feat: gather more info for bundled dependencies (#1301)

- fixes CycloneDX/cyclonedx-javascript-library#1247

---------

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

.github/workflows/npm-ls_demo-results.yml

@@ -21,15 +21,15 @@ jobs:
       fail-fast: false # gather all the results !
       matrix:
         subject:
-          - deps-from-git
-          - alternative-package-registry
+          # - deps-from-git
+          # - alternative-package-registry
           - bundled-dependencies
-          - dev-dependencies
-          - juice-shop
-          - local-dependencies
-          - local-workspaces
-          - package-integrity
-          - package-with-build-id
+          # - dev-dependencies
+          # - juice-shop
+          # - local-dependencies
+          # - local-workspaces
+          # - package-integrity
+          # - package-with-build-id
         additional_npm-ls_args: [ '' ]
         npm-version:
           ## see https://www.npmjs.com/package/npm?activeTab=versions
@@ -41,8 +41,8 @@ jobs:
           ## action based on https://github.com/actions/node-versions/releases
           ## see also: https://nodejs.org/en/about/releases/
           - '24'     # Current
-          #- '22'     # Active LTS
-          #- '20'
+          - '22'     # Active LTS
+          - '20'
         os:
           - ubuntu-latest
           - windows-latest

HISTORY.md

@@ -7,9 +7,11 @@ All notable changes to this project will be documented in this file.
 <!-- unreleased changes go here -->
 
 * Runtime Dependencies
+  * Raised `@cyclonedx/cyclonedx-library@^8.2.0`, was `@^8.0.0` (via [#1301])
   * Raised `commander@^14.0.0`, was `@^13.1.0` (via [#1297])
 
 [#1297]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1297
+[#1301]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1301
 
 ## 3.0.0 - 2025-04-08
 

demo/bundled-dependencies/README.md

@@ -11,13 +11,17 @@ or a list of `string` that identifies the keys in dependencies-lists.
 The package [`bundle-dependencies`](https://www.npmjs.com/package/bundle-dependencies)
 ships with bundled version of `yargs`.
 
+This package itself has a bundled dependency, whcih can be tested with `npm pack`.
+
 ## remarks
 
 * In *npm6* the `_inBundle` property is set to `true` in a dependency
 * In *npm8* the  `inBundle` property is set to `true` in a dependency.
 * Additionally, there is the property `bundleDependencies`(deprecated)/`bundledDependencies` in a component.  
   Value might be `true`(all), `false`(none), or a list of `string` that point to the keys in dependency list.  
 * Only one `resolved` can be found, since al the other packages were bundled, and are therefore not resolve.
+* Some package managers add a "dist" section to the bundled dependencies - which can be evaluated.  
+  See <https://github.com/CycloneDX/cyclonedx-node-npm/issues/1300>.
 
 ## output
 
@@ -53,7 +57,12 @@ Output of `npm ls --json -a -l` look like this:
               // other properties
             },
             // other dependencies
-          }
+          },
+          // other properties
+          "dist": {
+            "shasum": "035e5ea466ac7fea584b00353e33eae4082b9894",
+            "tarball": "http://registry.npmjs.org/yargs/-/yargs-4.1.0.tgz"
+          },
         }
       }
     }

demo/bundled-dependencies/project/package.json

@@ -10,6 +10,10 @@
     "directory": "demo/bundled-dependencies/project"
   },
   "dependencies": {
-    "bundle-dependencies": "1.0.2"
-  }
+    "bundle-dependencies": "1.0.2",
+    "is-obj": "3.0.0"
+  },
+  "bundledDependencies": [
+    "is-obj"
+  ]
 }

package.json

@@ -69,7 +69,7 @@
     }
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "^8.0.0",
+    "@cyclonedx/cyclonedx-library": "^8.2.0",
     "commander": "^14.0.0",
     "normalize-package-data": "^7.0.0",
     "xmlbuilder2": "^3.0.2"

src/builders.ts

@@ -354,51 +354,6 @@ export class BomBuilder {
     }
   }
 
-  /**
-   * See {@link https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#packages | package lock docs} for "integrity"
-   *
-   * integrity: A sha512 or sha1 [Standard Subresource Integrity](https://w3c.github.io/webappsec/specs/subresourceintegrity/) string for the artifact that was unpacked in this location.
-   */
-  private readonly integrityRE: ReadonlyMap<Enums.HashAlgorithm, RegExp> = new Map([
-    // !!! this list is pre-sorted, starting with most-common usage.
-
-    /* base64 alphabet: `A-Za-z0-9+/` and `=` for padding
-     * SHA-512 => base64 over 512 bit => 86 chars + 2 chars padding.
-     * examples:
-     * - sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==
-     * - sha512-DXUS22Y57/LAFSg3x7Vi6RNAuLpTXwxB9S2nIA7msBb/Zt8p7XqMwdpdc1IU7CkOQUPgAqR5fWvxuKCbneKGmA==
-     * - sha512-5BejraMXMC+2UjefDvrH0Fo/eLwZRV6859SXRg+FgbhA0R0l6lDqDGAQYhKbXhPN2ofk2kY5sgGyLNL907UXpA==
-     */
-    [Enums.HashAlgorithm['SHA-512'], /^sha512-([a-z0-9+/]{86}==)$/i],
-
-    /* base64 alphabet: `A-Za-z0-9+/` and `=` for padding
-     * SHA-1 => base64 over 160 bit => 27 chars + 1 chars padding.
-     * examples:
-     * - sha1-aSbRsZT7xze47tUTdW3i/Np+pAg=
-     * - sha1-Kq5sNclPz7QV2+lfQIuc6R7oRu0=
-     * - sha1-XV8g50dxuFICXD7bZslGLuuRPQM=
-     */
-    [Enums.HashAlgorithm['SHA-1'], /^sha1-([a-z0-9+/]{27}=)$/i],
-
-    /* base64 alphabet: `A-Za-z0-9+/` and `=` for padding
-     * SHA-256 => base64 over 256 bit => 43 chars + 1 chars padding.
-     * examples:
-     * - sha256-jxzgcB+8dLn7Cjjyg7stGWMftZf6rbdvgoE85TOzmT4=
-     * - sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
-     * - sha256-+8Gp+Fjqnhd5FpZL2Iw9N7kaHoRBJ2XimVB3fyZcS3U=
-     */
-    [Enums.HashAlgorithm['SHA-256'], /^sha256-([a-z0-9+/]{43}=)$/i],
-
-    /* base64 alphabet: `A-Za-z0-9+/` and `=` for padding
-     * SHA-384 => base64 over 384 bit => 64 chars + 0 chars padding.
-     * example:
-     * - sha384-aDkxLz2zQ0dwcNPAsr7NQXs1cVTUh5TQHXjPtGF+1auBmne2gy9lQt0Yu3OBMe9+
-     * - sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC
-     * - sha384-/b2OdaZ/KfcBpOBAOF4uI5hjA+oQI5IRr5B/y7g1eLPkF8txzmRu/QgZ3YwIjeG9
-     */
-    [Enums.HashAlgorithm['SHA-384'], /^sha384-([a-z0-9+/]{64})$/i]
-  ])
-
   /**
    * Ignore pattern for `resolved`.
    * - ignore: well, just ignore it ... i guess.
@@ -514,16 +469,9 @@ export class BomBuilder {
       const hashes = new Models.HashDictionary()
       const integrity = data.integrity
       if (isString(integrity)) {
-        for (const [hashAlgorithm, hashRE] of this.integrityRE) {
-          const hashMatchBase64 = hashRE.exec(integrity) ?? []
-          if (hashMatchBase64.length === 2) {
-            hashes.set(
-              hashAlgorithm,
-              Buffer.from(hashMatchBase64[1], 'base64').toString('hex')
-            )
-            break // there is only one hash in "integrity"
-          }
-        }
+        try {
+          hashes.set(...Utils.NpmjsUtility.parsePackageIntegrity(integrity))
+        } catch { /* pass */}
       }
       component.externalReferences.add(
         new Models.ExternalReference(

tests/_data/dummy_projects/with-prepared/node_modules/.package-lock.json

@@ -10,7 +10,8 @@
     "base64-js": "1.0.1",
     "buffer": "^5.4.3",
     "bundle-dependencies": "1.0.2",
-    "ignore": "^5.1.4"
+    "ignore": "^5.1.4",
+    "is-obj": "3.0.0"
   },
   "devDependencies": {
     "@types/node": "20.14.10",

tests/_data/dummy_projects/with-prepared/node_modules/is-obj/license

@@ -32,5 +32,7 @@ find "$NODE_MODULES_DIR" \
 find "$NODE_MODULES_DIR" \
   -type d \
   \( -name 'build' -or -name 'dist' -or -name 'lib' \) \
-  \( -path '*/node_modules/@*/*' -or -path '*/node_modules/[^@]*' \) \
-  | xargs rm -rf
+  \( -path '*/node_modules/@*/*/*' -or -path '*/node_modules/[^@]*/*' \) \
+  -print0 \
+  | xargs -0 \
+    rm -rf