search

CycloneDX / cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. GPT: https://chatgpt.com/g/g-673bfeb4037481919be8a2cd1bf868d2-cdxgen
https://cyclonedx.github.io/cdxgen/
Apache License 2.0
585 stars 156 forks source link

Update packages #1317

Open prabhu opened 3 months ago

prabhu commented 3 months ago

Current list looks like this.

┌─────────────────┬─────────────┬────────┐
│ Package         │ Current     │ Latest │
├─────────────────┼─────────────┼────────┤
│ @babel/parser   │ 7.24.8      │ 7.25.3 │
├─────────────────┼─────────────┼────────┤
│ @babel/traverse │ 7.24.8      │ 7.25.3 │
├─────────────────┼─────────────┼────────┤
│ ajv             │ 8.16.0      │ 8.17.1 │
├─────────────────┼─────────────┼────────┤
│ packageurl-js   │ 1.0.2       │ 1.2.1  │
├─────────────────┼─────────────┼────────┤
│ tar             │ 6.2.1       │ 7.4.3  │
├─────────────────┼─────────────┼────────┤
│ cheerio         │ 1.0.0-rc.12 │ 1.0.0  │
└─────────────────┴─────────────┴────────┘

The issue is the need for testing after updating. For example, to update babel we need a sample list of javascript and typescript repos and run cdxgen with --profile research, then compare the occurrence and callstack evidence. May be there is an opportunity to enhance the custom-json-diff tool to handle evidence attributes?

For tar, we need to test with a range of oci images (both container and tar versions). Note that v7 is so different (and buggy) that even the maintainer hasn't made them the default yet.

packageurl-js had a number of breaking changes and was failing for container images when I tried it the last time.

Not sure about ajv and cheerio.

prabhu commented 2 months ago 
pnpm outdated
┌───────────────┬─────────┬────────┐
│ Package       │ Current │ Latest │
├───────────────┼─────────┼────────┤
│ packageurl-js │ 1.0.2   │ 2.0.0  │
├───────────────┼─────────┼────────┤
│ tar           │ 6.2.1   │ 7.4.3  │
└───────────────┴─────────┴────────┘
prabhu commented 4 weeks ago

Only packageurl-js is left.