Tool name: CycloneDX JavaScript Library

### homepage_url

https://github.com/CycloneDX/cyclonedx-javascript-library#readme-ov-file

### contact_email

jan.kowalleck [at] owasp.org

### code_view_url

https://github.com/CycloneDX/cyclonedx-javascript-library

### spdx_license_expression

Apache-2.0

### description

This software librart provides the core functionality of [_CycloneDX_][link_website] for _JavaScript_ (_Node.js_ or _WebBrowsers_),
written in _TypeScript_ and compiled for the target.

#### Responsibilities

* Provide a general purpose _JavaScript_-implementation of [_CycloneDX_][link_website] for _Node.js_ and _WebBrowsers_.
* Provide typing for said implementation, so developers and dev-tools can rely on it.
* Provide data models to work with _CycloneDX_.
* Provide JSON- and XML-normalizers, that...
* supports all shipped data models.
* respects any injected [_CycloneDX_ Specification][CycloneDX-spec] and generates valid output according to it.
* can be configured to generate reproducible/deterministic output.
* can prepare data structures for JSON- and XML-serialization.
* Serialization:
* Provide a universal JSON-serializer for all target environments.
* Provide an XML-serializer for all target environments.
* Support the downstream implementation of custom XML-serializers tailored to specific environments
by providing an abstract base class that takes care of normalization and BomRef-discrimination.
This is done, because there is no universal XML support in _JavaScript_.
* Provide formal JSON- and XML-validators according to [_CycloneDX_ Specification][CycloneDX-spec]. (currently for _Node.js_ only)

[link_website]: https://cyclonedx.org/

#### Capabilities

* Enums for the following use cases:
* `AttachmentEncoding`
* `ComponentScope`
* `ComponentType`
* `ExternalReferenceType`
* `HashAlgorithm`
* `Vulnerability` related:
* `AffectStatus`
* `AnalysisJustification`
* `AnalysisResponse`
* `AnalysisState`
* `RatingMethod`
* `Severity`
* Data models for the following use cases:
* `Attachment`
* `Bom`
* `BomLink`, `BomLinkDocument`, `BomLinkElement`
* `BomRef`, `BomRefRepository`
* `Component`, `ComponentRepository`, `ComponentEvidence`
* `ExternalReference`, `ExternalReferenceRepository`
* `Hash`, `HashContent`, `HashDictionary`
* `LicenseExpression`, `NamedLicense`, `SpdxLicense`, `LicenseRepository`
* `Metadata`
* `OrganizationalContact`, `OrganizationalContactRepository`
* `OrganizationalEntity`, `OrganizationalEntityRepository`
* `Property`, `PropertyRepository`
* `SWID`
* `Tool`, `ToolRepository`, `Tools`
* `Vulnerability` related:
* `Advisory`, `AdvisoryRepository`
* `Affect`, `AffectRepository`, `AffectedSingleVersion`, `AffectedVersionRange`, `AffectedVersionRepository`
* `Analysis`
* `Credits`
* `Rating`, `RatingRepository`
* `Reference`, `ReferenceRepository`
* `Source`
* `Vulnerability`, `VulnerabilityRepository`
* Utilities for the following use cases:
* Generate valid random SerialNumbers for `Bom.serialNumber`
* Factories for the following use cases:
* Create data models from any license descriptor string
* Create `PackageURL` from `Component` data models
* Specific to _Node.js_: create data models from PackageJson-like data structures and derived data
* Builders for the following use cases:
* Specific to _Node.js_: create deep data models `Tool` or `Component` from PackageJson-like data structures
* Implementation of the [_CycloneDX_ Specification][CycloneDX-spec] for the following versions:
* `1.6`
* `1.5`
* `1.4`
* `1.3`
* `1.2`
* Normalizers that convert data models to JSON structures
* Normalizers that convert data models to XML structures
* Universal serializer that converts `Bom` data models to JSON string
* Specific Serializer that converts `Bom` data models to XML string
* Formal validators for JSON string and XML string (currently for _Node.js_ only)

[CycloneDX-spec]: https://github.com/CycloneDX/specification/#readme

### primary_languages

TypeScript

### short_term_roadmap

all things are community efforts - come and help/contribute

- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1183
- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1162
- Work In Progress: work towards implementation-completeness regarding CycloneDX data models.
Driven by the community - contributionsare welcome.
- add an alternative for optional EOL dependency `libxmljs2` with something else
- Add support for node v24
- Have known bugs fixed
- Continue supporting the community in contributing new features

### long_term_roadmap

all things are community efforts - come and help/contribute

- support upcoming CycloneDX 1.7 - at least the basics, more on demand.
CDX 1.7 is expected around May/June 2025.
- on demand: continue work towards implementation-completeness regarding CycloneDX
- goal: eventually support all specified data models
- driven by the community - contributions welcome!
- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1079
- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1193
- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1055
- support EOL _node_/JavaScript/TypeScript versions for as long as possible, unless a technical reason forces to drop
- https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1053

### proprietary_data

- [ ] Yes, the tool depends on proprietary data sources

### commercial_features

- [ ] Yes, the tool has a commercial version with different/additional features

### capabilities

- [x] Identifiers - Use Package-URL (PURL) identifiers
- [x] Identifiers - Use SPDX license expressions
- [x] Scanning - Analyze package manifests and lockfiles
- [ ] Scanning - Analyze package files
- [ ] Scanning - Scan for copyright
- [ ] Scanning - Scan for license
- [ ] Scanning - Analyze source code
- [ ] Scanning - Analyze containers
- [ ] Scanning - Analyze installed system packages (linux distros)
- [ ] Scanning - Analyze installed application packages
- [ ] Scanning - Other analysis
- [ ] Packages - Inventory packages
- [ ] Packages - Inventory packages dependencies
- [ ] Packages - Resolve dependencies
- [ ] Packages - Navigate or display dependency graph
- [x] Compliance - Generate CycloneDX SBOMs
- [ ] Compliance - Generate SPDX SBOMs
- [x] Compliance - Validate CycloneDX SBOM
- [ ] Compliance - Validate SPDX SBOMs
- [x] Compliance - Generate CycloneDX VEX
- [ ] Compliance - Generate CSAF VEX
- [ ] Compliance - Generate OpenVex
- [ ] Compliance - Generate other compliance documents
- [ ] Policies - Define and check license policies
- [ ] Policies - Define and check security policies
- [ ] Policies - Define and check other policies
- [ ] Data - Database of Package metadata
- [ ] Data - Database of Package dependency relationships
- [ ] Data - Database of License obligations
- [ ] Data - Database of Licenses
- [ ] Data - Database of Vulnerabilities
- [x] License - Help triage license issues
- [ ] License - Generate license credit and attribution notices
- [ ] License - Generate source code redistribution lists
- [ ] Vulnerabilities - Detect vulnerable code in packages
- [ ] Vulnerabilities - Find known vulnerabilities for package
- [ ] Vulnerabilities - Determine reachable vulnerabilities
- [ ] Vulnerabilities - Help triage vulnerabilities
- [ ] Binaries - Analyze binaries
- [ ] Binaries - Analyze ELF binaries
- [ ] Binaries - Analyze Windows binaries
- [ ] Binaries - Analyze firmware binaries
- [ ] Binaries - Analyze Other binaries
- [ ] Matching - Match source code
- [ ] Matching - Match binary code
- [ ] Tracing - Trace code execution
- [ ] Tracing - Trace build
- [ ] Code Security - Analyze code statically (SAST/linting)
- [ ] Code Security - Analyze code dynamically (DAST)
- [ ] Download - Source package
- [ ] Download - Source repositories
- [ ] Download - Binary package
- [ ] Deployment - Deployable as containers (Docker/OCI/k8s/etc)
- [ ] Deployment - Deployable in CI/CD pipelines
- [x] Deployment - Deployable as a library
- [ ] Run - Run as a command line tool
- [ ] Run - Run as a web application
- [ ] Run - Run as an API service

### other_capabilities

License triage - When incorrect SPDX license identifiers are detected and can be mapped to correct SPDX License identifiers where possible this is identified