specification

specification copied to clipboard

stevespringett

Is `bom-ref` required or optional?

4

The 1.6 schema of a `workflow`, `task`, `workspace`, and `trigger` require a `bom-ref`, yet each `description` for a `bom-ref` says it is "an optional identifier". Is the `description` incorrect, or...

weaversa

bom-ref help text needs tweaking ❗

4

`bom-ref` is a required attribute, so we need to remove the `optional` word from the description. https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.6.schema.json#L3887 https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.6.schema.json#L3895 https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.6.schema.json#L4207 https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.6.schema.json#L4214 I think in 1.7 we can think of externalizing the...

prabhu

[FEATURE]: component type "source"

13

## Allow listing of "source" type components Creating SBOMs for source collections is valuable, e.g. if you (have to) provide a source code bundle for OSS components you ship in...

gernot-h

[FEATURE]: Reference Transparency Exchange API Collection

3

## Describe the feature Since the [TEA Collection](https://github.com/CycloneDX/transparency-exchange-api/blob/main/tea-collection/tea-collection.md) provides a **versioned** and mutable set of external references related to a given CycloneDX Component (more precisely a [TEA Component](https://github.com/CycloneDX/transparency-exchange-api/blob/main/tea-component/tea-component.md)), it would...

ppkarwasz

feat: support multi license mix

4

As discussed in ticket #454, this PR adds the following abilities: - have multiple license expressions - have a mix of license expressions, SPDX license IDs, and named licenses Please...

jkowalleck

feat: licenses acknowledgement SHOULD be unique

7

as discussed in #619 - license acknowledgement should be be unique - license acknowledgement should be be unset when used if evidences ---- this is considered a non-breaking change, as...

jkowalleck

Added citation support and test cases.

2

TODO/DONE - [x] JSON schema modified - [x] XML schema modified - [x] ProtoBuf schema modified - [x] JSON examples/test data crafted - [x] XML examples/test data crafted - [x]...

stevespringett

Bumps [json-schema-for-humans](https://github.com/coveooss/json-schema-for-humans) from 1.3.4 to 1.4.1. Release notes Sourced from json-schema-for-humans's releases. v1.4.1 1.4.1 (2025-05-09) Bug Fixes Resolve bs4 deprecation warnings (#306) (ccb2a51) v1.4.0 1.4.0 (2025-05-09) Bug Fixes Markdown: Fix...

dependabot[bot]

[FEATURE]: there SHOULD be at most one "declared" and one "conclude" license per component

12

## Describe the feature CycloneDX allows multiple licenses in parallel, per component/evidence/etc. Currently, it is possible to have multiple "declared" licenses. Currently, it is possible to have multiple "concluded" licenses....

jkowalleck