deps/compliance/commands/src/sbom/sbom.ts (1)

220-227: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate --sbom-spec-version before passing it through.

Line 226 forwards raw user input without checks. This allows invalid CycloneDX versions and silently ignores the flag for SPDX, which can produce confusing/non-compliant output. Fail fast with explicit validation and format gating.

💡 Suggested patch

@@
   const sbomType = validateSbomType(opts.sbomType)
+  const sbomSpecVersion = validateSbomSpecVersion(opts.sbomSpecVersion, format)
@@
   const output = format === 'cyclonedx'
     ? serializeCycloneDx(result, {
       pnpmVersion: packageManager.version,
       lockfileOnly: opts.lockfileOnly,
       sbomAuthors: opts.sbomAuthors?.split(',').map((s) => s.trim()).filter(Boolean),
       sbomSupplier: opts.sbomSupplier,
-      specVersion: opts.sbomSpecVersion,
+      specVersion: sbomSpecVersion,
     })
     : serializeSpdx(result)
@@
 function validateSbomType (value: string | undefined): SbomComponentType {
   if (!value || value === 'library') return 'library'
   if (value === 'application') return 'application'
   throw new PnpmError(
@@
   )
 }
+
+function validateSbomSpecVersion (value: string | undefined, format: SbomFormat): string | undefined {
+  if (value == null) return undefined
+
+  if (format !== 'cyclonedx') {
+    throw new PnpmError(
+      'SBOM_SPEC_VERSION_UNSUPPORTED_FORMAT',
+      'The --sbom-spec-version option is supported only with --sbom-format cyclonedx.'
+    )
+  }
+
+  const normalized = value.trim()
+  const match = /^(\d+)\.(\d+)$/.exec(normalized)
+  if (!match) {
+    throw new PnpmError(
+      'SBOM_INVALID_SPEC_VERSION',
+      `Invalid CycloneDX spec version "${value}". Use a version >= 1.5 (for example: 1.5, 1.6, 1.7).`
+    )
+  }
+
+  const major = Number(match[1])
+  const minor = Number(match[2])
+  if (major < 1 || (major === 1 && minor < 5)) {
+    throw new PnpmError(
+      'SBOM_INVALID_SPEC_VERSION',
+      `Invalid CycloneDX spec version "${value}". Use a version >= 1.5.`
+    )
+  }
+
+  return `${major}.${minor}`
+}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deps/compliance/commands/src/sbom/sbom.ts` around lines 220 - 227, Before
calling serializeCycloneDx, validate opts.sbomSpecVersion when format ===
'cyclonedx': check that opts.sbomSpecVersion is one of the supported CycloneDX
spec versions (use a small whitelist constant) and if not, throw or exit with a
clear error message; do not forward raw input to serializeCycloneDx. Also ensure
that when format !== 'cyclonedx' the presence of --sbom-spec-version is ignored
or produces a helpful error/warning (fail fast) instead of being silently
dropped. Locate this logic around the serializeCycloneDx call and the format
variable, and perform validation prior to invoking serializeCycloneDx.