Repository navigation
caxa 4.0.1 makes the metadata file it writes for each binary (binary-metadata.json by default, or the name given to --metadata-file) describe that binary accurately, so an SBOM built from it, such as cdxgen's -t caxa, matches what the binary extracts. The binary itself and its payload format are unchanged.
The dependency graph now names the versions Node would load. Dependencies are resolved the way Node's module lookup does it, walking up from each package's own directory and following pnpm-style symlinks, so a package installed at several versions points at the right one. Optional and peer dependencies that are installed are linked too, and the binary's top-level component depends on every package nothing else requires, so no component is left unreachable.
The bundled Node runtime now lists only what ships. Before, it listed every shared library the build machine loaded, which on macOS meant several hundred entries from /usr/lib and /System. It now lists the libraries compiled into Node and the ones caxa copies into the app, all with scope required. The modules and napi entries are gone, since they are ABI numbers and not libraries.
Lazy members are recorded. With --lazy or --lazy-auto, the package that contains each lazy file carries a cdx:caxa:lazyMember property, so an SBOM consumer can tell that the file inside the archive is a placeholder until first use. Windows builds record none, because Windows extracts lazy members up front.
This release is #19.
Full Changelog: v4.0.0...v4.0.1