feat: use cyclonedx library ^10.0.0

HISTORY.md

@@ -6,6 +6,18 @@ All notable changes to this project will be documented in this file.
 
 <!-- unreleased changes go here -->
 
+* Fixed
+  * Qualified PackageURLs (via [#1416])
+* Changed
+  * Take care of PackageURL generation ourselves, now (via [#1416])  
+    Previously, this was done at best-effort by a 3rd-party library.
+* Dependencies
+  * Bumped dependency `@cyclonedx/cyclonedx-library@^10.0.0` now, was `@^8.4.0||^9.0.0` (via [#1416])
+  * Added dependency `packageurl-js@^2.0.1` (via [#1416])
+  * Added dependency `spdx-expression-parse@^3.0.1||^4.0.0` (via [#1416])
+
+[#1416]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1416
+
 ## 4.1.2 - 2025-12-05
 
 * Runtime Dependencies

package.json

@@ -69,9 +69,11 @@
     }
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "^8.4.0||^9.0.0",
+    "@cyclonedx/cyclonedx-library": "^10.0.0",
     "commander": "^14.0.0",
     "normalize-package-data": "^7.0.0 || ^8.0.0",
+    "packageurl-js": "^2.0.1",
+    "spdx-expression-parse": "^3.0.1 || ^4.0.0",
     "xmlbuilder2": "^3.0.2 || ^4.0.3"
   },
   "optionalDependencies": {
@@ -83,6 +85,7 @@
   "devDependencies": {
     "@types/node": "ts5.8",
     "@types/normalize-package-data": "^2.4.4",
+    "@types/spdx-expression-parse": "^3.0.5",
     "fast-glob": "^3.2.11",
     "imurmurhash": "^0.1.4",
     "c8": "^11",

src/_helpers.ts

@@ -128,3 +128,18 @@ export function normalizePackageManifest (data: any): asserts data is normalizeP
     data.version = oVersion.trim()
   }
 }
+
+
+/**
+ * Ignore pattern for `resolved`.
+ * - `^ignore:`- well, just ignore it ... i guess.
+ * - `^file:`  - local dist cannot be shipped and therefore should be ignored.
+ */
+export const npmResolvedIgnoreMatcher = /^(?:ignore|file):/i
+
+/**
+ * VCS pattern for `resolved`.
+ * - `^git:` & `^git+...:` & `*.git`- git
+ * - `^ssh:`                        - probably git
+ */
+export const npmResolvedVcsMatcher = /^git(?:\+[^:]+)?:|\.git(?:#|$)|^ssh:/i

src/_types.d.ts

@@ -0,0 +1,46 @@
+/*!
+This file is part of CycloneDX generator for NPM projects.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+SPDX-License-Identifier: Apache-2.0
+Copyright (c) OWASP Foundation. All Rights Reserved.
+*/
+
+// is the dir/path in which a package resides
+export type PackagePath = string
+
+export interface PackageData {
+  /** !!! only populated in project-root package */
+  private?: boolean
+  name: string
+  /** !!! local packages might not have a version */
+  version?: any
+  funding?: any
+  license?: any
+  /** where was the package downloaded from? */
+  resolved?: string
+  /** kind-of checksum of that resolved version */
+  integrity?: string
+  /** is (transitive) optional */
+  optional?: boolean
+  /** is dev-dependency */
+  dev?: boolean
+  /*** is dev-dependency AND is (transitive) optional */
+  devOptional?: boolean
+  /** is not required by any dependency */
+  extraneous?: boolean
+  /** is bundled with another package */
+  inBundle?: boolean
+  dependencies: Set<PackagePath>
+}