npm / @cyclonedx/cdxgen
@cyclonedx/cdxgen
What changed in @cyclonedx/cdxgen 12 to 13, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
32 breaking35 security79 new APIs and options9 performance61 behavior and defaults6 tooling81 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@cyclonedx/cdxgen 13199 changes
Breaking changes 20
Requires --verify-existing-with or --allow-unverified-history before adding a signers entry.
Exits with status 4 whenever a key is given and verification fails.
Requires --public-key or --secret-key and a root signature; verification rejects invalid UTF-8, duplicate member names, and numbers not exactly representable as doubles.
Generated .NET purls no longer use @latest.
A project's settings.xml no longer overrides configured mirrors and credentials.
cdx-verify requires this repeatable option or --secret-key, rather than falling back to a working-directory public.key.
Fails when the sandbox refuses a trace run instead of writing an empty BOM.
Lets cdx-sign verify existing history before adding a signers entry.
Verification is stricter against BOM content not signed by the trusted key, including missing root signatures and ambiguous JSON values.
The cbom command rejects
-t osinstead of attempting source crypto analysis against an OS inventory.Distro qualifiers are aligned with purl namespaces, and Azure Linux and CBL-Mariner are canonicalised to azure-linux.
The npm package was renamed from @cyclonedx/cdxgen.
The generation floor is now CycloneDX 1.6, 1.7 is the default, and 2.0 is accepted as a target; CLI generation of 1.4 and 1.5 is no longer supported.
Container images moved from the ghcr.io/cyclonedx namespace to ghcr.io/cdxgen.
The minimum supported Node.js version is now 24.
Writes the BOM document to stdout instead of silently creating a file named -.
Invalid purls are omitted, PyPI names are normalized, and several purl forms were repaired; downstream consumers should normalize purl strings before lookup during the transition.
PyPI names containing dots or underscores are normalized to hyphens per PEP 503, changing both purl and bom-ref.
The Flux data-flow engine drops sanitised and benign flows, lowering reachable counts and increasing purl coverage; existing assertions may need re-baselining.
stdout carries only the payload; diagnostics move to stderr.
Security 21
Allows a BOM without a root signature only when every component, service, and annotation is signed.
pnpm BOMs no longer expose the absolute install path.
Fails when any entry or any provided key does not verify.
Keys response-cache entries on credentials so one user's response is not served to another.
Adds audit rules for mutable git refs, registry modules without exact versions, and sources with embedded credentials.
Prevents credentials in module sources from reaching the BOM.
Crafted container image tar references can no longer access host files through layer, config or WorkingDir paths.
flake.nix inputs are capped or rewritten to run in linear time, reducing parsing abuse.
When dependency installation is disabled, project-local build wrappers and rush or pipenv installers are no longer executed.
Files with prototype-polluting keys now produce a warning instead of crashing.
pnpm lock entries named __proto__ are prevented from reaching the SBOM.
Docker-config registry credentials are forwarded to a token realm only when it is on the registry's own host.
requirements.txt inputs are capped or rewritten to run in linear time, reducing parsing abuse.
Arguments passed to shell commands are quoted for the platform shell so paths with spaces or shell characters remain single tokens.
tracebom runs traced commands through safer-exec with an egress proxy, sandbox dry-run mode and policy flags, and reports unavailable tracing or command failures.
PyTorch pickle checkpoints are flagged because loading them executes code.
ML-DSA, ML-KEM, and all twelve SLH-DSA parameter sets use verified OIDs; unresolvable families are skipped rather than assigned fabricated OIDs.
SLH-DSA now requires its hash family, preventing crashes on spellings such as SLH-DSA-192f.
Plugin skills preview actions with a dry run and do not install dependencies on the user's behalf.
These files are detected and hashed but never executed; repairs are taken from the lockfile instead.
packageExtensions in a project's package.json are applied declaratively and disclosed on the BOM without executing project code.
New APIs and options 53
Allows cdx-sign to add a signers entry without verifying existing history.
Angular app.config.ts files are now analyzed.
astgen adds template analysis for Ember, Angular, Alpine, and Astro.
Reads CMake presets to find build trees.
Mill 1.x projects are inventoried.
scala-cli projects are inventoried.
cdx-verify requires this option or --public-key.
Supports Windows tracing in a Microsoft eXecution Container and records loaded DLLs through ETW with valid purls.
Now include tracebom.
Full CMake and compilation database support depends on atom 4; atom 3.1.1 parses sources without a database as before.
Atom runs have their own configurable time limit.
CAXA_PREFETCH is documented as a configuration point for standalone-binary prefetching.
The standalone binary extraction directory is a reusable cache, with CAXA_TEMP_DIR documented for configuring it.
A path to a CMake cache can be supplied so cdxgen can resolve C and C++ dependencies from the build.
Specify a JSON compilation database explicitly for cdxgen or evinse; it is passed to atom only when the installed atom supports it.
The new caxa mode builds an SBOM from the extracted app, including npm integrity hashes, present native tools and vendored packages.
A new project type inventories installed agentic coding assistants, recording versions and structural counts without configuration values and redacting home paths.
Dosai package reachability verdicts are propagated with their kind, confidence, and reasons.
Kotlin analysis records data-flow slices, trace completeness, workspace-root reachability, and kosi diagnostics, including degraded status when kosi does not trust its counts.
Set a target triple to resolve the Cargo dependency graph for that specific target.
Set this environment variable to 1 to opt out of kosi analysis.
Use this flag to opt out of kosi analysis.
Configure the registry-aware default user agent with this environment variable.
Override the user agent for the crates registry.
Elm is supported as a project type, including elm.json and legacy 0.18 lockfiles, with offline enrichment from ELM_HOME and optional registry queries.
evinse can analyze Kotlin sources natively with kosi, producing source locations, callstacks, cryptographic assets, and SaaSBOM services instead of using the generic JavaScript path.
Kotlin analysis surfaces JNI seams, loadLibrary binding sites, and cinterop .def files as security signals on the components they attach to.
The JavaScript analyzer provides first-class Svelte and SvelteKit support, recovering source evidence from .svelte imports and attributing SvelteKit virtual modules to @sveltejs/kit.
cdxgen ships as a Claude Code plugin for SBOM, container and host scans, CBOM, AI-BOM and MCP inventory, auditing, signing, validation, evidence enrichment, and Dependency-Track publishing.
SaaSBOM routes include handler path and query parameters, request body type, and response type across gin, chi, echo, and net/http.
Scans can report SBOM completeness, build-environment limitations, and ranked remediations to improve fidelity.
The introspect profile provides SBOM completeness reporting and ranked remediation guidance.
CycloneDX 1.7 cryptographic assets support the algorithmFamily field.
Zig is a first-class project type; build.zig.zon is read and the full transitive graph is resolved.
A cache subcommand is available for the bounded fetch cache.
Sets the fetch cache TTL.
The BOM discloses applied npm packageExtensions.
The BOM discloses a hash for applied npm packageExtensions.
Setting this environment variable to stdout restores the v12 stream layout during migration.
CycloneDX 1.7 citations are supported at the document root.
Controls color output.
CycloneDX 1.7 cryptographic assets support the ellipticCurve field.
Gleam is a first-class project type and its project and manifest files are read to map packages to pkg:hex.
Selects the log format, including NDJSON on stderr.
Traffic Light Protocol classification is supported under document distribution constraints, with value redaction for CLEAR, GREEN, and AMBER.
Bazel projects using bzlmod are parsed from MODULE.bazel and MODULE.bazel.lock, with resolved dependencies mapped to their real ecosystem purls.
Mojo is a first-class project type; Mojo-native packages are separated from conda and PyPI packages pulled in through pixi.lock.
Disables the bounded fetch cache.
Disables progress output.
A quiet flag is available.
Retrieves and merges a supplier SBOM over the TEA conformance endpoint.
Publishes the generated BOM as a TEA Artifact; the experimental publisher uses exit status 3 on failure so the locally written BOM is not lost.
Verbose levels are now countable.
Performance 9
Walks the source tree once instead of ten times.
Skips packages no public registry can describe and remembers answers for the whole scan.
Cargo, Go, NuGet, RubyGems, pub, jsr, and Elm enrichment reads local caches first and fills only missing data.
Builds are fully supported and faster; deep sbt scans reuse the Coursier cache.
Large standalone-binary companions become lazy members, extracted and verified on first use, reducing cold-start writes and memory use.
Crate metadata is read from the local Cargo registry before querying crates.io, reducing delays on large lockfiles.
Call graph construction is leaner and roughly ten times faster.
The cdxrs Rust binary backs fetch, while JavaScript paths remain primary and Rust paths are an optional optimization.
Startup and small-project scans are roughly 45 percent faster, peak memory is down, and large scans are significantly faster with the new Rust backend.
Behavior and default changes 43
Astro configuration files are now analyzed.
Separates first-party and vendored code from third-party libraries.
Attributes evidence through resolved includes.
Records the compiler and its hardening flags in the formulation.
Deep sbt scans reuse the Coursier cache.
Uses metadata from the scanned project rather than the current working directory.
Produces Scala occurrences with exact lines, call stacks, crypto asset OIDs, and inbound and outbound endpoints without requiring atom.
Produces Scala occurrences with exact lines, call stacks, crypto asset OIDs, and inbound and outbound endpoints without requiring atom.
Checks local Maven, Gradle, and Coursier caches first, reducing Maven Central requests and avoiding them when build tools use a repository manager.
Pauses a rate-limiting host, honors Retry-After, and advises which mirror setting to use; build tools stop retrying into a rate limit.
Captures TLS details and egress hosts from a normal prompt.
Fills metadata for poetry, uv, pylock, Pipfile.lock, and requirements entries.
backs off from hosts that rate limit.
Builds evidence from compiler facts for Scala 2.13 and Scala 3 through 3.10, improving precision and accuracy.
Default scans now pick up Terraform automatically.
Scans Terraform modules whether or not terraform init or tofu init has run, and builds a dependency graph from the root through modules to providers.
Reads module licenses from downloaded packages, with optional OpenTofu registry and GitHub lookup.
cdxgen resolves C and C++ dependencies from build trees, including CMake requirements and fetched or pinned dependencies, rather than stopping at manifests.
A JSON compilation database is automatically sought in the scan root, usual build directories, and next to --cmake-cache.
The Ruby collector no longer runs for every multi-type scan, avoiding unnecessary bundle install for non-Ruby projects.
In container mode, trivy runs only as a rootfs scan.
Windows container image scans can use WSL Containers automatically when wslc is installed, without requiring Docker Desktop.
Build dependencies and proc-macros move out of the component list into the formulation section, with their bom-refs kept resolvable.
Dynamically linked native libraries are marked external under CycloneDX 1.7.
Maven Central requests are gated behind a per-host rate policy to address its aggregate limits and escalating bans.
Detection now reads additional client configurations, MCP Registry server.json manifests, MCPB and DXT bundles, and signals from the MCP 2026-07-28 protocol draft.
Inventory now recognizes GGUF, safetensors, ONNX, and PyTorch pickle checkpoints.
Crates declaring links produce separate native C library components, so advisories can be associated with the native library rather than its Rust binding.
BOM submission now uses a multipart form POST.
Taint analysis carries field-qualified values across by-value aggregate copies and higher-order calls.
Analysis resolves routes, inventories services and AI usage, seeds taint sources, and maps trust zones, including MCP tooling.
Framework signals are derived from PyPI classifiers, and the frameworks list has grown.
Rust analysis evaluates cfg attributes.
Rust analysis now analyses dependencies.
Rust analysis types method receivers.
Rust analysis resolves real modules and imports rather than guessing.
Unordered collections are sorted at finalization for deterministic output, and annotation timestamps derive from the annotated document so repeated renders agree.
C/C++ BOMs now resolve CMakeCache.txt and git submodules, attach cache versions, collapse repeated CMake requirements, and emit relative purl subpaths for absolute includes and versionless lockfile roots.
A strict purl implementation enforcing the purl-spec ABNF and per-type policies replaces packageurl-js.
Container and OS scan BOMs are kept as CI artifacts even when a scan fails.
Embedded Python SBOMs under this directory are expanded so their declared components appear as dependencies of the distribution.
Native atom binaries remove the JDK requirement on five platform targets; the three jar-kind triples still need Java 23.
Path-style alias values are resolved instead of being built into purls.
Tooling 3
New Python 3.15 images are available.
Swift images now include sourcekitten, so Linux evidence collection does not require an extra install.
Go 1.27 projects are supported end to end.
Fixes and other changes 50
Evidence is version-aware, lists each call site once, and no longer credits framework calls to coverlet.
Resolves repo-relative paths correctly and reports failures.
Gradle builds using the configuration cache work again.
Gradle builds using isolated projects work again.
Attributes dependencies in multi-project Gradle reports to the correct subproject.
Resolves repo-relative paths correctly and reports failures.
Packages with the legacy licenses field now get a license.
Resolves Maven reactors once.
MSBuild property versions now resolve.
Direct dependencies point to what was actually installed.
Multi-project solutions use the version from each project's own restore output.
A failed PyPI lookup can no longer rename a package.
Resolves repo-relative paths correctly and reports failures.
Writes a CBOM that validates against CycloneDX 1.6 and 1.7.
Keeps every traced crypto asset instead of only the last one.
Keeps uv workspace members in every scan.
Validator exceptions now surface in cdx-validate reports.
The .NET root is merged instead of duplicated, synthesized arborist edges are not marked as manifest sources, and protobuf round-trips no longer yield empty dependsOn.
dosai now respects the exclusion option.
JavaScript workspace members are now linked into the dependency tree.
Ruby gem metadata now describes the gem being built, with version and descriptive fields carried over from its gemspec and version.rb.
The cleaned npm version is recorded as a purl qualifier while reserved characters in purls are escaped exactly once.
A NuGet scan falls back when the service index is unreachable.
A gem's required Ruby version is represented as one Ruby platform component with an intersected version range.
Gemspec fields including email, singular license, unquoted homepage URLs and interpolated metadata URIs are now parsed.
evinse evidence is restored for the Swift Build backend by attributing calls through compiler-resolved references.
Bare owner/repo-shaped paths are no longer misclassified as Hugging Face repositories, avoiding an empty AI-only BOM.
A NuGet component's version and purl now stay in agreement.
The TOML parser change enables parsing PEP 735 dependency groups in pyproject.toml files.
The default user agent no longer gets blocked at crates.io's CDN edge, fixing 403s some users saw.
Rust dependency kinds and platform gates are resolved per edge, so this option filters dependencies correctly; observed optional dependencies are promoted to required.
Resolved Rust features are recorded per component.
Crypto algorithm assets resolve OIDs from the shared table; algorithms that cannot be named by the table are skipped instead of emitted invalid.
Audit rules remain evaluable when a property is absent.
Call graph construction falls back to CHA and records a diagnostic instead of aborting the report when underlying analysis panics.
Handler analysis follows import aliases and renamed context parameters, and resolves group-root registrations to their group prefix.
JVM projects can be resolved when their wrapper is broken or they target an unsupported JDK, avoiding shallow BOMs.
Poetry dependency keys are normalised.
Dependency-Track project tags are sent as a comma separated list so they do not land as a single value.
An unparseable workspace pyproject.toml no longer terminates the scan.
First-party modules are no longer misattributed to distributions.
Parsing emits parent dependency edges and repairs missing root edges.
Route templates resolve to concrete URLs, including versioned segments.
Rust analysis recovers from macros.
The cbom command alias now handles -t os.
Cleans the detected parent component.
Fixes canonicalisation of OS package URLs.
Fixes the TUI, which was broken with the new UX.
.NET Central Package Management projects governed by this file now resolve correctly.
Nix flake inputs use pkg:generic with a vcs_url qualifier and proposedType marker instead of the unrecognised pkg:nix type.
@cyclonedx/cdxgen 12104 changes
Breaking changes 12
Allows adding a signers entry without verifying existing signatures when explicitly selected.
Requires a root signature unless --allow-nested-only is used.
Refuses BOMs that are not valid UTF-8, repeat a member name, or contain a number a double cannot represent exactly.
Verification now binds each signature's algorithm, keyId and publicKey, and requires the algorithm to match the key type, fixing a signature forgery vulnerability. Signatures created with 12.8.4 or earlier must be re-signed.
HMAC signatures now require the
--secret-keyoption.When signing is configured but fails, cdxgen exits with an error instead of writing or uploading an unsigned BOM.
The distro_name value can contain only the distro codename.
Includes more Python build packages in generated results.
Filters @types/* npm packages out of runtime scope and requiredOnly BOMs so they appear as dev-only.
Exclude arguments are now passed to atom.
Chrome and IDE extension discovery is limited to explicit extension project types.
Secret-bearing metadata is redacted from BOMs.
Security 14
Accepts a BOM without a root signature only when every component, service and annotation carries a signature that verifies.
Fails when any signature entry or any given key does not verify.
Hardens JSF signature verification so the library function cannot report success for BOM content the trusted key never signed.
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Hardens handling of Maven shell metacharacters to address a security issue.
HBOM secure mode enforces allowlist preflight checks for commands and paths.
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
Dependency-Track submissions enforce host matching to harden security.
Registry authentication now enforces host matching to prevent credential leaks.
Sensitive BOM properties are validated against CycloneDX 1.7 TLP requirements.
Cargo predictive audit can predict supply-chain attacks against dependencies, with expanded coverage for cache inventory and workspace-aware prioritization.
Adds a command to analyse one BOM or a directory of BOMs for upstream supply-chain risks, with severity-based gating for CI and review workflows.
Adds extraction of Chrome extension security properties.
Adds GTFOBins-backed container risk analysis and BOM audit rules.
New APIs and options 26
Adds support for the pnpm CJS alias.
Adds detection of AI-generated code and authorship provenance.
Adds a license enhancer.
Adds components for PDM files.
Adds components for pnpm workspaces.
Adds a checker for policy violations.
Adds native SBOM attachment support for containers.
Adds support for the no-ignore argument.
Adds tracebom support for CBOM generation.
Adds a TUI mode powered by cdxui, available with the --tui argument.
The new ai type generates AI/ML-BOMs.
Adds golem integration for Go analysis, including call graphs, data-flow extraction, supply-chain evidence, and cryptographic-asset component generation.
A component type filter was added; the notes do not specify how to use it.
A caxa v3 batch workflow is available.
HBOM adds a dry and diagnostics mode.
Predictive audit allowlist filtering is available.
C/C++ BOM generation now supports collider.lock files.
Remote and offline OBOM generation now supports staged rootfs inputs.
A dedicated mcp project type is available.
cdxgen can now identify the MCP configurations and skills used in your project.
Adds ATT&CK-aware audit and workflow analysis to cdx-audit.
Adds a command to convert CycloneDX 1.6/1.7 BOMs to SPDX.
Adds dedicated BOM audit rules for Chrome extensions.
Adds direct Chrome extension path scanning using the chrome-extension target.
Adds support for PEP 751 pylock.toml files.
Adds SPDX output support in server mode, including SPDX format support for
/sbom.
Behavior and default changes 18
Adds compatibility with custom license specs.
Bun support is improved.
Strips the Scala version suffix for sbt.
For JavaScript and Python projects, AI-BOMs now include exact occurrence evidence.
evinse is now supported for Rust projects; pass --profile research to generate an SBOM with rich occurrence and call-stack evidence.
Template and icon class heuristics now cover material-symbols, primeicons, bootstrap-icons, and fontawesome.
JavaScript handling was improved; the notes do not specify the details.
CBOM behavior has been improved.
Dry-run mode now traces symlinks, spawn I/O, and archive extraction.
HBOM adds support for SEA binaries.
Package visibility has been improved.
Protobuf BOM support is added to cdx-convert, cdx-validate, cdx-verify, and hbom.
The field is now populated for externally identified components.
Mixed npm source scans now ignore vendored Composer and jar artifacts.
MCP inventory now covers OpenCode, Nanocoder, LangGraph, and CrewAI.
The secure-mode user experience for environment warnings has been improved.
Improves Windows LOLBAS / ATT&CK triage context.
Expands runtime rules for OBOM analysis.
Tooling 3
Changes CLI option parsing to handle defaults better.
Detects CLI scripts using npx and pnpm dlx wrappers and hydrates npm package metadata from disk in deep mode.
The dry-run user experience for activity output has been improved.
Fixes and other changes 31
Fixes an EACCES permission error when scanning /root.
Adds support for .NET Central Package Management.
Improves RubyGems parsing.
Fixes buggy sbt tree parsing.
Decompresses gzip, deflate, and br responses in undici httpClient.
Memoizes jar distribution lookups and discovers projects via sbt to fix hangs when processing sbt projects.
Deno support is added.
The OS distro namespace is canonicalized.
Using --exclude-type mcp no longer over-excludes MCP SDK packages.
Fixes native SBOM pulling for registries that do not provide the referrers API.
Fixes parsing of packages.config files.
Fixes parsing of Yarn aliases so they can be handled correctly.
Improves ASAR detection by sniffing headers.
Fixes a crash when scanning an empty go.mod file.
Fixes incorrect SBOM output when Gradle dependencies are unresolved.
Attempts to find hashes and licenses for Gradle dependencies.
Initial support for CBOM is now available for Rust projects, powered by rusi.
Improves required-scope detection for CSS, template, and CLI-based package usage, and parses .css, .scss, and .less style references.
Hardens Pixi parsing to better handle missing base paths and malformed TOML in workspace lock files.
Vue.js scope detection parses vite.config.* to reduce false negatives.
Vue.js scope detection parses vue.config.* to reduce false negatives.
Java Maven handling was improved; the notes do not specify the details.
Handles object-form GitHub Actions runs-on values.
Fixes profiling of standalone binary dependencies.
OBOM improvements include actionable output and Windows tuning.
BOM audit rules now cover disabled setup caches with remote npm or PyPI sources.
Fixed path selection for staged all-layers inputs.
Correctly classifies npm package-lock devOptional dependencies.
Improves Maven group and name detection from JAR manifests.
Handles Podfile.lock checks in CocoaPods scans without false missing-lock failures.
Adds purl source resolution for GitHub, Bitbucket, Maven, and Composer.