@@ -16,7 +16,7 @@ import {
1616import { platform as _platform , homedir , tmpdir } from "node:os" ;
1717import { basename , dirname , join , resolve , sep } from "node:path" ;
1818import process from "node:process" ;
19- import { URL , fileURLToPath } from "node:url" ;
19+ import { URL } from "node:url" ;
2020import got from "got" ;
2121import { PackageURL } from "packageurl-js" ;
2222import { parse } from "ssri" ;
@@ -27,7 +27,6 @@ import {
2727 getOriginUrl ,
2828 gitTreeHashes ,
2929 listFiles ,
30- runSwiftCommand ,
3130} from "../helpers/envcontext.js" ;
3231import {
3332 CARGO_CMD ,
@@ -161,7 +160,6 @@ import { collectOSCryptoLibs } from "../helpers/cbomutils.js";
161160import {
162161 executeOsQuery ,
163162 getBinaryBom ,
164- getCargoAuditableInfo ,
165163 getDotnetSlices ,
166164 getOSPackages ,
167165} from "../managers/binary.js" ;
@@ -2310,17 +2308,44 @@ export async function createNodejsBom(path, options) {
23102308 options ,
23112309 ) ;
23122310 }
2313- if ( pnpmLockFiles ?. length ) {
2311+ if (
2312+ pnpmLockFiles ?. length &&
2313+ isPackageManagerAllowed ( "pnpm" , [ "npm" , "yarn" , "rush" ] , options )
2314+ ) {
23142315 manifestFiles = manifestFiles . concat ( pnpmLockFiles ) ;
23152316 for ( const f of pnpmLockFiles ) {
2317+ if ( DEBUG_MODE ) {
2318+ console . log ( `Parsing ${ f } ) ;
2319+ }
23162320 const basePath = dirname ( f ) ;
23172321 // Determine the parent component
23182322 const packageJsonF = join ( basePath , "package.json" ) ;
2319- if ( existsSync ( packageJsonF ) ) {
2320- const pcs = await parsePkgJson ( packageJsonF , true ) ;
2321- if ( pcs . length ) {
2322- parentComponent = pcs [ 0 ] ;
2323- parentComponent . type = "application" ;
2323+ if ( ! Object . keys ( parentComponent ) . length ) {
2324+ if ( existsSync ( packageJsonF ) ) {
2325+ const pcs = await parsePkgJson ( packageJsonF , true ) ;
2326+ if ( pcs . length ) {
2327+ parentComponent = pcs [ 0 ] ;
2328+ parentComponent . type = "application" ;
2329+ ppurl = new PackageURL (
2330+ "npm" ,
2331+ options . projectGroup || parentComponent . group ,
2332+ parentComponent . name ,
2333+ options . projectVersion || parentComponent . version ,
2334+ null ,
2335+ null ,
2336+ ) . toString ( ) ;
2337+ parentComponent [ "bom-ref" ] = decodeURIComponent ( ppurl ) ;
2338+ parentComponent [ "purl" ] = ppurl ;
2339+ }
2340+ } else {
2341+ let dirName = dirname ( f ) ;
2342+ const tmpA = dirName . split ( sep ) ;
2343+ dirName = tmpA [ tmpA . length - 1 ] ;
2344+ parentComponent = {
2345+ group : "" ,
2346+ name : dirName ,
2347+ type : "application" ,
2348+ } ;
23242349 ppurl = new PackageURL (
23252350 "npm" ,
23262351 options . projectGroup || parentComponent . group ,
@@ -2332,32 +2357,16 @@ export async function createNodejsBom(path, options) {
23322357 parentComponent [ "bom-ref" ] = decodeURIComponent ( ppurl ) ;
23332358 parentComponent [ "purl" ] = ppurl ;
23342359 }
2335- } else {
2336- let dirName = dirname ( f ) ;
2337- const tmpA = dirName . split ( sep ) ;
2338- dirName = tmpA [ tmpA . length - 1 ] ;
2339- parentComponent = {
2340- group : "" ,
2341- name : dirName ,
2342- type : "application" ,
2343- } ;
2344- ppurl = new PackageURL (
2345- "npm" ,
2346- options . projectGroup || parentComponent . group ,
2347- options . projectName || parentComponent . name ,
2348- options . projectVersion || parentComponent . version ,
2349- null ,
2350- null ,
2351- ) . toString ( ) ;
2352- parentComponent [ "bom-ref" ] = decodeURIComponent ( ppurl ) ;
2353- parentComponent [ "purl" ] = ppurl ;
23542360 }
23552361 // Parse the pnpm file
23562362 const parsedList = await parsePnpmLock ( f , parentComponent ) ;
23572363 const dlist = parsedList . pkgList ;
23582364 if ( dlist ?. length ) {
23592365 pkgList = pkgList . concat ( dlist ) ;
23602366 }
2367+ if ( parsedList ?. parentSubComponents ?. length ) {
2368+ parentComponent . components = parsedList . parentSubComponents ;
2369+ }
23612370 if ( parsedList . dependenciesList && parsedList . dependenciesList ) {
23622371 dependencies = mergeDependencies (
23632372 dependencies ,
@@ -2367,7 +2376,10 @@ export async function createNodejsBom(path, options) {
23672376 }
23682377 }
23692378 }
2370- if ( pkgLockFiles ?. length ) {
2379+ if (
2380+ pkgLockFiles ?. length &&
2381+ isPackageManagerAllowed ( "npm" , [ "pnpm" , "yarn" ] , options )
2382+ ) {
23712383 manifestFiles = manifestFiles . concat ( pkgLockFiles ) ;
23722384 for ( const f of pkgLockFiles ) {
23732385 if ( DEBUG_MODE ) {
@@ -2395,7 +2407,10 @@ export async function createNodejsBom(path, options) {
23952407 }
23962408 }
23972409 }
2398- if ( existsSync ( join ( path , "rush.json" ) ) ) {
2410+ if (
2411+ existsSync ( join ( path , "rush.json" ) ) &&
2412+ isPackageManagerAllowed ( "rush" , [ "npm" , "yarn" , "pnpm" ] , options )
2413+ ) {
23992414 // Rush.js creates node_modules inside common/temp directory
24002415 const nmDir = join ( path , "common" , "temp" , "node_modules" ) ;
24012416 // Do rush install if we don't have node_modules directory
@@ -2466,7 +2481,10 @@ export async function createNodejsBom(path, options) {
24662481 ) ;
24672482 options . failOnError && process . exit ( 1 ) ;
24682483 }
2469- if ( yarnLockFiles ?. length ) {
2484+ if (
2485+ yarnLockFiles ?. length &&
2486+ isPackageManagerAllowed ( "yarn" , [ "npm" , "pnpm" ] , options )
2487+ ) {
24702488 manifestFiles = manifestFiles . concat ( yarnLockFiles ) ;
24712489 for ( const f of yarnLockFiles ) {
24722490 if ( DEBUG_MODE ) {
@@ -2483,7 +2501,7 @@ export async function createNodejsBom(path, options) {
24832501 ppurl = new PackageURL (
24842502 "npm" ,
24852503 options . projectGroup || tmpParentComponent . group ,
2486- options . projectName || tmpParentComponent . name ,
2504+ tmpParentComponent . name ,
24872505 options . projectVersion || tmpParentComponent . version ,
24882506 null ,
24892507 null ,
@@ -2542,7 +2560,7 @@ export async function createNodejsBom(path, options) {
25422560 const ppurl = new PackageURL (
25432561 "npm" ,
25442562 options . projectGroup || parentComponent . group ,
2545- options . projectName || parentComponent . name ,
2563+ parentComponent . name ,
25462564 options . projectVersion || parentComponent . version ,
25472565 null ,
25482566 null ,
@@ -2584,7 +2602,7 @@ export async function createNodejsBom(path, options) {
25842602 ppurl = new PackageURL (
25852603 "npm" ,
25862604 options . projectGroup || parentComponent . group ,
2587- options . projectName || parentComponent . name ,
2605+ parentComponent . name ,
25882606 options . projectVersion || parentComponent . version ,
25892607 null ,
25902608 null ,
@@ -2634,7 +2652,6 @@ export function createPixiBom(path, options) {
26342652 let dependencies = [ ] ;
26352653 let pkgList = [ ] ;
26362654 let formulationList = [ ] ;
2637- let frozen = true ;
26382655 let parentComponent = createDefaultParentComponent ( path , "pypi" , options ) ;
26392656 let PixiLockData = { } ;
26402657
@@ -2689,7 +2706,6 @@ export function createPixiBom(path, options) {
26892706 }
26902707
26912708 pkgList = PixiLockData . pkgList ;
2692- frozen = PixiLockData . frozen ;
26932709 formulationList = PixiLockData . formulationList ;
26942710 dependencies = PixiLockData . dependencies ;
26952711
@@ -5048,14 +5064,13 @@ export async function createCsharpBom(path, options) {
50485064 const csProjData = readFileSync ( f , { encoding : "utf-8" } ) ;
50495065 const retMap = parseCsProjData ( csProjData , f , { } ) ;
50505066 if ( retMap ?. parentComponent ?. properties ) {
5051- const parentProperties = retMap . parentComponent . properties ;
50525067 retMap . parentComponent . properties
50535068 . filter (
50545069 ( p ) =>
50555070 p . name === "cdx:dotnet:target_framework" && p . value . trim ( ) . length ,
50565071 )
50575072 . forEach ( ( p ) => {
5058- const frameworkValues = p . value
5073+ p . value
50595074 . split ( ";" )
50605075 . filter ( ( v ) => v . trim ( ) . length && ! v . startsWith ( "$(" ) )
50615076 . forEach ( ( v ) => {
0 commit comments