chore(deps): update dependency @cyclonedx/cdxgen to v12.5.0 #29
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/ci-toolchain"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
12.4.4→12.5.0Release Notes
cdxgen/cdxgen (@cyclonedx/cdxgen)
v12.5.0Compare Source
Highlights
This release introduces go evinse with golem integration for deep, data-flow-aware analysis of go projects. The JavaScript analyzer gains type-only import detection, better Vue.js scope resolution, and new npm build script metadata. Angular projects have improved CSS, template, and CLI evidence collection.
Major Features
go evinse with golem (#4073) — Full integration of the golem plugin binary for Go project analysis. Includes call graph and data-flow extraction, evidence collection (callstacks, locations, supply-chain scope), and crypto-flow evidence with cryptographic-asset component generation.
Angular analyzer enhancements (#4074) — Improved required-scope detection for CSS, template, and CLI-based package usage. Style file parsing handles .css, .scss, and .less references. Template and icon class heuristics cover material-symbols, primeicons,bootstrap-icons, and fontawesome. Analyzer now detects CLI scripts including npx and pnpm dlx wrappers and hydrates npm package metadata from disk in deep mode.
Vue.js precision improvements (#4115) — Scope detection parses
vite.config.*andvue.config.*to reduce false negatives. astgen from atom-parsetools is improved to better infer types for angular and vue.js in JavaScript and TypeScript.JavaScript type-only imports (#4110) — The JS/TS analyzer now detects and prunes type-only imports and exports (
import type { X }, export type { Y }), producing more accurate scope assignment and reducing false positives for packages used only at compiletime.@types packages excluded from runtime scope (#4108) — @types/* npm packages are now filtered out from runtime scope and excluded from requiredOnly BOMs, so they appear correctly as dev-only.
Other Changes
cdxgen-plugins-bin updated: Includes dosai 3.0.5 support with more improvement for dotnet and R.
Pixi parsing hardened (#4077): Better handling of missing base paths and malformed toml in pixi.lock workspace files.
Full Changelog: https://github.com/cdxgen/cdxgen/compare/v12.4.4...v12.5.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.