# SBOM — Ignite UI for Angular (npm, 22.0.x)

**File:** `infragistics-angular-22.0.6.cdx.json`
**Format:** CycloneDX 1.6 (JSON)
**Subject:** The delivered Ignite UI for Angular npm package set (17 packages) with its fully resolved dependency closure.

## What it describes

Built by performing a **full `npm install`** of the 17 delivered packages from the public
registry and cataloging the resulting pinned `package-lock.json` — i.e. exactly what a
consuming application resolves.

- **295 components total**
  - **17 delivered** Infragistics packages (`sbom:classification = delivered`)
  - **16 peer/platform** packages — auto-installed `peerDependencies` (`@angular/*`, `rxjs`, `ajv`, `express`, `hono`, `zod`, `openfin-*`, `igniteui-i18n-resources`) marked `sbom:classification = peer`
  - **262 transitive** runtime dependencies (`sbom:classification = transitive`)
- A complete `dependencies` graph resolved from the lockfile (nearest-`node_modules` resolution).

Every component carries a `pkg:npm/...` PURL, a resolved license, an `sbom:classification`
property, and (where npm provided one) an integrity hash.

## Delivered packages & versions

Versions are mixed (npm "latest" per package as of 2026-08-11):

- `igniteui-angular`, `igniteui-angular-extras`, `igniteui-angular-i18n` — **22.0.6**
- `igniteui-angular-core` + wrappers (`charts`, `dashboards`, `data-grids`, `datasources`,
  `excel`, `fdc3`, `gauges`, `inputs`, `layouts`, `maps`, `spreadsheet`,
  `spreadsheet-chart-adapter`) — **22.0.1**
- `igniteui-dockmanager` — **2.1.3**

## Licenses

- **13** components under the **Infragistics Ultimate** license (`igniteui-angular-core` + the 12 wrappers).
- **`igniteui-angular`, `igniteui-angular-extras`, `igniteui-dockmanager`** declare `"SEE LICENSE IN LICENSE"`
  in their manifest — the actual `LICENSE` file text is **embedded** in each component (`licenses[].license.text`).
- **`igniteui-angular-i18n` is MIT** (not the Ultimate license) — worth noting.
- Across the full closure: 225 MIT, 17 ISC, 13 Ultimate, 11 BSD-3-Clause, 10 Apache-2.0, plus a few dual-license expressions.
- **1 `NOASSERTION`**: `buffers@0.1.1`, a very old transitive package that declares no license in its
  manifest, `LICENSE` file, or registry metadata. This is the correct SPDX value for "undeterminable."

Licenses were read from each installed `package.json`; for platform-specific optional native
packages not installed on this OS (`@parcel/watcher-*`, `sass-embedded-*`), the license was
backfilled from the npm registry (all MIT).

## Scope decision (peerDependencies)

Per the "full resolved install" choice, auto-installed `peerDependencies` (the Angular framework,
`rxjs`, etc.) **are included** so a consumer's vulnerability scanner sees them — but they are
flagged `sbom:classification = peer` so they are distinguishable from what Infragistics ships.
`devDependencies` are excluded (they are not installed for a consumer).

Platform-specific optional native binaries for **all** operating systems are represented (from the
lockfile), so the BOM is valid regardless of the consumer's OS — not just the machine it was built on.

## How it was generated

1. `npm install` the 17 packages (public registry) → pinned `package-lock.json` + `node_modules`.
2. Authored the CycloneDX 1.6 document directly from the lockfile (complete graph + exact versions),
   with licenses from each `package.json` (registry fallback for not-on-disk optional packages).
3. Validated (below). Syft was run independently as a cross-check on the component inventory.

> Note: Syft's raw `dir:` scan was **not** used as the source because it emitted 0 licenses,
> a partial dependency graph, and 15 non-runtime artifacts (GitHub Actions references scraped from
> `.github/workflows` files bundled inside some packages, plus a native binary). Authoring from the
> lockfile avoids that noise while keeping Syft as an inventory cross-check.

## Validation performed

- **Schema:** validates clean against the official CycloneDX `bom-1.6.schema.json` (+ spdx, jsf).
- **Checks (all pass):** every component has a `pkg:npm/` PURL; the delivered set equals the expected 17;
  every component has ≥1 license and an `sbom:classification`; every dependency reference resolves;
  no `pkg:github` / CI-noise components; `metadata.component` is the product (no local-path leak).
- SPDX identifiers were validated against the SPDX enum so no invalid license IDs are emitted.

## Notes / limitations

- The product is a **multi-version set**; `metadata.component.version` uses the flagship
  `igniteui-angular` version (`22.0.6`) with the full per-package version note in `metadata.properties`.
- Regenerate per release — the build kit in `C:\SBOM\Scripts\angular` makes this a one-command run.