codekingpro/portable-devtools
114k
1<!DOCTYPE html><html><head>
2<meta charset="utf-8">
3<title>npm-sbom</title>
4<style>
5body {
6 background-color: #ffffff;
7 color: #24292e;
8
9 margin: 0;
10
11 line-height: 1.5;
12
13 font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
14}
15#rainbar {
16 height: 10px;
17 background-image: linear-gradient(139deg, #fb8817, #ff4b01, #c12127, #e02aff);
18}
19
20a {
21 text-decoration: none;
22 color: #0366d6;
23}
24a:hover {
25 text-decoration: underline;
26}
27
28pre {
29 margin: 1em 0px;
30 padding: 1em;
31 border: solid 1px #e1e4e8;
32 border-radius: 6px;
33
34 display: block;
35 overflow: auto;
36
37 white-space: pre;
38
39 background-color: #f6f8fa;
40 color: #393a34;
41}
42code {
43 font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace;
44 font-size: 85%;
45 padding: 0.2em 0.4em;
46 background-color: #f6f8fa;
47 color: #393a34;
48}
49pre > code {
50 padding: 0;
51 background-color: inherit;
52 color: inherit;
53}
54h1, h2, h3 {
55 font-weight: 600;
56}
57
58#logobar {
59 background-color: #333333;
60 margin: 0 auto;
61 padding: 1em 4em;
62}
63#logobar .logo {
64 float: left;
65}
66#logobar .title {
67 font-weight: 600;
68 color: #dddddd;
69 float: left;
70 margin: 5px 0 0 1em;
71}
72#logobar:after {
73 content: "";
74 display: block;
75 clear: both;
76}
77
78#content {
79 margin: 0 auto;
80 padding: 0 4em;
81}
82
83#table_of_contents > h2 {
84 font-size: 1.17em;
85}
86#table_of_contents ul:first-child {
87 border: solid 1px #e1e4e8;
88 border-radius: 6px;
89 padding: 1em;
90 background-color: #f6f8fa;
91 color: #393a34;
92}
93#table_of_contents ul {
94 list-style-type: none;
95 padding-left: 1.5em;
96}
97#table_of_contents li {
98 font-size: 0.9em;
99}
100#table_of_contents li a {
101 color: #000000;
102}
103
104header.title {
105 border-bottom: solid 1px #e1e4e8;
106}
107header.title > h1 {
108 margin-bottom: 0.25em;
109}
110header.title > .description {
111 display: block;
112 margin-bottom: 0.5em;
113 line-height: 1;
114}
115
116header.title .version {
117 font-size: 0.8em;
118 color: #666666;
119}
120
121footer#edit {
122 border-top: solid 1px #e1e4e8;
123 margin: 3em 0 4em 0;
124 padding-top: 2em;
125}
126
127table {
128 width: 100%;
129 margin: 1em 0;
130 border-radius: 6px;
131 border: 1px solid #e1e4e8;
132 overflow: hidden;
133 border-collapse: separate;
134 border-spacing: 0;
135}
136
137table thead {
138 background-color: #f6f8fa;
139}
140
141table tbody {
142 background-color: #ffffff;
143}
144
145table th,
146table td {
147 padding: 0.75em;
148 text-align: left;
149 border-right: 1px solid #e1e4e8;
150 border-bottom: 1px solid #e1e4e8;
151}
152
153table th:last-child,
154table td:last-child {
155 border-right: none;
156}
157
158table tbody tr:last-child td {
159 border-bottom: none;
160}
161
162table th {
163 font-weight: 600;
164 background-color: #f6f8fa;
165}
166
167table code {
168 white-space: nowrap;
169}
170
171</style>
172</head>
173<body>
174<div id="banner">
175<div id="rainbar"></div>
176<div id="logobar">
177<svg class="logo" role="img" height="32" width="32" viewBox="0 0 700 700">
178<polygon fill="#cb0000" points="0,700 700,700 700,0 0,0"></polygon>
179<polygon fill="#ffffff" points="150,550 350,550 350,250 450,250 450,550 550,550 550,150 150,150"></polygon>
180</svg>
181<div class="title">
182npm command-line interface
183</div>
184</div>
185</div>
186
187<section id="content">
188<header class="title">
189<h1 id="----npm-sbom----11121">
190 <span>npm-sbom</span>
191 <span class="version">@11.12.1</span>
192</h1>
193<span class="description">Generate a Software Bill of Materials (SBOM)</span>
194</header>
195
196<section id="table_of_contents">
197<h2 id="table-of-contents">Table of contents</h2>
198<div id="_table_of_contents"><ul><li><a href="#see-also">See Also</a></li></ul></div>
199</section>
200
201<div id="_content"><h3 id="synopsis">Synopsis</h3>
202<pre><code class="language-bash">npm sbom
203</code></pre>
204<h3 id="description">Description</h3>
205<p>The <code>npm sbom</code> command generates a Software Bill of Materials (SBOM) listing the dependencies for the current project.
206SBOMs can be generated in either <a href="https://spdx.dev/">SPDX</a> or <a href="https://cyclonedx.org/">CycloneDX</a> format.</p>
207<h3 id="example-cyclonedx-sbom">Example CycloneDX SBOM</h3>
208<pre><code class="language-json">{
209 "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
210 "bomFormat": "CycloneDX",
211 "specVersion": "1.5",
212 "serialNumber": "urn:uuid:09f55116-97e1-49cf-b3b8-44d0207e7730",
213 "version": 1,
214 "metadata": {
215 "timestamp": "2023-09-01T00:00:00.001Z",
216 "lifecycles": [
217 {
218 "phase": "build"
219 }
220 ],
221 "tools": [
222 {
223 "vendor": "npm",
224 "name": "cli",
225 "version": "10.1.0"
226 }
227 ],
228 "component": {
229 "bom-ref": "simple@1.0.0",
230 "type": "library",
231 "name": "simple",
232 "version": "1.0.0",
233 "scope": "required",
234 "author": "John Doe",
235 "description": "simple react app",
236 "purl": "pkg:npm/simple@1.0.0",
237 "properties": [
238 {
239 "name": "cdx:npm:package:path",
240 "value": ""
241 }
242 ],
243 "externalReferences": [],
244 "licenses": [
245 {
246 "license": {
247 "id": "MIT"
248 }
249 }
250 ]
251 }
252 },
253 "components": [
254 {
255 "bom-ref": "lodash@4.17.21",
256 "type": "library",
257 "name": "lodash",
258 "version": "4.17.21",
259 "scope": "required",
260 "author": "John-David Dalton",
261 "description": "Lodash modular utilities.",
262 "purl": "pkg:npm/lodash@4.17.21",
263 "properties": [
264 {
265 "name": "cdx:npm:package:path",
266 "value": "node_modules/lodash"
267 }
268 ],
269 "externalReferences": [
270 {
271 "type": "distribution",
272 "url": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
273 },
274 {
275 "type": "vcs",
276 "url": "git+https://github.com/lodash/lodash.git"
277 },
278 {
279 "type": "website",
280 "url": "https://lodash.com/"
281 },
282 {
283 "type": "issue-tracker",
284 "url": "https://github.com/lodash/lodash/issues"
285 }
286 ],
287 "hashes": [
288 {
289 "alg": "SHA-512",
290 "content": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
291 }
292 ],
293 "licenses": [
294 {
295 "license": {
296 "id": "MIT"
297 }
298 }
299 ]
300 }
301 ],
302 "dependencies": [
303 {
304 "ref": "simple@1.0.0",
305 "dependsOn": [
306 "lodash@4.17.21"
307 ]
308 },
309 {
310 "ref": "lodash@4.17.21",
311 "dependsOn": []
312 }
313 ]
314}
315</code></pre>
316<h3 id="example-spdx-sbom">Example SPDX SBOM</h3>
317<pre><code class="language-json">{
318 "spdxVersion": "SPDX-2.3",
319 "dataLicense": "CC0-1.0",
320 "SPDXID": "SPDXRef-DOCUMENT",
321 "name": "simple@1.0.0",
322 "documentNamespace": "http://spdx.org/spdxdocs/simple-1.0.0-bf81090e-8bbc-459d-bec9-abeb794e096a",
323 "creationInfo": {
324 "created": "2023-09-01T00:00:00.001Z",
325 "creators": [
326 "Tool: npm/cli-10.1.0"
327 ]
328 },
329 "documentDescribes": [
330 "SPDXRef-Package-simple-1.0.0"
331 ],
332 "packages": [
333 {
334 "name": "simple",
335 "SPDXID": "SPDXRef-Package-simple-1.0.0",
336 "versionInfo": "1.0.0",
337 "packageFileName": "",
338 "description": "simple react app",
339 "primaryPackagePurpose": "LIBRARY",
340 "downloadLocation": "NOASSERTION",
341 "filesAnalyzed": false,
342 "homepage": "NOASSERTION",
343 "licenseDeclared": "MIT",
344 "externalRefs": [
345 {
346 "referenceCategory": "PACKAGE-MANAGER",
347 "referenceType": "purl",
348 "referenceLocator": "pkg:npm/simple@1.0.0"
349 }
350 ]
351 },
352 {
353 "name": "lodash",
354 "SPDXID": "SPDXRef-Package-lodash-4.17.21",
355 "versionInfo": "4.17.21",
356 "packageFileName": "node_modules/lodash",
357 "description": "Lodash modular utilities.",
358 "downloadLocation": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
359 "filesAnalyzed": false,
360 "homepage": "https://lodash.com/",
361 "licenseDeclared": "MIT",
362 "externalRefs": [
363 {
364 "referenceCategory": "PACKAGE-MANAGER",
365 "referenceType": "purl",
366 "referenceLocator": "pkg:npm/lodash@4.17.21"
367 }
368 ],
369 "checksums": [
370 {
371 "algorithm": "SHA512",
372 "checksumValue": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
373 }
374 ]
375 }
376 ],
377 "relationships": [
378 {
379 "spdxElementId": "SPDXRef-DOCUMENT",
380 "relatedSpdxElement": "SPDXRef-Package-simple-1.0.0",
381 "relationshipType": "DESCRIBES"
382 },
383 {
384 "spdxElementId": "SPDXRef-Package-simple-1.0.0",
385 "relatedSpdxElement": "SPDXRef-Package-lodash-4.17.21",
386 "relationshipType": "DEPENDS_ON"
387 }
388 ]
389}
390</code></pre>
391<h3 id="package-lock-only-mode">Package lock only mode</h3>
392<p>If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded.
393This means that information from the package.json files of your dependencies will not be included in the result set (e.g.
394description, homepage, engines).</p>
395<h3 id="configuration">Configuration</h3>
396<h4 id="omit"><code>omit</code></h4>
397<ul>
398<li>Default: 'dev' if the <code>NODE_ENV</code> environment variable is set to
399'production'; otherwise, empty.</li>
400<li>Type: "dev", "optional", or "peer" (can be set multiple times)</li>
401</ul>
402<p>Dependency types to omit from the installation tree on disk.</p>
403<p>Note that these dependencies <em>are</em> still resolved and added to the
404<code>package-lock.json</code> or <code>npm-shrinkwrap.json</code> file. They are just not
405physically installed on disk.</p>
406<p>If a package type appears in both the <code>--include</code> and <code>--omit</code> lists, then
407it will be included.</p>
408<p>If the resulting omit list includes <code>'dev'</code>, then the <code>NODE_ENV</code> environment
409variable will be set to <code>'production'</code> for all lifecycle scripts.</p>
410<h4 id="package-lock-only"><code>package-lock-only</code></h4>
411<ul>
412<li>Default: false</li>
413<li>Type: Boolean</li>
414</ul>
415<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
416ignoring <code>node_modules</code>.</p>
417<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
418instead of checking <code>node_modules</code> and downloading dependencies.</p>
419<p>For <code>list</code> this means the output will be based on the tree described by the
420<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
421<h4 id="sbom-format"><code>sbom-format</code></h4>
422<ul>
423<li>Default: null</li>
424<li>Type: "cyclonedx" or "spdx"</li>
425</ul>
426<p>SBOM format to use when generating SBOMs.</p>
427<h4 id="sbom-type"><code>sbom-type</code></h4>
428<ul>
429<li>Default: "library"</li>
430<li>Type: "library", "application", or "framework"</li>
431</ul>
432<p>The type of package described by the generated SBOM. For SPDX, this is the
433value for the <code>primaryPackagePurpose</code> field. For CycloneDX, this is the
434value for the <code>type</code> field.</p>
435<h4 id="workspace"><code>workspace</code></h4>
436<ul>
437<li>Default:</li>
438<li>Type: String (can be set multiple times)</li>
439</ul>
440<p>Enable running a command in the context of the configured workspaces of the
441current project while filtering by running only the workspaces defined by
442this configuration option.</p>
443<p>Valid values for the <code>workspace</code> config are either:</p>
444<ul>
445<li>Workspace names</li>
446<li>Path to a workspace directory</li>
447<li>Path to a parent workspace directory (will result in selecting all
448workspaces within that folder)</li>
449</ul>
450<p>When set for the <code>npm init</code> command, this may be set to the folder of a
451workspace which does not yet exist, to create the folder and set it up as a
452brand new workspace within the project.</p>
453<p>This value is not exported to the environment for child processes.</p>
454<h4 id="workspaces"><code>workspaces</code></h4>
455<ul>
456<li>Default: null</li>
457<li>Type: null or Boolean</li>
458</ul>
459<p>Set to true to run the command in the context of <strong>all</strong> configured
460workspaces.</p>
461<p>Explicitly setting this to false will cause commands like <code>install</code> to
462ignore workspaces altogether. When not set explicitly:</p>
463<ul>
464<li>Commands that operate on the <code>node_modules</code> tree (install, update, etc.)
465will link workspaces into the <code>node_modules</code> folder. - Commands that do
466other things (test, exec, publish, etc.) will operate on the root project,
467<em>unless</em> one or more workspaces are specified in the <code>workspace</code> config.</li>
468</ul>
469<p>This value is not exported to the environment for child processes.</p>
470<h2 id="see-also">See Also</h2>
471<ul>
472<li><a href="../using-npm/package-spec.html">package spec</a></li>
473<li><a href="../using-npm/dependency-selectors.html">dependency selectors</a></li>
474<li><a href="../configuring-npm/package-json.html">package.json</a></li>
475<li><a href="../using-npm/workspaces.html">workspaces</a></li>
476</ul></div>
477
478<footer id="edit">
479<a href="https://github.com/npm/cli/edit/latest/docs/lib/content/commands/npm-sbom.md">
480<svg role="img" viewBox="0 0 16 16" width="16" height="16" fill="currentcolor" style="vertical-align: text-bottom; margin-right: 0.3em;">
481<path fill-rule="evenodd" d="M11.013 1.427a1.75 1.75 0 012.474 0l1.086 1.086a1.75 1.75 0 010 2.474l-8.61 8.61c-.21.21-.47.364-.756.445l-3.251.93a.75.75 0 01-.927-.928l.929-3.25a1.75 1.75 0 01.445-.758l8.61-8.61zm1.414 1.06a.25.25 0 00-.354 0L10.811 3.75l1.439 1.44 1.263-1.263a.25.25 0 000-.354l-1.086-1.086zM11.189 6.25L9.75 4.81l-6.286 6.287a.25.25 0 00-.064.108l-.558 1.953 1.953-.558a.249.249 0 00.108-.064l6.286-6.286z"></path>
482</svg>
483Edit this page on GitHub
484</a>
485</footer>
486</section>
487
488
489
490</body></html>