Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

@cyclonedx/cyclonedx-library

Package Overview
Dependencies
Maintainers
5
Versions
82
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@cyclonedx/cyclonedx-library

Core functionality of CycloneDX for JavaScript (Node.js or WebBrowser).

  • 6.11.0
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
90K
decreased by-14.18%
Maintainers
5
Weekly downloads
 
Created
Source

CycloneDX JavaScript Library

shield_npm-version shield_rtfd shield_gh-workflow-test shield_coverage shield_ossf-best-practices shield_license
shield_website shield_slack shield_groups shield_twitter-follow


Core functionality of CycloneDX for JavaScript (Node.js or WebBrowsers), written in TypeScript and compiled for the target.

Responsibilities

  • Provide a general purpose JavaScript-implementation of CycloneDX for Node.js and WebBrowsers.
  • Provide typing for said implementation, so developers and dev-tools can rely on it.
  • Provide data models to work with CycloneDX.
  • Provide JSON- and XML-normalizers, that...
    • supports all shipped data models.
    • respects any injected CycloneDX Specification and generates valid output according to it.
    • can be configured to generate reproducible/deterministic output.
    • can prepare data structures for JSON- and XML-serialization.
  • Serialization:
    • Provide a universal JSON-serializer for all target environments.
    • Provide an XML-serializer for all target environments.
    • Support the downstream implementation of custom XML-serializers tailored to specific environments
      by providing an abstract base class that takes care of normalization and BomRef-discrimination.
      This is done, because there is no universal XML support in JavaScript.
  • Provide formal JSON- and XML-validators according to CycloneDX Specification. (currently for Node.js only)

Capabilities

  • Enums for the following use cases:
    • AttachmentEncoding
    • ComponentScope
    • ComponentType
    • ExternalReferenceType
    • HashAlgorithm
    • Vulnerability related:
      • AffectStatus
      • AnalysisJustification
      • AnalysisResponse
      • AnalysisState
      • RatingMethod
      • Severity
  • Data models for the following use cases:
    • Attachment
    • Bom
    • BomLink, BomLinkDocument, BomLinkElement
    • BomRef, BomRefRepository
    • Component, ComponentRepository, ComponentEvidence
    • ExternalReference, ExternalReferenceRepository
    • Hash, HashContent, HashDictionary
    • LicenseExpression, NamedLicense, SpdxLicense, LicenseRepository
    • Metadata
    • OrganizationalContact, OrganizationalContactRepository
    • OrganizationalEntity, OrganizationalEntityRepository
    • Property, PropertyRepository
    • SWID
    • Tool, ToolRepository
    • Vulnerability related:
      • Advisory, AdvisoryRepository
      • Affect, AffectRepository, AffectedSingleVersion, AffectedVersionRange, AffectedVersionRepository
      • Analysis
      • Credits
      • Rating, RatingRepository
      • Reference, ReferenceRepository
      • Source
      • Vulnerability, VulnerabilityRepository
  • Utilities for the following use cases:
    • Generate valid random SerialNumbers for Bom.serialNumber
  • Factories for the following use cases:
    • Create data models from any license descriptor string
    • Create PackageURL from Component data models
    • Specific to Node.js: create data models from PackageJson-like data structures and derived data
  • Builders for the following use cases:
    • Specific to Node.js: create deep data models Tool or Component from PackageJson-like data structures
  • Implementation of the CycloneDX Specification for the following versions:
    • 1.6
    • 1.5
    • 1.4
    • 1.3
    • 1.2
  • Normalizers that convert data models to JSON structures
  • Normalizers that convert data models to XML structures
  • Universal serializer that converts Bom data models to JSON string
  • Specific Serializer that converts Bom data models to XML string:
    • Specific to WebBrowsers: implementation utilizes browser-specific document generators and printers.
    • Specific to Node.js: implementation utilizes optional dependencies as described below
  • Formal validators for JSON string and XML string (currently for Node.js only)
    Requires optional dependencies as described below

Installation

This package and the build results are available for npm, pnpm and yarn:

npm i -S @cyclonedx/cyclonedx-library
pnpm add @cyclonedx/cyclonedx-library
yarn add @cyclonedx/cyclonedx-library

You can install the package from source, which will build automatically on installation:

npm i -S github:CycloneDX/cyclonedx-javascript-library
pnpm add github:CycloneDX/cyclonedx-javascript-library
yarn add @cyclonedx/cyclonedx-library@github:CycloneDX/cyclonedx-javascript-library # only with yarn-2

Optional Dependencies

Some dependencies are optional. See the shipped package.json for version constraints.

Usage

See extended examples.

As Node.js package

const CDX = require('@cyclonedx/cyclonedx-library')

const bom = new CDX.Models.Bom()
bom.metadata.component = new CDX.Models.Component(
  CDX.Enums.ComponentType.Application,
  'MyProject'
)
const componentA = new CDX.Models.Component(
  CDX.Enums.ComponentType.Library,
  'myComponentA',
)
bom.components.add(componentA)
bom.metadata.component.dependencies.add(componentA.bomRef)

In WebBrowsers

<script src="path-to-this-package/dist.web/lib.js"></script>
<script type="application/javascript">
    const CDX = CycloneDX_library

    let bom = new CDX.Models.Bom()
    bom.metadata.component = new CDX.Models.Component(
        CDX.Enums.ComponentType.Application,
        'MyProject'
    )
    const componentA = new CDX.Models.Component(
        CDX.Enums.ComponentType.Library,
        'myComponentA',
    )
    bom.components.add(componentA)
    bom.metadata.component.dependencies.add(componentA.bomRef)
</script>

API documentation

We ship annotated type definitions, so that your IDE and tools may pick up the documentation when you use this library downstream.

There are also pre-rendered documentations hosted on readthedocs.

Development & Contributing

Feel free to open issues, bug reports or pull requests.
See the CONTRIBUTING file for details.

License

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.

Keywords

FAQs

Package last updated on 15 Jul 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc