CycloneDX
Update packages
Current list looks like this.
┌─────────────────┬─────────────┬────────┐
│ Package │ Current │ Latest │
├─────────────────┼─────────────┼────────┤
│ @babel/parser │ 7.24.8 │ 7.25.3 │
├─────────────────┼─────────────┼────────┤
│ @babel/traverse │ 7.24.8 │ 7.25.3 │
├─────────────────┼─────────────┼────────┤
│ ajv │ 8.16.0 │ 8.17.1 │
├─────────────────┼─────────────┼────────┤
│ packageurl-js │ 1.0.2 │ 1.2.1 │
├─────────────────┼─────────────┼────────┤
│ tar │ 6.2.1 │ 7.4.3 │
├─────────────────┼─────────────┼────────┤
│ cheerio │ 1.0.0-rc.12 │ 1.0.0 │
└─────────────────┴─────────────┴────────┘
The issue is the need for testing after updating. For example, to update babel we need a sample list of javascript and typescript repos and run cdxgen with --profile research, then compare the occurrence and callstack evidence. May be there is an opportunity to enhance the custom-json-diff tool to handle evidence attributes?
For tar, we need to test with a range of oci images (both container and tar versions). Note that v7 is so different (and buggy) that even the maintainer hasn't made them the default yet.
packageurl-js had a number of breaking changes and was failing for container images when I tried it the last time.
Not sure about ajv and cheerio.
pnpm outdated
┌───────────────┬─────────┬────────┐
│ Package │ Current │ Latest │
├───────────────┼─────────┼────────┤
│ packageurl-js │ 1.0.2 │ 2.0.0 │
├───────────────┼─────────┼────────┤
│ tar │ 6.2.1 │ 7.4.3 │
└───────────────┴─────────┴────────┘
