Update `ajv-formats-draft2019@1.6.1`

[grease-work-23]

When running cyclondedx v 2.1.0 on node 22 I get:

[INFO] Running 'npx @cyclonedx/cyclonedx-npm --mc-type library --output-file target/frontend.sbom.json' in /home/led/ws/inca1/vertigo/frontend
[INFO] (node:75084) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
[INFO] (Use `node --trace-deprecation ...` to show where the warning was created)

The issue stems from this library using an outdated third-party dep, this is the dep tree;

├─┬ @cyclonedx/cyclonedx-npm@2.1.0
│ ├─┬ @cyclonedx/cyclonedx-library@7.1.0
│ │ ├─┬ ajv-formats-draft2019@1.6.1 <------ DEPRECATED
│ │ │ ├── ajv@6.12.6 deduped
│ │ │ ├── punycode@2.3.0
│ │ │ ├─┬ schemes@1.4.0
│ │ │ │ └── extend@3.0.2
│ │ │ ├─┬ smtp-address-parser@1.1.0
│ │ │ │ └─┬ nearley@2.20.1
│ │ │ │   ├── commander@2.20.3
│ │ │ │   ├── moo@0.5.2
│ │ │ │   ├── railroad-diagrams@1.0.0
│ │ │ │   └─┬ randexp@0.4.6
│ │ │ │     ├── discontinuous-range@1.0.0
│ │ │ │     └── ret@0.1.15
│ │ │ └─┬ uri-js@4.4.1
│ │ │   └── punycode@2.3.0 deduped
│ │ ├─┬ ajv-formats@3.0.1
│ │ │ └── ajv@8.17.1 deduped
│ │ ├─┬ ajv@8.17.1
│ │ │ ├── fast-deep-equal@3.1.3 deduped
│ │ │ ├── fast-uri@3.0.1
│ │ │ ├── json-schema-traverse@1.0.0
│ │ │ └── require-from-string@2.0.2
│ │ ├─┬ libxmljs2@0.35.0
│ │ │ ├─┬ bindings@1.5.0

https://www.npmjs.com/package/ajv-formats-draft2019 is 4 years old and can be updated.

See also CycloneDX/cyclonedx-webpack-plugin#1348 that was closed

[jkowalleck]

is there any replacement for ajv-formats-draft2019@1.6.1?

[jkowalleck]

Feel free to pullrequest a solution.

[grease-work-23]

I assumed that ajv-formats is a drop-in replacement for ajv-formats-draft2019 but that might not be the case.

there are other people writing here:
luzlab/ajv-formats-draft2019#29 and the project seems abandoned.

Do you want me or the developers of this project to propose a solution in how to migrate from the abandoned third-party dep ajv-formats-draft2019 ?

[jkowalleck]

today, there is simply no migration path. we are "stuck" with ajv-formats-draft2019@1.6.1.

currently, ajv is our validator of choice, ajv-formats adds most string format validation, and ajv-formats-draft2019 adds validation for "iri-reference"/"idn-email" format.

I would be happy to review any pull request modernizing our dependencies.

[jkowalleck]

BTW: the JSON-validation is pluggable andextensible. https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/src/_optPlug.node/jsonValidator.ts

implementation with ajv is here: https://github.com/CycloneDX/cyclonedx-javascript-library/tree/main/src/_optPlug.node/__jsonValidators

[jkowalleck]

after reading our code, I noticed

• "iri-reference" format is not validated, since there is simply no working implementation out there.
• "idn-email" is used.

offer still stands: feel free to rework/replace the things.
Don't be shy, any change is welcome - even breaking changes - dont worry, release manager will take care of it ;-)

PS: even crafting our own validator with the help of some libs would be acceptable/feasible - see luzlab/ajv-formats-draft2019#22 (comment)

[grease-work-23]

I made a PR here; #1226. FYI used cursor IDE and ran the tests and it claims that
addFormats2019(ajv, { formats: ['idn-email'] }) can be replaced with ajv.addFormat('idn-email', true) which I noticed wont work,

https://ajv.js.org/guide/formats.html says:

Additional formats in ajv-formats-draft2019
JSON Schema draft-07 also defines formats iri, iri-reference, idn-hostname and idn-email for URLs, hostnames and emails with international characters. These formats are available in ajv-formats-draft2019

(opens new window) plugin.
#

Mabye a good next step is to copy the email format validation from the ajv-formats-draft2019) library?

[jkowalleck]

Mabye a good next step is to copy the email format validation from the ajv-formats-draft2019) library?

then, go ahead, if you must. remember: copy foreign code falls under licensing and other rights. check carefully what you do there.

[grease-work-23]

Ok, will look into in when I have some time over, I noted that ajv-formats-draft2019 is licensed under MIT which is ok.

[jkowalleck]

Ok, will look into in when I have some time over, I noted that ajv-formats-draft2019 is licensed under MIT which is ok.

MIT, eh? then dont forget to include the original license, as the MIT license requires to do

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.