped
+    .replace(/<parent>[\s\S]*?<\/parent>/, '')
+    .replace(/<(dependencies|dependencyManagement|build|profiles|plugins|reporting)>[\s\S]*?<\/\1>/g, '');
+  const parentBlock = (stripped.match(/<parent>([\s\S]*?)<\/parent>/) || [])[1] || '';
+  const props = {
+    'project.version': tag(topLevel, 'version') || tag(parentBlock, 'version'),
+    'project.groupId': tag(topLevel, 'groupId') || tag(parentBlock, 'groupId'),
+  };
+  const propsBlock = (stripped.match(/<properties>([\s\S]*?)<\/properties>/) || [])[1] || '';
+  for (const m of propsBlock.matchAll(/<([\w.-]+)>\s*([^<]*?)\s*<\/\1>/g)) props[m[1]] = m[2];
+  const resolve = (value) => {
+    let v = value;
+    for (let i = 0; i < 5 && v && /\$\{([^}]+)\}/.test(v); i++) {
+      v = v.replace(/\$\{([^}]+)\}/g, (_, key) => (props[key] !== undefined && props[key] !== null ? props[key] : `\${${key}}`));
+    }
+    return v;
+  };
+
+  const managedBlock = (stripped.match(/<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/) || [])[1] || '';
+  const managed = new Map();
+  for (const m of managedBlock.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const g = resolve(tag(m[1], 'groupId'));
+    const a = resolve(tag(m[1], 'artifactId'));
+    const v = resolve(tag(m[1], 'version'));
+    if (g && a && v) managed.set(`${g}:${a}`, v);
+  }
+
+  const components = [];
+  let skipped = 0;
+  const outside = stripped.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/, (c) => c.replace(/[^\n]/g, ' '));
+  for (const m of outside.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const block = m[1];
+    const g = resolve(tag(block, 'groupId'));
+    const a = resolve(tag(block, 'artifactId'));
+    let v = resolve(tag(block, 'version')) || managed.get(`${g}:${a}`) || null;
+    if (!g || !a || !v || /\$\{|[[\]()]/.test(v)) { skipped++; continue; } // unresolved or a version range
+    const scope = tag(block, 'scope');
+    const line = outside.slice(0, m.index).split('\n').length + block.slice(0, block.indexOf('<artifactId>')).split('\n').length - 1;
+    components.push(maven(g, a, v, file, line, { dev: scope === 'test' || scope === 'provided', direct: true }));
+  }
+  const notes = ['pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones'];
+  if (skipped) notes.push(`pom.xml: ${skipped} dependency(ies) with a version inherited from a parent/BOM or a range were not audited`);
+  return {
+    file, components, skipped, note: notes.join('; '),
+    rootName: tag(topLevel, 'artifactId'), rootVersion: props['project.version'],
+  };
+}
+
+function maven(group, artifact, version, file, line, { dev = false, direct = false } = {}) {
+  return component({
+    ecosystem: 'maven', name: `${group}:${artifact}`, osvName: `${group}:${artifact}`, version,
+    purl: `pkg:maven/${group}/${artifact}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Shared ------------------------------------------------------------------------------
+
+function component({ ecosystem, name, osvName, version, purl, file, line, dev = false, direct = false }) {
+  return {
+    key: purl,
+    name,
+    version,
+    purl,
+    ecosystem,
+    osvName,
+    license: null,
+    scope: dev ? 'optional' : 'required',
+    dev,
+    optional: dev,
+    direct,
+    dependsOn: [],
+    location: { file, line },
+  };
+}
+
+function dedupe(components) {
+  const seen = new Map();
+  for (const c of components) {
+    const existing = seen.get(c.key);
+    if (!existing) seen.set(c.key, c);
+    else {
+      existing.direct = existing.direct || c.direct;
+      existing.optional = existing.optional && c.optional;
+      existing.dev = existing.optional;
+      existing.scope = existing.optional ? 'optional' : 'required';
+    }
+  }
+  return [...seen.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+function lines(file) {
+  try {
+    return fs.readFileSync(file, 'utf8').split(/\r?\n/);
+  } catch {
+    return [];
+  }
+}
+
+function exists(root, file) {
+  return fs.existsSync(path.join(root, file));
+}
+
+function firstExisting(root, files) {
+  return files.find((f) => exists(root, f)) || null;
+}
+
+module.exports = { readManifests, hasManifests };

package/src/core/project-source.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { parseLockfile } = require('./lockfile-parser');
+const { readSbom } = require('./sbom-reader');
+const { readManifests, hasManifests } = require('./manifest-reader');
+
+/**
+ * Decides where the components of a project come from:
+ *
+ *  - `sbom`:          an input SBOM (`-i`), any ecosystem
+ *  - `npm`:           the npm/Yarn/pnpm lockfile (native, richest data)
+ *  - `manifest`:      requirements.txt / poetry.lock / go.mod / pom.xml… when
+ *                     there is no npm lockfile
+ *  - `npm+manifest`:  both in the same folder (e.g. a JS front end next to a
+ *                     Python service); vulnerabilities cover both
+ *
+ * `parsed` is what the scanner, license check, VEX and SARIF consume; it is
+ * null for plain npm projects, which keep their existing code paths.
+ *
+ * @param {string} projectRoot
+ * @param {{ input?: string|null }} [options]
+ */
+function loadProject(projectRoot, { input = null } = {}) {
+  if (input) {
+    const parsed = readSbom(input);
+    return { mode: 'sbom', parsed, manifests: null };
+  }
+
+  const lock = parseLockfile(projectRoot);
+  const manifests = hasManifests(projectRoot) ? readManifests(projectRoot) : null;
+
+  if (lock.ok && manifests) {
+    // npm components keep their name-based lookups; manifest ones use purls.
+    const parsed = {
+      ...lock,
+      purlBased: false,
+      components: [...lock.components, ...manifests.components],
+      root: { ...lock.root, dependsOn: [...lock.root.dependsOn, ...manifests.root.dependsOn] },
+    };
+    return { mode: 'npm+manifest', parsed, manifests };
+  }
+  if (!lock.ok && manifests) return { mode: 'manifest', parsed: manifests, manifests };
+  return { mode: 'npm', parsed: null, manifests: null };
+}
+
+/**
+ * The nearest folder, walking up from `start`, with a package.json or a
+ * supported manifest of another ecosystem. Null when there is none.
+ */
+function findAnyProjectRoot(start) {
+  let dir = path.resolve(start);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json')) || hasManifests(dir)) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+module.exports = { loadProject, findAnyProjectRoot };

package/src/core/readiness.js

@@ -5,6 +5,7 @@ const path = require('node:path');
 const { readJson } = require('../utils/fs');
 const { parseLockfile } = require('./lockfile-parser');
 const { repositoryUrl } = require('./installed-metadata');
+const { readManifests } = require('./manifest-reader');
 
 /**
  * Organisational CRA duties that can be checked from the repository itself:
@@ -106,9 +107,12 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
   // an SBOM produced by their own tooling (Syft, cdxgen…) kept in the repo.
   const parsed = parseLockfile(projectRoot);
   const sbomFile = parsed.ok ? null : findSbomFile(projectRoot);
-  add('sbom', 'SBOM available (npm lockfile or an SBOM file)', 'required', parsed.ok || sbomFile,
+  const manifests = parsed.ok || sbomFile ? null : readManifests(projectRoot);
+  add('sbom', 'Dependency inventory for the SBOM (lockfile, manifest or SBOM file)', 'required', parsed.ok || sbomFile || manifests,
     parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)`
-      : sbomFile ? `Found ${sbomFile}` : `${parsed.error} For other ecosystems, commit an SBOM (e.g. sbom.cdx.json).`,
+      : sbomFile ? `Found ${sbomFile}`
+        : manifests ? `${manifests.files.join(', ')} (${manifests.components.length} components)`
+          : 'No lockfile, supported manifest or SBOM file found.',
     'CRA Annex I Part II (1)');
 
   add('package-repository', 'package.json links the source repository', 'recommended', Boolean(repositoryUrl(pkg.repository)),

package/src/core/sbom-reader.js

@@ -45,6 +45,7 @@ function readSbom(file) {
   return {
     ok: true,
     manager: 'sbom',
+    purlBased: true,
     format: result.format,
     lockfileName: path.basename(file),
     sourceFile: file,

package/src/core/vuln-scanner.js

@@ -25,19 +25,19 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  *    CVEs found are cross-checked with the CISA KEV catalogue.
  *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
- * An existing SBOM of any ecosystem can be scanned instead of the lockfile by
- * passing the result of readSbom() as `parsed`; its components are looked up
- * in OSV.dev by Package URL.
+ * Other ecosystems are scanned by passing, as `parsed`, the result of
+ * readSbom() (an input SBOM) or readManifests() (requirements.txt, go.mod,
+ * pom.xml…); their components are looked up in OSV.dev by Package URL.
  *
  * @param {string} projectRoot
  * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean, parsed?: object }} [options]
  * @returns {Promise<object>}
  */
 async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true, parsed: given } = {}) {
-  const fromSbom = Boolean(given && given.manager === 'sbom');
+  const fromSbom = Boolean(given && given.purlBased);
   if (source === 'npm') {
     if (fromSbom) {
-      return { ok: false, error: '`npm audit` cannot scan an input SBOM; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
+      return { ok: false, error: '`npm audit` only scans npm projects; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
     }
     return npmAuditSection(projectRoot, { production });
   }
@@ -88,7 +88,9 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
     ok: true,
     source: 'osv',
     scanned: scannable.length,
-    input: fromSbom ? { file: parsed.sourceFile, format: parsed.format, unidentified: parsed.unidentified } : null,
+    input: fromSbom
+      ? { file: parsed.sourceFile || parsed.lockfileName, format: parsed.format, unidentified: parsed.unidentified, notes: parsed.notes || [] }
+      : null,
     ecosystems: [...new Set(scannable.map((c) => c.ecosystem || 'npm'))].sort(),
     kev: catalogue
       ? (catalogue.ok
@@ -135,6 +137,7 @@ function toFinding(component, records, isDirect, catalogue) {
     version: component.version,
     purl: component.purl || buildPurl(component.name, component.version),
     ecosystem: component.ecosystem || 'npm',
+    location: component.location || null,
     severity,
     direct: isDirect,
     range: null,
@@ -169,7 +172,8 @@ function productionComponents(parsed, rootPkg) {
       if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
     }
   }
-  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+  // Components of other ecosystems (npm+manifest projects) use their own scope.
+  return parsed.components.filter((c) => (c.ecosystem ? !c.optional : seen.has(componentKey(c.name, c.version))));
 }
 
 function severityRank(severity) {

package/src/reporters/console.js

@@ -38,6 +38,7 @@ function renderVulnerabilities(section) {
   }
   logger.detail(describeSources(section));
   for (const warning of section.warnings || []) logger.warn(warning);
+  for (const note of (section.input && section.input.notes) || []) logger.detail(note);
 
   const c = section.counts;
   if (c.total === 0) {
@@ -89,9 +90,9 @@ function describeSources(section) {
     ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
     : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
   const scope = section.input
-    ? `${section.scanned} components from ${shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
-      (section.input.unidentified ? ` · ${section.input.unidentified} without purl skipped` : '')
-    : `${section.scanned} components`;
+    ? `${section.scanned} components from ${section.input.format === 'manifest' ? section.input.file : shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
+      (section.input.unidentified ? ` · ${section.input.unidentified} ${section.input.format === 'manifest' ? 'not pinned, skipped' : 'without purl skipped'}` : '')
+    : `${section.scanned} components${(section.ecosystems || []).length > 1 ? ` (${section.ecosystems.join(', ')})` : ''}`;
   return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${scope}`;
 }
 
@@ -121,6 +122,12 @@ function renderSbom(section) {
     logger.error(section.error);
     return;
   }
+  if (section.manifest) {
+    logger.detail(`Components read from ${section.files.join(', ')} (${section.ecosystems.join(', ')}): ${section.componentCount}`);
+    logger.warn('cra-audit builds TR-03183 SBOMs from npm lockfiles. For these ecosystems, commit the SBOM your');
+    logger.detail('build tooling produces (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and audit it with -i.');
+    return;
+  }
   logger.detail(`${section.input ? `Input SBOM: ${shortPath(section.input)} · ` : ''}Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {

package/src/reporters/sarif.js

@@ -30,7 +30,8 @@ function buildSarif(report, projectRoot, policy = {}) {
   const rules = new Map();
   const results = [];
   const vulns = report.sections.vulnerabilities;
-  const inputFile = vulns && vulns.input ? vulns.input.file : null;
+  // An input SBOM is searched for purls; manifest findings carry their own location.
+  const inputFile = vulns && vulns.input && vulns.input.format !== 'manifest' ? vulns.input.file : null;
   const lock = lockfileLocator(projectRoot, inputFile);
   const assessments = normalizeAllowlist(policy);
 
@@ -47,7 +48,7 @@ function buildSarif(report, projectRoot, policy = {}) {
             : finding.malicious || source.kev || ['critical', 'high'].includes(source.severity || finding.severity) ? 'error'
               : (source.severity || finding.severity) === 'moderate' ? 'warning' : 'note',
           message: { text: vulnerabilityMessage(finding, source) },
-          locations: [lock.locate(finding.name, finding.version, finding.purl)],
+          locations: [finding.location ? lock.at(finding.location) : lock.locate(finding.name, finding.version, finding.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${finding.name}@${finding.version || ''}` },
         };
         if (accepted) {
@@ -71,14 +72,17 @@ function buildSarif(report, projectRoot, policy = {}) {
       ['cra-audit/license-missing', s.missing, 'warning', (c) => `${c.name}@${c.version} has no documented license (TR-03183-2 §5.2.2).`],
     ];
     for (const [ruleId, list, level, text] of groups) {
-      if (!list.length) continue;
+      // Manifests (requirements.txt, go.mod…) never declare licenses: that gap is
+      // reported once by the audit, not as one alert per dependency.
+      const relevant = ruleId === 'cra-audit/license-missing' ? list.filter((c) => !c.location) : list;
+      if (!relevant.length) continue;
       rules.set(ruleId, licenseRule(ruleId));
-      for (const c of list) {
+      for (const c of relevant) {
         results.push({
           ruleId,
           level,
           message: { text: text(c) },
-          locations: [lock.locate(c.name, c.version, c.purl)],
+          locations: [c.location ? lock.at(c.location) : lock.locate(c.name, c.version, c.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${c.name}@${c.version}` },
         });
       }
@@ -193,7 +197,14 @@ function lockfileLocator(projectRoot, inputFile = null) {
       },
     };
   };
-  return { repoRoot, locate };
+  // A known file + line (components read from manifests).
+  const at = ({ file: rel, line }) => ({
+    physicalLocation: {
+      artifactLocation: { uri: path.relative(repoRoot, path.resolve(projectRoot, rel)).split(path.sep).join('/'), uriBaseId: '%SRCROOT%' },
+      region: { startLine: line || 1 },
+    },
+  });
+  return { repoRoot, locate, at };
 }
 
 function findEntryLine(lines, name, version) {