Skip to content

feat: basic support for CycloneDX 1.7 #1324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Oct 22, 2025
Merged

feat: basic support for CycloneDX 1.7 #1324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
341a2b7
tests: pulled latest test resources
jkowalleck Oct 22, 2025
a032bf6
feat: schma CDX1.7
jkowalleck Oct 22, 2025
1562af5
feat: implement 1.7
jkowalleck Oct 22, 2025
ed84738
docs
jkowalleck Oct 22, 2025
cba2dee
feat
jkowalleck Oct 22, 2025
809d24d
feat
jkowalleck Oct 22, 2025
a251606
feat
jkowalleck Oct 22, 2025
c1605fe
feat
jkowalleck Oct 22, 2025
4d14fa1
docs
jkowalleck Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions HISTORY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,12 @@ All notable changes to this project will be documented in this file.

<!-- add unreleased items here -->

* Added
* Support CycloneDX 1.7 ([#1325] via [#1324])

[#1324]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1324
[#1325]: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1325

## 9.1.0 -- 2025-10-20

* Dependencies
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ written in _TypeScript_ and compiled for the target.
* Builders for the following use cases:
* Specific to _Node.js_: create deep data models `Tool` or `Component` from PackageJson-like data structures
* Implementation of the [_CycloneDX_ Specification][CycloneDX-spec] for the following versions:
* `1.7`
* `1.6`
* `1.5`
* `1.4`
Expand Down
4 changes: 3 additions & 1 deletion res/schema/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ some schema for offline use as download via [script](../../tools/schema-download
original sources: <https://github.com/CycloneDX/specification/blob/master>

Currently using version
[8a27bfd1be5be0dcb2c208a34d2f4fa0b6d75bd7](https://github.com/CycloneDX/specification/commit/8a27bfd1be5be0dcb2c208a34d2f4fa0b6d75bd7)
[4b3f59453366e27c8073fd24e98bf21ef8892c8e](https://github.com/CycloneDX/specification/commit/4b3f59453366e27c8073fd24e98bf21ef8892c8e)

| file | note |
|------|------|
Expand All @@ -15,11 +15,13 @@ Currently using version
| [`bom-1.4.SNAPSHOT.xsd`](bom-1.4.SNAPSHOT.xsd) | applied changes: 1 |
| [`bom-1.5.SNAPSHOT.xsd`](bom-1.5.SNAPSHOT.xsd) | applied changes: 1 |
| [`bom-1.6.SNAPSHOT.xsd`](bom-1.6.SNAPSHOT.xsd) | applied changes: 1 |
| [`bom-1.7.SNAPSHOT.xsd`](bom-1.7.SNAPSHOT.xsd) | applied changes: 1 |
| [`bom-1.2.SNAPSHOT.schema.json`](bom-1.2.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.3.SNAPSHOT.schema.json`](bom-1.3.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.4.SNAPSHOT.schema.json`](bom-1.4.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.5.SNAPSHOT.schema.json`](bom-1.5.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.6.SNAPSHOT.schema.json`](bom-1.6.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.7.SNAPSHOT.schema.json`](bom-1.7.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.2-strict.SNAPSHOT.schema.json`](bom-1.2-strict.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`bom-1.3-strict.SNAPSHOT.schema.json`](bom-1.3-strict.SNAPSHOT.schema.json) | applied changes: 2,3,4,5,6 |
| [`spdx.SNAPSHOT.xsd`](spdx.SNAPSHOT.xsd) | |
Expand Down
4 changes: 2 additions & 2 deletions res/schema/bom-1.4.SNAPSHOT.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1636,7 +1636,7 @@
"$ref": "#/definitions/version"
},
"range": {
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"$ref": "#/definitions/range"
},
"status": {
Expand Down Expand Up @@ -1679,7 +1679,7 @@
"maxLength": 1024
},
"range": {
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"type": "string",
"minLength": 1,
"maxLength": 1024
Expand Down
2 changes: 1 addition & 1 deletion res/schema/bom-1.4.SNAPSHOT.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1993,7 +1993,7 @@ limitations under the License.
</xs:element>
<xs:element name="range" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
<xs:annotation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst</xs:documentation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec</xs:documentation>
</xs:annotation>
</xs:element>
</xs:choice>
Expand Down
4 changes: 2 additions & 2 deletions res/schema/bom-1.5.SNAPSHOT.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2281,7 +2281,7 @@
"$ref": "#/definitions/version"
},
"range": {
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"$ref": "#/definitions/range"
},
"status": {
Expand Down Expand Up @@ -2323,7 +2323,7 @@
"maxLength": 1024
},
"range": {
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"type": "string",
"minLength": 1,
"maxLength": 1024
Expand Down
6 changes: 3 additions & 3 deletions res/schema/bom-1.5.SNAPSHOT.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2433,12 +2433,12 @@ limitations under the License.
</xs:enumeration>
<xs:enumeration value="incomplete_first_party_proprietary_only">
<xs:annotation>
<xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation>
<xs:documentation>The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="incomplete_first_party_opensource_only">
<xs:annotation>
<xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation>
<xs:documentation>The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="incomplete_third_party_only">
Expand Down Expand Up @@ -3644,7 +3644,7 @@ limitations under the License.
</xs:element>
<xs:element name="range" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
<xs:annotation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst</xs:documentation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec</xs:documentation>
</xs:annotation>
</xs:element>
</xs:choice>
Expand Down
8 changes: 4 additions & 4 deletions res/schema/bom-1.6.SNAPSHOT.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"type": "string",
"title": "CycloneDX Specification Version",
"description": "The version of the CycloneDX specification the BOM conforms to.",
"examples": ["1.6.1"]
"examples": ["1.6"]
},
"serialNumber": {
"type": "string",
Expand Down Expand Up @@ -2237,7 +2237,7 @@
"aggregate": {
"$ref": "#/definitions/aggregateType",
"title": "Aggregate",
"description": "Specifies an aggregate type that describe how complete a relationship is."
"description": "Specifies an aggregate type that describes how complete a relationship is."
},
"assemblies": {
"type": "array",
Expand Down Expand Up @@ -2928,7 +2928,7 @@
},
"range": {
"title": "Version Range",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"$ref": "#/definitions/versionRange"
},
"status": {
Expand Down Expand Up @@ -2983,7 +2983,7 @@
]
},
"versionRange": {
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec",
"type": "string",
"minLength": 1,
"maxLength": 4096,
Expand Down
12 changes: 6 additions & 6 deletions res/schema/bom-1.6.SNAPSHOT.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ limitations under the License.
<xs:simpleType name="versionRangeType">
<xs:annotation>
<xs:documentation xml:lang="en"><![CDATA[
A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst
A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec

Example values:
- "vers:cargo/9.0.14"
Expand Down Expand Up @@ -2672,7 +2672,7 @@ limitations under the License.
<xs:element name="copyright" type="bom:copyrightsType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>
opyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.
Copyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.
</xs:documentation>
</xs:annotation>
</xs:element>
Expand Down Expand Up @@ -2715,7 +2715,7 @@ limitations under the License.
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="aggregate" type="bom:aggregateType" default="not_specified">
<xs:annotation>
<xs:documentation>Specifies an aggregate type that describe how complete a relationship is.</xs:documentation>
<xs:documentation>Specifies an aggregate type that describes how complete a relationship is.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="assemblies" minOccurs="0" maxOccurs="1">
Expand Down Expand Up @@ -2810,12 +2810,12 @@ limitations under the License.
</xs:enumeration>
<xs:enumeration value="incomplete_first_party_proprietary_only">
<xs:annotation>
<xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation>
<xs:documentation>The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="incomplete_first_party_opensource_only">
<xs:annotation>
<xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation>
<xs:documentation>The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="incomplete_third_party_only">
Expand Down Expand Up @@ -4475,7 +4475,7 @@ limitations under the License.
</xs:element>
<xs:element name="range" type="bom:versionRangeType" minOccurs="1" maxOccurs="1">
<xs:annotation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst</xs:documentation>
<xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec</xs:documentation>
</xs:annotation>
</xs:element>
</xs:choice>
Expand Down
Loading