Skip to content

chore(deps): bump @cyclonedx/cdxgen from 12.2.0 to 12.5.1#578

Merged
v3nant merged 1 commit into
mainfrom
dependabot/npm_and_yarn/cyclonedx/cdxgen-12.5.1
Jun 10, 2026
Merged

chore(deps): bump @cyclonedx/cdxgen from 12.2.0 to 12.5.1#578
v3nant merged 1 commit into
mainfrom
dependabot/npm_and_yarn/cyclonedx/cdxgen-12.5.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Bumps @cyclonedx/cdxgen from 12.2.0 to 12.5.1.

Release notes

Sourced from @​cyclonedx/cdxgen's releases.

Release v12.5.1

cdxgen now supports generating AI/ML-BOM with the new -t ai type. For JavaScript and Python projects, AI-BOM would also include the exact occurrence evidence.

evinse is now supported for Rust projects. Pass --profile research to generate SBOM with rich occurrence and call-stack evidence. We have also added initial support for CBOM for Rust. This feature is powered by rusi.

Full Changelog: cdxgen/cdxgen@v12.5.0...v12.5.1

Release v12.5.0

Highlights

This release introduces go evinse with golem integration for deep, data-flow-aware analysis of go projects. The JavaScript analyzer gains type-only import detection, better Vue.js scope resolution, and new npm build script metadata. Angular projects have improved CSS, template, and CLI evidence collection.

Major Features

go evinse with golem (#4073) — Full integration of the golem plugin binary for Go project analysis. Includes call graph and data-flow extraction, evidence collection (callstacks, locations, supply-chain scope), and crypto-flow evidence with cryptographic-asset component generation.

Angular analyzer enhancements (#4074) — Improved required-scope detection for CSS, template, and CLI-based package usage. Style file parsing handles .css, .scss, and .less references. Template and icon class heuristics cover material-symbols, primeicons,bootstrap-icons, and fontawesome. Analyzer now detects CLI scripts including npx and pnpm dlx wrappers and hydrates npm package metadata from disk in deep mode.

Vue.js precision improvements (#4115) — Scope detection parses vite.config.* and vue.config.* to reduce false negatives. astgen from atom-parsetools is improved to better infer types for angular and vue.js in JavaScript and TypeScript.

JavaScript type-only imports (#4110) — The JS/TS analyzer now detects and prunes type-only imports and exports (import type { X }, export type { Y }), producing more accurate scope assignment and reducing false positives for packages used only at compiletime.

@​types packages excluded from runtime scope (#4108) — @types/* npm packages are now filtered out from runtime scope and excluded from requiredOnly BOMs, so they appear correctly as dev-only.

Other Changes

cdxgen-plugins-bin updated: Includes dosai 3.0.5 support with more improvement for dotnet and R. Pixi parsing hardened (#4077): Better handling of missing base paths and malformed toml in pixi.lock workspace files.

Full Changelog: cdxgen/cdxgen@v12.4.4...v12.5.0

Release v12.4.4

What's Changed

Full Changelog: cdxgen/cdxgen@v12.4.3...v12.4.4

Release v12.4.3

This release includes one security fix.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 8, 2026 21:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 8, 2026
Bumps [@cyclonedx/cdxgen](https://github.com/cdxgen/cdxgen) from 12.2.0 to 12.5.1.
- [Release notes](https://github.com/cdxgen/cdxgen/releases)
- [Commits](cdxgen/cdxgen@v12.2.0...v12.5.1)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cdxgen"
  dependency-version: 12.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/cyclonedx/cdxgen-12.5.1 branch from de27257 to 3e4c330 Compare June 10, 2026 19:44
@v3nant v3nant merged commit b77837c into main Jun 10, 2026
12 checks passed
@v3nant v3nant deleted the dependabot/npm_and_yarn/cyclonedx/cdxgen-12.5.1 branch June 10, 2026 20:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants