fix: prevent version modifications

.github/workflows/npm-ls_demo-results.yml

@@ -35,6 +35,7 @@ jobs:
           - juice-shop
           - local-dependencies
           - local-workspaces
+          - package-with-build-id
         npm-version:
           ## see https://www.npmjs.com/package/npm?activeTab=versions
           ## see also: https://github.com/npm/cli/releases

HISTORY.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
+* Fixed
+  * No longer omit components' version's buildID ([#551] via [#597])  
+    Only affects NPM>=7. NPM6 omits this information in the first place, still.
+
+[#551]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/551
+[#597]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/597
+
 ## 1.9.1 - 2023-03-15
 
 * Docs

demo/README.md

@@ -8,6 +8,7 @@ Each project demonstrates an individual use case:
 * [use of local dependencies](local-dependencies)
 * [use of workspaces](local-workspaces)
 * [the Juice Shop](juice-shop)
+* [package with buildID in version](package-with-build-id)
 
 Each dir contains of a `project` folder that holds the npm package
 and a `example-results` folder that holds generated boms.

demo/package-with-build-id/README.md

@@ -0,0 +1,40 @@
+# Integration test: local workspaces
+
+Install a package with a non-SemVer or a buildID and see how they behave.
+
+## remarks
+
+* _npm_ v6 cuts of the buildID from the version string
+* _npm_ v7 leaves the version string unchanged
+
+## output
+
+see [demo snapshots](../../tests/_data/npm-ls_demo-results/package-with-build-id).
+
+Output of `npm6 ls --json -a -l` look like this:
+
+```json5
+{
+  "name": "demo-package-with-build-id",
+  "version": "1.0.0-123",
+  "_id": "demo-package-with-build-id@1.0.0-123",
+  "_shrinkwrap": {
+    "name": "demo-package-with-build-id",
+    "version": "1.0.0-123+456",
+    "lockfileVersion": 1
+  },
+  // other properties
+}
+```
+
+
+Output of `npm7 ls --json -a -l` look like this:
+
+```json5
+{
+  "version": "1.0.0-123+456",
+  "name": "demo-package-with-build-id",
+  "_id": "demo-package-with-build-id@1.0.0-123+456",
+  // other properties
+}
+```