From e1c8ebea6846657a6122705772b03d14021abe4c Mon Sep 17 00:00:00 2001 From: Jordan Hury Date: Sun, 8 Nov 2026 10:42:30 +0200 Subject: [PATCH 1/3] XRAY-167150 - Xspecter version 1.9.0 Co-Authored-By: Claude Opus 5.5 --- sca/bom/xrayplugin/plugin/plugin.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sca/bom/xrayplugin/plugin/plugin.go b/sca/bom/xrayplugin/plugin/plugin.go index 6404e2bac..19b3b9536 100644 --- a/sca/bom/xrayplugin/plugin/plugin.go +++ b/sca/bom/xrayplugin/plugin/plugin.go @@ -24,7 +24,7 @@ import ( const ( xrayLibPluginVersionEnvVariable = "JFROG_CLI_XRAY_LIB_PLUGIN_VERSION" - defaultXrayLibPluginVersion = "1.6.0" + defaultXrayLibPluginVersion = "1.9.0" SnippetDetectionEnvVariable = "JFROG_XRAY_SNIPPET_SCAN_ENABLE" From 2e73813bb791a1c177e7384132787b5f76d460c3 Mon Sep 17 00:00:00 2001 From: Jordan Hury Date: Sun, 8 Nov 2026 11:07:42 +0200 Subject: [PATCH 2/3] XRAY-167150 - Opt in to build execution in the Xray-Lib plugin Xspecter 1.8.0 runs Gradle only when allowBuildExecution is set (XRAY-161571). jf audit and Frogbot scan the user's own project, so keep resolving lockfile-less Gradle projects as before. Co-Authored-By: Claude Opus 5.5 --- sca/bom/xrayplugin/plugin/config.go | 2 ++ sca/bom/xrayplugin/xraylibbom.go | 13 +++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/sca/bom/xrayplugin/plugin/config.go b/sca/bom/xrayplugin/plugin/config.go index e1fc6f77d..9e40d5f87 100644 --- a/sca/bom/xrayplugin/plugin/config.go +++ b/sca/bom/xrayplugin/plugin/config.go @@ -22,4 +22,6 @@ type Config struct { Ecosystems []techutils.Technology `json:"ecosystems,omitempty" yaml:"ecosystems,omitempty"` // [Optional] Specific directories to scan. IncludeDirs []string `json:"includeDirs,omitempty"` + // [Optional] Allow running build tools (e.g. the target's gradlew) to resolve dependencies. + AllowBuildExecution bool `json:"allowBuildExecution,omitempty" yaml:"allowBuildExecution,omitempty"` } diff --git a/sca/bom/xrayplugin/xraylibbom.go b/sca/bom/xrayplugin/xraylibbom.go index e90714db9..3d0e1638e 100644 --- a/sca/bom/xrayplugin/xraylibbom.go +++ b/sca/bom/xrayplugin/xraylibbom.go @@ -131,12 +131,13 @@ func (sbg *XrayLibBomGenerator) getXrayLibExecutablePath() (xrayLibPath string, func (sbg *XrayLibBomGenerator) executeScanner(scanner plugin.Scanner, target results.ScanTarget) (output *cyclonedx.BOM, err error) { scanConfig := plugin.Config{ - BomRef: cdxutils.GetFileRef(target.Target), - Type: string(cyclonedx.ComponentTypeFile), - Name: target.Target, - IgnorePatterns: ignorePatternsForTarget(target), - IncludeDirs: target.Include, - Ecosystems: sbg.specificTechs, + BomRef: cdxutils.GetFileRef(target.Target), + Type: string(cyclonedx.ComponentTypeFile), + Name: target.Target, + IgnorePatterns: ignorePatternsForTarget(target), + IncludeDirs: target.Include, + Ecosystems: sbg.specificTechs, + AllowBuildExecution: true, } if scanConfigStr, err := utils.GetAsJsonString(scanConfig, false, true); err == nil { log.Debug(fmt.Sprintf("Scan configuration: %s", scanConfigStr)) From 76fca1457a03840d67a0a9a328a9ce2ba654fb77 Mon Sep 17 00:00:00 2001 From: Jordan Hury Date: Sun, 8 Nov 2026 14:07:43 +0200 Subject: [PATCH 3/3] XRAY-167150 - Align pnpm and uv new SCA test expectations with Xspecter 1.9.0 Xspecter 1.9.0 drops the phantom pnpm root built from package.json's main field, and resolves uv.lock into its real tree (3 direct, 4 transitive) instead of listing every package as direct. Co-Authored-By: Claude Opus 5.5 --- audit_test.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/audit_test.go b/audit_test.go index d335f6041..3ed72eea7 100644 --- a/audit_test.go +++ b/audit_test.go @@ -1086,8 +1086,8 @@ func TestAuditNewScaCycloneDxPnpm(t *testing.T) { ) assert.NoError(t, err) validations.VerifyCycloneDxResults(t, output, validations.ValidationParams{ - Total: &validations.TotalCount{Vulnerabilities: 1, BomComponents: 2 /* root */ + 2 /* direct */, Licenses: 1}, - SbomComponents: &validations.SbomCount{Root: 2, Direct: 2}, + Total: &validations.TotalCount{Vulnerabilities: 1, BomComponents: 1 /* root */ + 2 /* direct */, Licenses: 1}, + SbomComponents: &validations.SbomCount{Root: 1, Direct: 2}, Vulnerabilities: &validations.VulnerabilityCount{ ValidateScan: &validations.ScanCount{Sca: 1}, ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{NotApplicable: 1}, @@ -1238,8 +1238,8 @@ func TestAuditNewScaCycloneDxUV(t *testing.T) { ) assert.NoError(t, err) validations.VerifyCycloneDxResults(t, output, validations.ValidationParams{ - Total: &validations.TotalCount{Vulnerabilities: 20, BomComponents: 1 /* root */ + 8 /* direct */ + 1 /* file (secret)*/, Licenses: 5}, - SbomComponents: &validations.SbomCount{Root: 1, Direct: 8}, + Total: &validations.TotalCount{Vulnerabilities: 20, BomComponents: 1 /* root */ + 3 /* direct */ + 4 /* transitive */ + 1 /* file (secret)*/, Licenses: 5}, + SbomComponents: &validations.SbomCount{Root: 1, Direct: 3, Transitive: 4}, Vulnerabilities: &validations.VulnerabilityCount{ ValidateScan: &validations.ScanCount{Sca: 18, Sast: 1, Secrets: 1}, ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{NotCovered: 9, NotApplicable: 9},