build(deps-dev): Bump @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0

CHANGELOG.md

@@ -30,6 +30,9 @@
 
 ### Security
 
+- Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows
+  workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the
+  manifest and every lockfile copy against reintroducing a vulnerable release.
 - Require `@xmldom/xmldom` 0.8.15 or later in the 0.8 line for Electron
   packaging dependencies. This addresses the XML injection, malformed-input,
   and quadratic-time parsing advisories affecting the previous 0.8.13 copy.

docs/src/changelog.md

@@ -6,6 +6,8 @@ foundational work by theme.
 
 ## Unreleased
 
+- **SBOM tooling security:** Pin CycloneDX npm 6.0.0 to address
+  `GHSA-q69g-4hcv-6jg4`, with regression coverage for resolved versions.
 - **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+
   within the 0.8 line for Electron packaging tools, with a lockfile guard
   against reintroducing vulnerable copies.

package.json

@@ -40,7 +40,7 @@
     "locales:review": "node scripts/review-locales.mjs"
   },
   "devDependencies": {
-    "@cyclonedx/cyclonedx-npm": "5.0.0",
+    "@cyclonedx/cyclonedx-npm": "6.0.0",
     "@playwright/test": "^1.59.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",

scripts/release-metadata.test.mjs

@@ -91,6 +91,27 @@ describe('public release metadata', () => {
     expect(nonPublic).toEqual([]);
   });
 
+  it('pins a patched CycloneDX SBOM generator without vulnerable resolved copies', async () => {
+    const [packageJson, lockfile] = await Promise.all([
+      read('package.json').then(JSON.parse),
+      read('package-lock.json').then(JSON.parse),
+    ]);
+    const dependency = '@cyclonedx/cyclonedx-npm';
+    const pinned = packageJson.devDependencies[dependency];
+    const version = /^(\d+)\.\d+\.\d+$/.exec(pinned);
+    const copies = Object.entries(lockfile.packages)
+      .filter(([packagePath]) => packagePath.endsWith(`node_modules/${dependency}`));
+
+    expect(version, pinned).not.toBeNull();
+    expect(Number(version?.[1])).toBeGreaterThanOrEqual(6);
+    expect(lockfile.packages[''].devDependencies[dependency]).toBe(pinned);
+    expect(copies.length).toBeGreaterThan(0);
+    for (const [packagePath, metadata] of copies) {
+      expect(metadata.version, packagePath).toBe(pinned);
+      expect(metadata.dev, packagePath).toBe(true);
+    }
+  });
+
   it('pins patched brace-expansion versions in every supported major', async () => {
     const [packageJson, lockfile] = await Promise.all([
       read('package.json').then(JSON.parse),