[WIP] feat: support jsr protocol

HISTORY.md

@@ -6,6 +6,12 @@ All notable changes to this project will be documented in this file.
 
 <!-- add unreleased items here -->
 
+* Added
+  * Support yarn protocol `jsr` ([#289] via [#])
+
+[#289]: https://github.com/CycloneDX/cyclonedx-node-yarn/issues/289
+[#]: 
+
 ## 3.0.2 - 2025-04-10
 
 Maintenance release with provenance.

src/builders.ts

@@ -300,6 +300,10 @@ export class BomBuilder {
         // Therefore, do not do anything speculative.
         break
       }
+      case locator.reference.startsWith('jsr:'): {
+        // TODO - https://github.com/CycloneDX/cyclonedx-node-yarn/issues/289
+        break
+      }
       case YarnPluginGitUtils.isGitUrl(locator.reference): {
         component.externalReferences.add(new ExternalReference(
           trySanitizeGitUrl(locator.reference),

tests/_data/testbeds/jsr-protocol-dependency/.gitignore

@@ -0,0 +1,6 @@
+*
+!/.gitignore
+!/README.md
+!/package.json
+!/yarn.lock
+

tests/_data/testbeds/jsr-protocol-dependency/README.md

@@ -0,0 +1,5 @@
+# Integration test: git protocol
+
+*ATTENTION*: this demo might use known vulnerable dependencies for showcasing purposes.
+
+Install dependencies directly via `jsr` protocol.

tests/_data/testbeds/jsr-protocol-dependency/package.json

@@ -0,0 +1,15 @@
+{
+  "private": true,
+  "name": "jsr-protocol-dependency",
+  "description": "demo: jsr-protocol-dependency -- showcase how install via jsr protocol looks like",
+  "version": "0.0.0",
+  "license": "Apache-2.0",
+  "repository": "git@github.com:CycloneDX/cyclonedx-node-yarn.git",
+  "dependencies": {
+    "@act/act": "jsr:^0.1.3"
+  },
+  "scripts": {
+    "SBOM": "YARN_PLUGINS=$PROJECT_CWD/../../../../bundles/@yarnpkg/plugin-cyclonedx.js yarn cyclonedx"
+  },
+  "packageManager": "yarn@4.9.0"
+}

tests/integration/index.test.js

@@ -38,6 +38,7 @@ const testSetups = [
   'git-protocol-dependency',
   'github-protocol-dependency',
   'http-protocol-dependency',
+  'jsr-protocol-dependency',
   // 'juice-shop',
   'local-dependencies',
   'local-workspaces',

tests/integration/setup.js

@@ -36,6 +36,7 @@ const testbedsPath = path.join(testRootPath, '_data', 'testbeds');
     'git-protocol-dependency',
     'github-protocol-dependency',
     'http-protocol-dependency',
+    'jsr-protocol-dependency',
     // 'juice-shop', << may have problems to install on certain systems ...
     'local-dependencies',
     'local-workspaces',