pip install of stix [1.2.0.0], brings cybox [2.1.0.13] these versions are incompatible

[michaelpepin]

pip install of stix [1.2.0.0], brings cybox [2.1.0.13], these versions appear to be incompatible.

• if I manual downgrade cybox to 2.1.0.12 everything works fine

the incompatibility appear to be due to Cybox changes to the nsparser and functions move to mixbox

p.s. not happy about a dot releases not being backwards compatible

[gtback]

Yes, this is a known issue, and to be honest I'm not happy about it either 😦 .

Unfortunately, when we released 1.2.0.0, we didn't restrict the cybox dependency to < 2.1.0.13 (since we didn't know the next release would be so significant and breaking). There's not a good way around this (we can't revise the old version), other than to say if you pin stix==1.2.0.0, you should also (now) pin cybox==2.1.0.12 as well.

In the future, we can consider making each version of stix depend on a specific version of cybox, but that won't fix this for existing versions like 1.2.0.0.

[michaelpepin]

with python-cybox versioning [2.1.0.12 vs 2.1.0.13] this is an issue.
<stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0">
all versions look the same

[gtback]

The CybOX XML generated by either version of the library should be valid and compatible with the other (and likely identical, but I'm not 100% sure of that).