Zoltan KochanandClaude Opus 5.5
6f95957063
* docs: lint prose with Vale Add Vale with an in-repo style, .vale/styles/pnpm, that turns the writing rules in AGENTS.md and the Google developer documentation style guide into lint rules. The stock Vale packages (Google, Microsoft, RedHat, write-good) were too noisy to block on, for example 1,300 passive-voice hits in the v12 docs alone, so the rules are written for this repo, following the GitLab model. Each one links the guideline it enforces. Levels: - error, fails CI: dashes, plain-word substitutions, condescending words, "please", "note that", hedges, puffery, optional plurals, exclamation marks, ellipses, curly quotes, generic link text, product spellings, sentence-case headings, repeated words, double spaces, implementation history in comments; in changesets, bold or italic emphasis, internal names and release-line names. - warning: future tense, sentences over 30 words, "instead of" and "so that" tails in changesets. - suggestion: passive voice. .vale.ini scopes the rules. Docs get every rule. Contributor Markdown and code comments keep dashes and headings as warnings until their roughly 8,100 em dashes are rewritten. Released changesets stay in .changeset/ and are not rewritten, so lint-prose.mjs lints only the changesets added since PROSE_BASE (the PR base in CI). The prose workflow installs a pinned, checksum-verified Vale release and runs `pnpm lint:prose`. The rest of this change rewrites the existing docs, READMEs, contributor Markdown, and code comments to pass the error-level rules. Only prose and comment text changed. Renamed headings keep their anchors. Spelling stays with cspell, which checks identifiers that Vale does not see. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep prose lint from flattening meaning --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
3.5 KiB
id, title
| id | title |
|---|---|
| sbom | pnpm sbom |
Added in: v11.0.0
Generate a Software Bill of Materials (SBOM) for the project.
Supported formats:
- CycloneDX 1.7 (JSON)
- SPDX 2.3 (JSON)
Usage
pnpm sbom --sbom-format cyclonedx
pnpm sbom --sbom-format spdx
pnpm sbom --sbom-format cyclonedx --lockfile-only
pnpm sbom --sbom-format spdx --prod
pnpm sbom --sbom-format cyclonedx --out sbom.cdx.json
pnpm sbom --sbom-format cyclonedx --split
pnpm sbom --sbom-format cyclonedx --exclude-peers
Inside a workspace, pnpm sbom supports filtering. When a single workspace package is selected, the root component in the SBOM uses that package's metadata.
Workspaces with sharedWorkspaceLockfile: false are supported. pnpm reads the lockfiles of selected and reachable projects when generating a workspace SBOM.
Since v11.20.0, a component resolved from a named registry carries the purl repository_url qualifier (for example pkg:npm/foo@1.0.0?repository_url=https%3A%2F%2Fnpm.work.example.com%2F), so the same name and version served by two registries does not collapse onto one component. Credentials that a namedRegistries URL may embed (userinfo or a query string) are stripped from the qualifier, while the origin and path are kept, since two registries can differ only by path.
CycloneDX output marks components reachable only through devDependencies with scope: "excluded" and the cdx:npm:package:development property. Runtime components, including installed optional dependencies, use the default required scope.
Options
--sbom-format <cyclonedx|spdx>
The SBOM output format. This option is required. Supported values: cyclonedx, spdx.
--sbom-type <library|application>
- Default: library
The component type for the root package.
--sbom-spec-version <version>
Added in: v11.1.0
- Default: 1.7
- Type: 1.5, 1.6, 1.7
The CycloneDX specification version to emit. Only valid with --sbom-format cyclonedx.
--lockfile-only
Only use lockfile data (skip reading from the store).
--sbom-authors <names>
Comma-separated list of SBOM authors. Written to metadata.authors in the CycloneDX output.
--sbom-supplier <name>
SBOM supplier name. Written to metadata.supplier in the CycloneDX output.
--out <path>
Added in: v11.8.0
Write the SBOM to a file instead of stdout.
Use %s in the path as a placeholder for the package name and %v as a placeholder for the package version. In a workspace, a path containing %s writes one SBOM per selected package:
pnpm sbom --sbom-format cyclonedx --out out/%s.cdx.json
pnpm sbom --sbom-format cyclonedx --out out/%s-%v.cdx.json
--split
Added in: v11.8.0
Generate a separate SBOM for each selected workspace package. Without --out, the SBOMs are printed to stdout as NDJSON, one JSON document per line.
When --split is combined with --out, the output path must contain %s.
--exclude-peers
Added in: v11.9.0
Exclude peer dependencies from the SBOM. Dependencies reachable only through those peers are also excluded.
This is useful with auto-install-peers because peer dependencies are resolved into the lockfile and otherwise look the same as regular dependencies.
--prod, -P
Only include dependencies and optionalDependencies.
--dev, -D
Only include devDependencies.
--no-optional
Don't include optionalDependencies.