{"id":15062507,"url":"https://github.com/cyclonedx/cyclonedx-node-yarn","last_synced_at":"2025-10-29T08:01:59.541Z","repository":{"id":39868042,"uuid":"507229238","full_name":"CycloneDX/cyclonedx-node-yarn","owner":"CycloneDX","description":"Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.","archived":false,"fork":false,"pushed_at":"2025-04-10T09:43:38.000Z","size":6258,"stargazers_count":22,"open_issues_count":20,"forks_count":6,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-10T10:47:41.500Z","etag":null,"topics":["bill-of-materials","bom","cyclonedx","hacktoberfest","node","nodejs","sbom","sbom-generator","sbom-tool","software-bill-of-materials","yarn","yarn-plugin"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CycloneDX.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"]}},"created_at":"2022-06-25T06:08:00.000Z","updated_at":"2025-04-10T09:43:41.000Z","dependencies_parsed_at":"2024-05-13T18:04:03.370Z","dependency_job_id":"4d8f2a35-5950-40b3-8072-b928b0db5617","html_url":"https://github.com/CycloneDX/cyclonedx-node-yarn","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-node-yarn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-node-yarn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-node-yarn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-node-yarn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CycloneDX","download_url":"https://codeload.github.com/CycloneDX/cyclonedx-node-yarn/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248225844,"owners_count":21068078,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bill-of-materials","bom","cyclonedx","hacktoberfest","node","nodejs","sbom","sbom-generator","sbom-tool","software-bill-of-materials","yarn","yarn-plugin"],"created_at":"2024-09-24T23:41:48.307Z","updated_at":"2025-10-29T08:01:59.531Z","avatar_url":"https://github.com/CycloneDX.png","language":"JavaScript","funding_links":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"],"categories":[],"sub_categories":[],"readme":"# CycloneDX SBOM for yarn\n\n[![shield_yarnpkg-version]][link_yarnpkg]\n[![shield_npm-version]][link_npm]\n[![shield_gh-workflow-test]][link_gh-workflow-test]\n[![shield_coverage]][link_codacy]\n[![shield_ossf-best-practices]][link_ossf-best-practices]\n[![shield_license]][license_file]  \n[![shield_website]][link_website]\n[![shield_slack]][link_slack]\n[![shield_groups]][link_discussion]\n[![shield_twitter-follow]][link_twitter]\n\n----\n\nCreate [CycloneDX] Software Bill of Materials (SBOM) from _[yarn]_ projects.  \nThis is probably the most accurate, complete SBOM generator for yarn-based projects.\n\n## Requirements\n\n* `node \u003e= 20.18.0`\n* `yarn \u003e= 4.0.0` (berry)\n\nHowever, there are older version of this software which support \n* Node v18 and later\n* Yarn v3  and later\n\n## Installation\n\nInstall the plugin into your yarn project via one of the following methods:\n\n* **zero-install**: No install needed, just call on demand via dlx-wrapper as described in section \"usage\".\n* **cli-wrapper**: As a development dependency of the current project:\n  ```shell\n  yarn add --dev @cyclonedx/yarn-plugin-cyclonedx\n  ```\n* **plugin**: Install the [latest version from GitHub release](https://github.com/CycloneDX/cyclonedx-node-yarn/releases/latest) asset as a plugin for the current project:\n  ```shell\n  yarn plugin import https://github.com/CycloneDX/cyclonedx-node-yarn/releases/latest/download/yarn-plugin-cyclonedx.cjs\n  ```\n\n## Usage\n\nUsage depends on the installation method:\n\n* With **zero-install** via dlx-wrapper:\n  ```shell\n  yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --help\n  ```\n* After **cli-wrapper** installation:\n  ```shell\n  yarn exec cyclonedx-yarn --help\n  ```\n* After **plugin** installation:\n  ```shell \n  yarn cyclonedx --help\n  ```\n\nThe help page:\n\n```text\nGenerates CycloneDX SBOM for current workspace.\n\n━━━ Usage ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n$ yarn cyclonedx\n\n━━━ Options ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  --production,--prod        Exclude development dependencies.\n                             (default: true if the NODE_ENV environment variable is set to \"production\", otherwise false)\n  --gather-license-texts     Search for license files in components and include them as license evidence.\n                             This feature is experimental.\n  --short-PURLs              Omit all qualifiers from PackageURLs.\n                             This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.\n  --sv,--spec-version #0     Which version of CycloneDX to use.\n                             (choices: 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, default: 1.6)\n  --output-reproducible      Whether to go the extra mile and make the output reproducible.\n                             This might result in loss of time- and random-based values.\n  --of,--output-format #0    Which output format to use.\n                             (choices: JSON, XML, default: JSON)\n  -o,--output-file #0        Path to the output file.\n                             Set to \"-\" to write to STDOUT.\n                             (default: write to STDOUT)\n  --mc-type #0               Type of the main component.\n                             (choices: application, library, firmware, default: application)\n  -v,--verbose               Increase the verbosity of messages.\n                             Use multiple times to increase the verbosity even more.\n\n━━━ Details ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nRecursively scan workspace dependencies and emits them as \nSoftware-Bill-of-Materials(SBOM) in CycloneDX format.\n```\n\n\n## Internals\n\nThis _yarn_ plugin utilizes the [CycloneDX library][CycloneDX-library] to generate the actual data structures.\n\nThis tool does **not** expose any additional _public_ API or classes - all code is intended to be internal and might change without any notice during version upgrades.\nHowever, the CLI is stable - you may call it programmatically like:\n```javascript\nconst { execFileSync } = require('node:child_process')\nconst { constants: { MAX_LENGTH: BUFFER_MAX_LENGTH } } = require('node:buffer')\nconst sbom = JSON.parse(execFileSync(process.execPath, [\n    '.../path/to/this/package/bin/cyclonedx-yarn-cli.js',\n    '--output-format', 'JSON',\n    '--output-file', '-'\n    // additional CLI args\n  ], {stdio: ['ignore', 'pipe', 'ignore'], encoding: 'buffer', maxBuffer: BUFFER_MAX_LENGTH }))\n```\n\n## Development \u0026 Contributing\n\nFeel free to open issues, bugreports or pull requests.  \nSee the [`CONTRIBUTING`][contributing_file] file for details.\n\n## License\n\nPermission to modify and redistribute is granted under the terms of the Apache 2.0 license.  \nSee the [`LICENSE`][license_file] file for the full license.\n\nFor details and license posture of the assembly, see the `LICENSE` file in the respective release assets.\n\n\n[license_file]: https://github.com/CycloneDX/cyclonedx-node-yarn/blob/main/LICENSE\n[contributing_file]: https://github.com/CycloneDX/cyclonedx-node-yarn/blob/main/CONTRIBUTING.md\n\n[CycloneDX]: https://cyclonedx.org/\n[yarn]: https://yarnpkg.com/\n[cyclonedx-library]: https://www.npmjs.com/package/@cyclonedx/cyclonedx-library\n\n[shield_gh-workflow-test]: https://img.shields.io/github/actions/workflow/status/CycloneDX/cyclonedx-node-yarn/nodejs.yml?branch=main\u0026logo=GitHub\u0026logoColor=white \"tests\"\n[shield_coverage]: https://img.shields.io/codacy/coverage/b0af77db5c7b4ab7a36eab255c7f9ede?logo=Codacy\u0026logoColor=white \"test coverage\"\n[shield_ossf-best-practices]: https://img.shields.io/cii/percentage/8960?label=OpenSSF%20best%20practices \"OpenSSF best practices\"\n[shield_yarnpkg-version]: https://img.shields.io/npm/v/%40cyclonedx%2Fyarn-plugin-cyclonedx/latest?registry_uri=https%3A%2F%2Fregistry.yarnpkg.com\u0026logo=yarn\u0026logoColor=white\u0026label=yarnpkg \"yarnpkg\"\n[shield_npm-version]: https://img.shields.io/npm/v/%40cyclonedx%2Fyarn-plugin-cyclonedx/latest?logo=npm\u0026logoColor=white\u0026label=npm \"npm\"\n[shield_license]: https://img.shields.io/github/license/CycloneDX/cyclonedx-node-yarn?logo=open%20source%20initiative\u0026logoColor=white \"license\"\n[shield_website]: https://img.shields.io/badge/https://-cyclonedx.org-blue.svg \"homepage\"\n[shield_slack]: https://img.shields.io/badge/slack-join-blue?logo=Slack\u0026logoColor=white \"slack join\"\n[shield_groups]: https://img.shields.io/badge/discussion-groups.io-blue.svg \"groups discussion\"\n[shield_twitter-follow]: https://img.shields.io/badge/Twitter-follow-blue?logo=Twitter\u0026logoColor=white \"twitter follow\"\n\n[link_website]: https://cyclonedx.org/\n[link_gh-workflow-test]: https://github.com/CycloneDX/cyclonedx-node-yarn/actions/workflows/nodejs.yml?query=branch%3Amain\n[link_yarnpkg]: https://yarnpkg.com/package?name=%40cyclonedx%2Fyarn-plugin-cyclonedx\n[link_npm]: https://www.npmjs.com/package/@cyclonedx/yarn-plugin-cyclonedx\n[link_codacy]: https://app.codacy.com/gh/CycloneDX/cyclonedx-node-yarn/dashboard\n[link_ossf-best-practices]: https://www.bestpractices.dev/projects/8960\n[link_slack]: https://cyclonedx.org/slack/invite\n[link_discussion]: https://groups.io/g/CycloneDX\n[link_twitter]: https://twitter.com/CycloneDX_Spec\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-node-yarn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyclonedx%2Fcyclonedx-node-yarn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-node-yarn/lists"}