---

CycloneDX Webpack Plugin

This plugin for webpack creates a CycloneDX Software Bill of Materials (SBoM) containing an aggregate of all bundled dependencies.
This plugin uses the linkages generated by webpack to create a dependency graph which only contain the dependencies that are actually used (after tree-shaking).

Requirements

• Node.js >= 14
• webpack ^5

However, there are older versions of this plugin, that support

• Node.js v8.0.0 or higher
• webpack v4.0.0 or higher

Installing

npm i -D @cyclonedx/webpack-plugin
yarn add -D @cyclonedx/webpack-plugin

Usage

Configuration

For configuration and options, please consult the shipped CycloneDxWebpackPluginOptions interface definition, or see one of the examples.

Example

In your webpack config add the CycloneDX plugin:

const { CycloneDxWebpackPlugin } = require('@cyclonedx/webpack-plugin');

/** @type {import('@cyclonedx/webpack-plugin').CycloneDxWebpackPluginOptions} */
const cycloneDxWebpackPluginOptions = {
  specVersion: '1.4',
  outputLocation: './bom'
}

module.exports = {
  // ...
  plugins: [
    new CycloneDxWebpackPlugin(cycloneDxWebpackPluginOptions)
  ]
}

See extended examples.

Support for IETF /.well-known/sbom

The CycloneDX Webpack plugin supports placing the CycloneDX SBOM in a pre-defined location, specifically in /.well-known/sbom. This option is enabled by default. The behavior can be changed by overriding the values of includeWellknown and wellknownLocation.
See draft-lear-opsawg-sbom-access for more information on the specification, currently an IETF draft.

In your webpack config add the CycloneDX plugin:

const { CycloneDxWebpackPlugin } = require('@cyclonedx/webpack-plugin');

/** @type {import('@cyclonedx/webpack-plugin').CycloneDxWebpackPluginOptions} */
const cycloneDxWebpackPluginOptions = {
  includeWellknown: true,
  wellknownLocation: './.well-known'
}

module.exports = {
  // ...
  plugins: [
    new CycloneDxWebpackPlugin(cycloneDxWebpackPluginOptions)
  ]
}

Use with Angular

Angular uses Webpack under the hood. Therefore, it is possible to integrate this plugin by utilizing @angular-builders/custom-webpack.

Use with React

React uses Webpack under the hood. Therefore, it is possible to integrate this plugin.

Development & Contributing

Feel free to open issues, bugreports or pull requests.
See the CONTRIBUTING file for details.

License

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.