Add support for cycloneDX 1.7

Author: eoftedal

CLAUDE.md

@@ -15,18 +15,43 @@ This is a monorepo with two main parts:
 cd node
 npm install
 npm run build       # compile TypeScript → lib/
-npm run test        # run jest test suite (node/spec/tests/*.spec.ts)
+npm run test        # run the test suite (node/spec/tests/*.spec.ts)
 npm run check       # lint + typecheck
 npm run lint        # eslint --fix
 npm run typecheck   # tsc --noEmit
 ```
 
+### Testing
+
+Tests use the built-in [`node:test`](https://nodejs.org/api/test.html) runner (`describe`/`it` with
+`node:assert`), not jest.
+
+**The specs import from `../../lib/`, not `../../src/`, so `npm run build` must be run before
+`npm run test`** — otherwise you are testing the previously compiled output and your changes will
+appear to have no effect:
+
+```bash
+cd node
+npm run build && npm run test
+```
+
 Run a single test file:
 ```bash
 cd node
-npx jest spec/tests/contentscan.spec.ts
+TS_NODE_PROJECT=tsconfig.spec.json node --require ts-node/register --test spec/tests/contentscan.spec.ts
+```
+
+Run a single test by name (matched as a regex against the `it(...)` description):
+```bash
+cd node
+TS_NODE_PROJECT=tsconfig.spec.json node --require ts-node/register --test \
+  --test-name-pattern 'should validate report according to schema' spec/tests/cyclonedx.spec.ts
 ```
 
+Reporters that emit CycloneDX are validated against the JSON schemas bundled in
+`node/spec/schema/`. When adding support for a new spec version, add its `bom-<version>.schema.json`
+there too.
+
 ## Vulnerability repository (repository/)
 
 The source of truth is `jsrepository-master.json`. The other `jsrepository*.json` files are derived outputs and must be kept in sync.

README.md

@@ -31,6 +31,9 @@ retire.js can generate SBOMs in the CycloneDX-format:
 $ retire --outputformat cyclonedx
 ```
 
+`cyclonedx` produces CycloneDX 1.4 XML. For JSON, and for newer spec versions, use `cyclonedxJSON` (1.4), `cyclonedxJSON1_6` or
+`cyclonedxJSON1_7`. The `cyclonedxJSON1_6_VEX` and `cyclonedxJSON1_7_VEX` variants also include a `vulnerabilities` section.
+
 By default retire.js will exit with code 13 if it finds vulnerabilities. This can be overridden with `--exitwith 0`.
 
 

chrome/extension-no-func/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "retire.js-no-func",
   "description": "Scanning website for vulnerable js libraries. Icon by studiomx",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "icons": {
     "16": "icons/icon16.png",
     "48": "icons/icon48.png",

chrome/extension/js/generated/retire-chrome.js

@@ -10871,7 +10871,7 @@ var retirechrome = (() => {
     "../../node/lib/retire.js"(exports) {
       "use strict";
       var exports = exports || {};
-      exports.version = "5.6.0";
+      exports.version = "5.7.0";
       function isDefined(o) {
         return typeof o !== "undefined";
       }

chrome/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "retire.js",
   "description": "Scanning website for vulnerable js libraries. Icon by studiomx",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "icons": {
     "16": "icons/icon16.png",
     "48": "icons/icon48.png",

node/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [5.7.0]
+
+### Improvements
+
+- Added CycloneDX 1.7 output: `--outputformat cyclonedxJSON1_7` and `cyclonedxJSON1_7_VEX`.
+- CycloneDX 1.7 reports every resolved license, each as its own SPDX expression. Earlier spec versions only allow a single expression per component, so 1.4/1.6 output still reports the first license only.
+- The CycloneDX 1.6 and 1.7 reports now include:
+  - `$schema`, pointing at the schema for the emitted spec version.
+  - `metadata.tools` in the object form introduced in 1.5, replacing the deprecated legacy array.
+  - `metadata.component`, describing the scanned path as the subject of the BOM.
+  - `dependencies`, linking the scan target to every detected component.
+  - `evidence.identity`, reporting how the version was detected (`filecontent`, `filename`, `hash`, `ast`, ...) as a CycloneDX identity technique and confidence.
+  - `vulnerabilities[].detail`, when the repository supplies `details` (VEX variants only).
+
+### Bugfixes
+
+- CycloneDX 1.6 output threw when a vulnerability in a custom `--jsrepo` had no `cwe`, and could throw on a vulnerability with no `identifiers`.
+
 ## [5.6.0]
 
 ### Improvements

node/README.md

@@ -18,7 +18,8 @@ Options:
   --jsrepo <path|url>      Local or internal version of repo. Can be multiple comma separated. Default: 'central')
   --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
   --proxy <url>            Proxy url (http://some.host:8080)
-  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON
+  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6,
+                           cyclonedxJSON1_6_VEX, cyclonedxJSON1_7 and cyclonedxJSON1_7_VEX
   --outputpath <path>      File to which output should be written
   --ignore <paths>         Comma delimited list of paths to ignore
   --ignorefile <path>      Custom ignore file, defaults to .retireignore / .retireignore.json
@@ -35,7 +36,9 @@ Options:
 ```
 
 The `depcheck` output format mimics the output of OWASP Dependency Check, but lacks some information compared to OWASP Dependency Check, because that information is not in the repo.
-The `cyclonedx` output format is based on based on the https://github.com/CycloneDX spec.
+The `cyclonedx` output format is based on the https://github.com/CycloneDX spec. `cyclonedx` and `cyclonedxJSON` emit CycloneDX 1.4
+(XML and JSON respectively). `cyclonedxJSON1_6` and `cyclonedxJSON1_7` emit JSON for the corresponding spec versions, and the
+`_VEX` variants of those additionally include a `vulnerabilities` section.
 
 ## .retireignore
 

node/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.6.0';
+exports.version = '5.7.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

node/package-lock.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",