cyclonedx merge defaults to specVersion 1.5 even when merging two v1.4 files

[aja08379]

Merging SBOMs seems to default to the output file being version 1.5, regardless of the input file versions. See for example test1.txt and test2.txt attached. Both v1.4, created with the snyk sbom CLI command.

Command used to merge them is:

cyclonedx merge --input-files test1.txt test2.txt --output-file new.txt --input-format json --output-format json --name "Test" --version "v0.0"

The output SBOM new.txt is v1.5 (also attached):

user@ubuntu2004:~$ cat test1.txt | jq
{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",

user@ubuntu2004:~$ cat test2.txt | jq
{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",

ash@ubuntu2004:~$ cat new.txt | jq
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",

new.txt test1.txt test2.txt

[Parisha7]

We are also facing similar issue. Is there any fix coming up soon?

[saloni410]

When can we expect the fix please ?

[andreas-hilti]

I think the intended behavior is to produce SBOMs of the latest version. However, you can use "--output-version v1_4" to force it to produce an SBOM of version 1.4.

[anubhav-tyagi1]

Hello @andreas-hilti ,

We are encountering an issue with the CycloneDX merge command. When merging two SBOMs with spec version v1.4, the resulting SBOM is in spec version v1.5.

Is this the expected behavior of the merge command?

Additionally, it appears that the merge command does not support an --output-version flag, as confirmed by the documentation, so we cannot explicitly specify the output spec version.

[andreas-hilti]

Hello @andreas-hilti ,

We are encountering an issue with the CycloneDX merge command. When merging two SBOMs with spec version v1.4, the resulting SBOM is in spec version v1.5.

Is this the expected behavior of the merge command?

Additionally, it appears that the merge command does not support an --output-version flag, as confirmed by the documentation, so we cannot explicitly specify the output spec version.

Yes, you are right, it is currently not supported. You can review: https://github.com/CycloneDX/cyclonedx-cli/pull/366

What you can do already now is this (merge followed by convert):

cyclonedx.exe merge --input-files sbom1.json sbom2.json --output-file sbom_combined.json
cyclonedx.exe convert --input-file sbom_combined.json --output-file sbom_combined_conv.json --output-version v1_4

[andreas-hilti]

With release 0.26.0 you can now specify the output format version using --output-version.