chore(deps): update dependency @cyclonedx/cyclonedx-npm to v4.2.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@cyclonedx/cyclonedx-npm	devDependencies	minor	4.0.3 → 4.2.1

---

Release Notes

CycloneDX/cyclonedx-node-npm (@​cyclonedx/cyclonedx-npm)

v4.2.1

Compare Source

• Fixed
  • Properly generate PackageURLs for private packages (#​1425 via #​1426)

v4.2.0

Compare Source

• Fixed
  • Qualified PackageURLs (via #​1416)
• Changed
  • Take care of PackageURL generation ourselves, now (via #​1416)
    Previously, this was done at best-effort by a 3rd-party library.
• Dependencies
  • Bumped dependency @cyclonedx/cyclonedx-library@^10.0.0 now, was @^8.4.0||^9.0.0 (via #​1416)
  • Added dependency packageurl-js@^2.0.1 (via #​1416)
  • Added dependency spdx-expression-parse@^3.0.1||^4.0.0 (via #​1416)

v4.1.2

Compare Source

• Runtime Dependencies
  • Support runtime-dependency xmlbuilder2@​^3.0.2||^4.0.3, was @^3.0.2 (#​1392 via #​1390)
• Style
  • Applied latest code standards (via #​1388)

v4.1.1

Compare Source

• Fixed
  • Create output dir properly if needed (via #​1377)

v4.1.0

Compare Source

• Added
  • Reproducible SBOM results have Metadata's property cdx:reproducible populated (#​1054 via #​1373)
    See the official property taxonomy cdx for details.
• Build
  • Use TypeScript v5.9.3 now, was v5.9.2 (via #​1356)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}