cyclonedx-node-module ignores package-lock.json about cyclonedx-node-module HOT 5 CLOSED

This has been incorporated into v2.0.0 and will be available soon.

from cyclonedx-node-module.

Yes, a million times yes! I'm not a node programmer, so I just downloaded one of our repositories, ran 'cyclonedx-bom -o bom.xml' on it, and was dumbfounded because the bom.xml file was empty. I tried everything I could think of to get it to work, and eventually Googled my way to salvation by finding this issue (and fix). Up until 3am working on this, feeling a bit loopy right now.

from cyclonedx-node-module.

The lock file doesn't provide enough information so it cannot be used by itself. node_modules needs to be there.

I'm in the process of completely refactoring the node module. I'll add a check that outputs some help in the event a BOM with zero components is produced. Look for these changes in v2.0.0 of the module.

from cyclonedx-node-module.

@stevespringett curious what information you get from node_modules that you cant see in package-lock.json ?

requiring node_modules adds extra steps (and time) when doing this on the CI.

from cyclonedx-node-module.

The following data can easily be incorporated into a BOM using node_modules, but not with a package-lock.json:

• Component description
• Component type (framework, library, etc)
• Authors
• License
• License file
• Website URL
• Issue tracker URL
• VCS URL

SPDX license ID and optional license file are obviously valuable for legal and compliance use cases. The URLs are valuable not only for documentation purposes, but for advanced forms of analysis as well (e.g. project health). In addition, future versions of the node plugin will include every file-level component and their corresponding hash values, etc, that provided integrity above and beyond what package-lock.json is capable of achieving.

from cyclonedx-node-module.