Changelog

CHANGELOG

v11.12.0 (2026-08-13)

Features

  • Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

v11.11.2 (2026-08-12)

Bug Fixes

v11.11.1 (2026-08-10)

Bug Fixes

v11.11.0 (2026-06-17)

Bug Fixes

  • Protocolpropertiestype enum case 5g-aka for CycloneDX 1.7 (#1004, bc97e1c)

Features

  • cryptoprimitive enum cases for CycloneDX 1.7 (#1002, 788ced1)

  • protocolpropertiestype enum cases for CycloneDX 1.7 (#1003, f9223d8)

v11.10.0 (2026-06-11)

Bug Fixes

  • Lossless flattening of dependency graph during JSON serialization (#993, d0e10ca)

  • Typing in contrib.bom.utils.BomDependencyGraphFlatMerger (#998, 988a937)

Documentation

  • Improve docs of contrib.bom.utils.BomRefDiscriminator (#996, 9beaf5c)

Features

  • Add contrib.bom.utils.BomDependencyGraphFlatMerger (#997, 78b8d8b)

  • Move output.BomRefDiscriminator to contrib.bom.utils.BomRefDiscriminator (#995, 3bb87aa)

Performance Improvements

  • contrib.bom.utils.bomdependencygraphflatmerger._flatten_merge (#999, a8579b8)

v11.9.0 (2026-06-08)

Features

  • Add support for license expression details (#908, b502381)

v11.8.0 (2026-06-04)

Documentation

Features

  • Add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1 (#985, 303889b)

  • Pull SPDX license IDs v1.1-3.28.0 (#986, 42ff044)

v11.7.0 (2026-03-17)

Documentation

Features

  • Add properties for licenses according to CycloneDX 1.5 (#947, 375d209)

  • Make schema deprecation warnings handle-able (#945, 71edacf)

v11.6.0 (2025-12-02)

Documentation

Features

  • Moved non‑standard implementations to Contrib area (#916, 15a9023)

v11.5.0 (2025-10-31)

Features

  • Add support for DistributionConstraints in BOM metadata (#906, 70adb7c)

  • Add support for properties in external references (#907, 73e7c1a)

v11.4.0 (2025-10-23)

Features

  • Add support for CycloneDX 1.7 (basics) (#902, f35b9ee)

v11.3.0 (2025-10-22)

Bug Fixes

  • Implement __lt__ for models still missing it (#899, bebda4f)

Features

  • Deserialize single ComponentEvidence.identity (#900, 9425c67)

v11.2.0 (2025-10-15)

Documentation

  • Add Changelog to project urls (d8a24b7)

Features

v11.1.0 (2025-09-09)

Documentation

Features

  • Add BomRefs for known models according to CycloneDX 1.5 (#859, 0898cf7)

  • Updating SPDX license list to 3.27.0 (#885, 876a364)

v11.0.0 (2025-07-21)

Features

  • Ignore unknown properties when deserializing (#853, 4842828)

v10.5.0 (2025-07-20)

Features

v10.4.1 (2025-07-08)

Bug Fixes

  • Add runtime dependnecy typing_extensions>=4.6; python_version<"3.13" (#845, 95b560a)

  • Added runtime dependnecy referencing>=0.28.4" (#846, 4d01e87)

v10.4.0 (2025-07-08)

Bug Fixes

  • Issue DeprecationWarnings for deprecated properties properly (#838, 34a11aa)

  • Removed meaningless pattern checks for CycloneDX 1.2 JSON schema (#843, 6e8083a)

Features

v10.3.0 (2025-06-30)

Documentation

  • Instructions for code style (160810f)

Features

  • Schema based validation may return iterable of all errors (#834, f95576f)

v10.2.0 (2025-06-10)

Bug Fixes

  • vulnerabilityscoresource.get_from_vector() for CVSS_V3_1 and CVSS_V4 (#824, a97ccd4)

Features

  • Add support for component’s evidences according to spec (#810, 3395fda)

v10.1.0 (2025-06-05)

Features

v10.0.2 (2025-06-02)

Bug Fixes

  • model.bommetadata.component setter typehint (#817, bfe889a)

v10.0.1 (2025-05-10)

Bug Fixes

  • Add missing comparator for VulnerabilityAnalysis (#812, 0df2982)

Documentation

v10.0.0 (2025-04-23)

Features

v9.1.1-rc.1 (2025-03-03)

v9.1.0 (2025-02-27)

Bug Fixes

  • Improved comparison functionality of model.VulnerabilityAnalysis (#795, 7d57c73)

Features

  • model.vulnerabilityanalysis properties for issued/updated datetime (#794, 4a3955a)

v9.0.2 (2025-02-26)

v9.0.0 (2025-02-26)

BREAKING Changes

  • Fix: model.vulnerability.VulnerabilityReference‘s properties are all mandatory (#790 via #792)

  • Refactor: Rename spdx.is_compund_expression -> spdx.is_expression (#779)

  • Behavior: BomRef affects comparison/hashing (#754 & #780)
     This is only a breaking change if you relied on ordering of elements.

  • Behavior: streamline comparison/hashing functions (#755) This is only a breaking change if you relied on ordering of elements.

  • Dependency: bump dependency py-serializable >=2 <3, was >=1.1.1 <2 (#775) This is only a breaking change if you have other packages depend on that specific version.

v8.9.0 (2025-02-25)

Documentation

  • Extended instructions for “contributing” (#783, e2a4ed3)

Features

  • Avoid raising NoPropertiesProvidedException for optional parameters (#786, 845b8d5)

v8.8.0 (2025-02-12)

Features

  • Add cyclonedx.model.crypto.ProtocolProperties.crypto_refs (#767, beb35f5)

v8.7.0 (2025-02-06)

Features

  • Allow empty OrganizationalContact object (#772, 03b35f4)

v8.6.0 (2025-02-04)

Features

  • Allow empty OrganizationalEntity object (#768, 472bded)

  • Expand the capabilities of models.definition.Standard (#713, 901dcdc)

v8.5.1 (2025-01-28)

Documentation

  • Fix typos in in conda-forge.md and remove unused reference in README (#762, 66ece7a)

  • Modernize docstrings for CDX1.6 (#759, fb9a42e)

  • Responsibilities & capabilities (#763, ab4ae45)

Features

v8.5.0 (2024-11-18)

Documentation

  • Remove invalid docsting note about auto-assigned bom-ref values (#733, 5aa5787)

Features

v8.4.0 (2024-10-29)

Bug Fixes

  • No warning for missing dependencies if no component exists (#720, d9c3ded)

Features

  • Add factory method XsUri.make_bom_link() (#728, 5ec73d0)

v8.3.0 (2024-10-26)

Documentation

Features

v8.2.1 (2024-10-24)

Bug Fixes

v8.2.0 (2024-10-22)

Features

v8.1.0 (2024-10-21)

Documentation

  • Fix code examples regarding outputting (#709, c72d5f4)

Features

  • Add support for Lifecycles in BOM metadata (#698, 6cfeb71)

v8.0.0 (2024-10-14)

Documentation

  • chaneglog: Omit chore/ci/refactor/style/test/build (#703, a210809)

Features

BREAKING Changes

  • Removed cyclonedx.mode.ThisTool, utilize cyclonedx.builder.this.this_tool() instead. * Moved cyclonedx.model.Tool to cyclonedx.model.tool.Tool.

  • Property cyclonedx.mode.bom.BomMetaData.tools is of type cyclonedx.model.tool.ToolRepository now, was SortedSet[cyclonedx.model.Tool]. The getter will act accordingly; the setter might act in a backwards-compatible way.

  • Property cyclonedx.mode.vulnerability.Vulnerability.tools is of type cyclonedx.model.tool.ToolRepository now, was SortedSet[cyclonedx.model.Tool]. The getter will act accordingly; the setter might act in a backwards-compatible way.

  • Constructor cyclonedx.model.license.LicenseExpression() accepts optional argument acknowledgement only as key-word argument, no longer as positional argument.

Changes

  • Constructor of cyclonedx.model.bom.BomMetaData also accepts an instance of cyclonedx.model.tool.ToolRepository for argument tools. * Constructor of cyclonedx.model.bom.BomMetaData no longer adds this very library as a tool. Downstream users SHOULD add it manually, like my-bom.metadata.tools.components.add(cyclonedx.builder.this.this_component()).

Fixes

  • Deserialization of CycloneDX that do not include tools in the metadata are no longer unexpectedly modified/altered.

Added

Enabled Metadata Tools representation and serialization in accordance with CycloneDX 1.5

  • New class cyclonedx.model.tool.ToolRepository. * New function cyclonedx.builder.this.this_component() – representation of this very python library as a Component. * New function cyclonedx.builder.this.this_tool() – representation of this very python library as a Tool. * New function cyclonedx.model.tool.Tool.from_component().

Dependencies

  • Raised runtime dependency py-serializable>=1.1.1,<2, was >=1.1.0,<2.

v7.6.2 (2024-10-07)

Bug Fixes

  • Behavior of and typing for crypto setters with optional values (#694, d8b20bd)

Documentation

v7.6.1 (2024-09-18)

Bug Fixes

v7.6.0 (2024-08-14)

Features

  • hashtype.from_composite_str for Blake2b, SHA3, Blake3 (#663, c59036e)

v7.5.1 (2024-07-08)

Bug Fixes

  • Xml serialize normalizedString and token properly (#646, b40f739)

v7.5.0 (2024-07-04)

Features

  • Add workaround property for v1.5 and v1.6 (#642, b5ebcf8)

v7.4.1 (2024-06-12)

Bug Fixes

  • cyclonedx.model.property.value value is optional (#631, ad0f98b)

Documentation

v7.4.0 (2024-05-23)

Documentation

  • Ossp best practice percentage (75f58dc)

Features

v7.3.4 (2024-05-06)

Bug Fixes

  • Allow suppliers with empty-string names (#611, b331aeb)

v7.3.3 (2024-05-06)

Bug Fixes

  • Json validation allow arbitrary $schema value (#613, 08b7c60)

v7.3.2 (2024-04-26)

Bug Fixes

  • Properly sort components based on all properties (#599, 8df488c)

v7.3.1 (2024-04-22)

Bug Fixes

  • Include all fields of Component in __lt__ function for #586 (#587, d784685)

v7.3.0 (2024-04-19)

Features

v7.2.0 (2024-04-19)

Features

v7.1.0 (2024-04-10)

Documentation

  • Missing schema support table & update schema support to reflect version 7.0.0 (#584, d230e67)

Features

  • Support bom.properties for CycloneDX v1.5+ (#585, 1d1c45a)

v7.0.0 (2024-04-09)

Features

  • Support for CycloneDX v1.6 (8bbdf46)

  • added draft v1.6 schemas and boilerplate for v1.6

  • re-generated test snapshots for v1.6

  • note bom.metadata.manufacture as deprecated

  • work on bom.metadata for v1.6

  • Deprecated .component.author. Added .component.authors and .component.manufacturer

  • work to add .component.omniborid - but tests deserialisation tests fail due to schema differences (.component.author not in 1.6)

  • work to get deserialization tests passing

v6.4.4 (2024-03-18)

Bug Fixes

v6.4.3 (2024-03-04)

Bug Fixes

  • Serialization of model.component.Diff (#557, 22fa873)

v6.4.2 (2024-03-01)

Build System

Documentation

  • Exclude internal docs from rendering (#545, 7e55dfe)

  • Update architecture description and examples (#550, a19fd28)

v6.4.1 (2024-01-30)

Bug Fixes

  • model.bomref no longer equal to unset peers (#543, 1fd7fee)

Documentation

v6.4.0 (2024-01-22)

Documentation

Features

v6.3.0 (2024-01-06)

Documentation

  • Add Documentation url to project meta (1080b73)

  • Add Documentation url to project meta (c4288b3)

Features

  • Enable dependency py-serializable 0.17 (#529, 9f24220)

v6.2.0 (2023-12-31)

Build System

  • Allow additional major-version RC branch patterns (f8af156)

Documentation

Features

  • Allow lxml requirement in range of >=4,<6 (#523, 7d12b9a)

v6.1.0 (2023-12-22)

Features

  • Add function to map python hashlib algorithms to CycloneDX (#519, 81f8cf5)

v6.0.0 (2023-12-10)

Features

Breaking Changes

  • Removed symbols that were already marked as deprecated (via #493)

  • Removed symbols in parser.* (#489 via #495)

  • Removed output.LATEST_SUPPORTED_SCHEMA_VERSION (#491 via #494)

  • Serialization of unsupported enum values might downgrade/migrate/omit them (#490 via #496) Handling might raise warnings if a data loss occurred due to omitting. The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.

  • Serialization of any model.component.Component with unsupported type raises exception.serialization.SerializationOfUnsupportedComponentTypeException (#490 via #496) * Object model.bom_ref.BomRef‘s property value defaults to Null, was arbitrary UUID (#504 via #505) This change does not affect serialization. All bom-refs are guaranteed to have unique values on rendering.

  • Removed helpers from public API (#503 via #506)

Added

  • Basic support for CycloneDX 1.5 (#404 via #488) * No data models were enhanced nor added, yet. Pull requests to add functionality are welcome. * Existing enumerable got new cases, to reflect features of CycloneDX 1.5 (#404 via #488) * Outputters were enabled to render CycloneDX 1.5 (#404 via #488)

Tests

  • Created (regression/unit/integration/functional) tests for CycloneDX 1.5 (#404 via #488) * Created (regression/functional) tests for Enums’ handling and completeness (#490 via #496)

Misc

  • Bumped dependency py-serializable@^0.16, was @^0.15 (via #496)

API Changes — the details for migration

  • Added new sub-package exception.serialization (via #496)

  • Removed class models.ComparableTuple (#503 via #506)

  • Enum model.ExternalReferenceType got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)

  • Removed function models.get_now_utc (#503 via #506) * Removed function models.sha1sum (#503 via #506)

  • Enum model.component.ComponentType got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)

  • Removed model.component.Component.__init__()‘s deprecated optional kwarg namespace (via #493) Use kwarg group instead.

  • Removed model.component.Component.__init__()‘s deprecated optional kwarg license_str (via #493) Use kwarg licenses instead.

  • Removed deprecated method model.component.Component.get_namespace() (via #493)

  • Removed class models.dependency.DependencyDependencies (#503 via #506)

  • Removed model.vulnerability.Vulnerability.__init__()‘s deprecated optional kwarg source_name (via #493) Use kwarg source instead.

  • Removed model.vulnerability.Vulnerability.__init__()‘s deprecated optional kwarg source_url (via #493) Use kwarg source instead.

  • Removed model.vulnerability.Vulnerability.__init__()‘s deprecated optional kwarg recommendations (via #493) Use kwarg recommendation instead.

  • Removed model.vulnerability.VulnerabilityRating.__init__()‘s deprecated optional kwarg score_base (via #493) Use kwarg score instead.

  • Enum model.vulnerability.VulnerabilityScoreSource got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)

  • Removed output.LATEST_SUPPORTED_SCHEMA_VERSION (#491 via #494)

  • Removed deprecated function output.get_instance() (via #493) Use function output.make_outputter() instead. * Added new class output.json.JsonV1Dot5, to reflect CycloneDX 1.5 (#404 via #488)

  • Added new item to dict output.json.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 (#404 via #488)

  • Added new class output.xml.XmlV1Dot5, to reflect CycloneDX 1.5 (#404 via #488)

  • Added new item to dict output.xml.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 (#404 via #488)

  • Removed class parser.ParserWarning (#489 via #495)

  • Removed class parser.BaseParser (#489 via #495)

  • Enum schema.SchemaVersion got new case V1_5, to reflect CycloneDX 1.5 (#404 via #488)

v5.2.0 (2023-12-02)

Documentation

Features

  • model.xsuri migrate control characters according to spec (#498, e490429)

v5.1.1 (2023-11-02)

Bug Fixes

v5.1.0 (2023-10-31)

Documentation

Features

  • Guarantee unique BomRefs in serialization result (#479, a648775)

v5.0.1 (2023-10-24)

Documentation

v5.0.0 (2023-10-24)

Features

BREAKING CHANGES

  • Dropped support for python<3.8 (#436 via #441; enable #433)

  • Reworked license related models, collections, and factories (#365 via #466)

  • Behavior * Method model.bom.Bom.validate() will throw exception.LicenseExpressionAlongWithOthersException, if detecting invalid license constellation (#453 via #452)

  • Fixed tuple comparison when unequal lengths (via #461)

  • API * Enum schema.SchemaVersion is no longer string-like (#442 via #447)

  • Enum schema.OutputVersion is no longer string-like (#442 via #447)

  • Abstract class output.BaseOutput requires implementation of new method output_format (#446 via #447)

  • Abstract method output.BaseOutput.output_as_string() got new optional parameter indent (#437 via #458) * Abstract method output.BaseOutput.output_as_string() accepts arbitrary kwargs (via #458, #462)

  • Removed class factory.license.LicenseChoiceFactory (via #466) The old functionality was integrated into factory.license.LicenseFactory.

  • Method factory.license.LicenseFactory.make_from_string()‘s parameter name_or_spdx was renamed to value (via #466)

  • Method factory.license.LicenseFactory.make_from_string()‘s return value can also be a LicenseExpression (#365 via #466) The behavior imitates the old factory.license.LicenseChoiceFactory.make_from_string()

  • Renamed class module.License to module.license.DisjunctliveLicense (#365 via #466)

  • Removed class module.LicenseChoice (#365 via #466) Use dedicated classes module.license.DisjunctliveLicense and module.license.LicenseExpression instead

  • All occurrences of models.LicenseChoice were replaced by models.licenses.License (#365 via #466)

  • All occurrences of SortedSet[LicenseChoice] were specialized to models.license.LicenseRepository (#365 via #466)

Fixed

  • Serialization of multy-licenses (#365 via #466) * Detect unused “dependent” components in model.bom.validate() (via #464)

Changed

  • Updated latest supported list of supported SPDX license identifiers (via #433)

  • Shipped schema files are moved to a protected space (via #433)
     These files were never intended for public use.

  • XML output uses a default namespace, which makes results smaller. (#438 via #458)

Added

  • Support for Python 3.12 (via #460)

  • JSON- & XML-Validators (#432, #446 via #433, #448)
     The functionality might require additional dependencies, that can be installed with the extra “validation”. See the docs in section “Installation” for details. * JSON & XML can be generated in a more human-friendly form (#437, #438 via #458)

  • Type hints, typings & overloads for better integration downstream (via #463) * API * New function output.make_outputter() (via #469) This replaces the deprecated function output.get_instance().

  • New sub-package validation (#432, #446 via #433, #448, #469, #468, #469)

  • New class exception.MissingOptionalDependencyException (#432 via #433) * New class exception.LicenseExpressionAlongWithOthersException (#453 via #452) * New dictionaries output.{json,xml}.BY_SCHEMA_VERSION (#446 via #447) * Existing implementations of class output.BaseOutput now have a new method output_format (#446 via #447)

  • Existing implementations of method output.BaseOutput.output_as_string() got new optional parameter indent (#437 via #458)

  • Existing implementations of method output.BaseOutput.output_to_file() got new optional parameter indent (#437 via #458) * New method factory.license.LicenseFactory.make_with_expression() (via #466)

  • New class model.license.DisjunctiveLicense (#365 via #466)

  • New class model.license.LicenseExpression (#365 via #466)

  • New class model.license.LicenseRepository (#365 via #466)

  • New class serialization.LicenseRepositoryHelper (#365 via #466)

Deprecated

  • Function output.get_instance() might be removed, use output.make_outputter() instead (via #469)

Tests

  • Added validation tests with official CycloneDX schema test data (#432 via #433)

  • Use proper snapshots, instead of pseudo comparison (#437 via #464)

  • Added regression test for bug #365 (via #466, #467)

Misc

  • Dependencies: bumped py-serializable@^0.15.0, was @^0.11.1 (via #458, #463, #464, #466)

  • Style: streamlined quotes and strings (via #472)

  • Chore: bumped internal dev- and QA-tools (#436 via #441, #472)

  • Chore: added more QA tools to prevent common security issues (via #473)

v4.2.3 (2023-10-16)

Bug Fixes

  • Spdx-expression-validation internal crashes are cought and handled (#471, 5fa66a0)

v4.2.2 (2023-09-14)

Bug Fixes

Documentation

v4.2.1 (2023-09-06)

Bug Fixes

  • licensechoicefactory.make_from_string() prioritize SPDX id over expression (#427, e1bdfdd)

v4.2.0 (2023-09-06)

Features

v4.1.0 (2023-08-27)

Documentation

  • examples: Showcase shorthand dependency management (#403, 8b32efb)

Features

  • Programmatic access to library’s version (#417, 3585ea9)

v4.0.1 (2023-06-28)

Bug Fixes

  • Conditional warning if no root dependencies were found (#398, c8175bb)

Build System

Documentation

v4.0.0 (2023-03-20)

Bug Fixes

  • Remove toml as dependency as not used and seems to be breaking Python 3.11 CI (8fb1b14)

  • Removed autopep8 in favour of flake8 as both have conflicting dependencies now (8fb1b14)

  • Removed setuptools as dependency (8fb1b14)

  • Removed types-toml from dependencies - not used (8fb1b14)

  • Update serializable to include XML safety changes (8fb1b14)

Features

Breaking Changes

  • Large portions of this library have been re-written for this release and many methods and contracts have changed.

v3.1.5 (2023-01-12)

Bug Fixes

  • Mak test’s schema paths relative to cyclonedx package (#338, 1f0c05f)

v3.1.4 (2023-01-11)

Bug Fixes

Features

  • Include tests in sdist builds for #336 (#337, 936ad7d)

v3.1.3 (2023-01-07)

Bug Fixes

  • Serialize dependency graph for nested components (#329, fb3f835)

v3.1.2 (2023-01-06)

Bug Fixes

  • Prevent errors on metadata handling for some specification versions (#330, f08a656)

Documentation

v3.1.1 (2022-11-28)

Bug Fixes

  • Type hint for get_component_by_purl is incorrect (3f20bf0)

v3.1.0 (2022-09-15)

Features

  • License factories (033bad2)

  • Out-factor SPDX compund detection (fd4d537)

  • Out-factor SPDX compund detection (2b69925)

v2.7.1 (2022-08-01)

Bug Fixes

  • Pinned mypy <= 0.961 due to #278 (d6955cb)

  • Properly support nested components and services #275 (6597db7)

v2.7.0 (2022-07-21)

Features

  • Added updated CycloneDX 1.4.2 schemas (7fb27ae)

  • Support for CycloneDX schema version 1.4.2 (db7445c)

v2.6.0 (2022-06-20)

Features

  • Reduce unnessessarry type casting of set/SortedSet (#203, 089d971)

v2.5.2 (2022-06-15)

Bug Fixes

  • Add expected lower-than comparators for OrganizationalEntity and VulnerabilityCredits (#248, 0046ee1)

v2.5.1 (2022-06-10)

Bug Fixes

  • Add missing Vulnerability comparator for sorting (#246, c3f3d0d)

v2.5.0 (2022-06-10)

Build System

  • Move typing to dev-dependencies (0e2376b)

Documentation

  • Fix typo “This is out” -> “This is our” (ef0278a)

Features

  • Use SortedSet in model to improve reproducibility - this will provide predictable ordering of various items in generated CycloneDX documents - thanks to @RodneyRichardson (8a1c404)

v2.4.0 (2022-05-17)

Features

  • deps: Remove unused typing-extensions constraints (2ce358a)

v2.3.0 (2022-04-20)

Features

  • Add support for Dependency Graph in Model and output serialisation (ea34513)

v2.2.0 (2022-04-12)

Features

  • Bump JSON schemas to latest fix verison for 1.2 and 1.3 - see: (bd6a088)

  • Bump XML schemas to latest fix version for 1.2-1.4 - see: (bd2e756)

v2.1.1 (2022-04-05)

Bug Fixes

  • version being optional in JSON output can raise error (ba0c82f)

  • Prevent error if version not set (b9a84b5)

v2.1.0 (2022-03-28)

Features

  • Output errors are verbose (bfe8fb1)

v2.0.0 (2022-02-21)

BREAKING Changes

  • BREAKING CHANGE: Adopt PEP-3102

  • BREAKING CHANGE: Optional Lists are now non-optional Sets

  • BREAKING CHANGE: Remove concept of DEFAULT schema version - replaced with LATEST schema version

  • BREAKING CHANGE: Added BomRef data type

Bug Fixes

  • component.bom_ref is not Optional in our model implementation (in the schema it is) - we generate a UUID if bom_ref is not supplied explicitly (5c954d1)

  • expression not supported in Component Licsnes for version 1.0 (15b081b)

  • license_url not serialised in XML output #179 (#180, f014d7c)

  • Components with no version (optional since 1.4) produce invalid BOM output in XML #150 (70d25c8)

  • Further fix for #150 (1f55f3e)

  • Implemented correct __hash__ methods in models (#155, 32c0139)

  • Regression introduced by first fix for #150 (c09e396)

  • Resolved #169 (part of #155) (#172, a926b34)

  • Temporary fix for __hash__ of Component with properties #153 (a51766d)

Features

  • bom-ref for Component and Vulnerability default to a UUID (#142, b45ff18)

  • bom-ref for Component and Vulnerability default to a UUID if not supplied ensuring they have a unique value #141 (b45ff18)

  • Bump dependencies (da3f0ca)

  • Complete support for bom.components (#155, 32c0139)

  • Completed work on #155 (#172, a926b34)

  • Support complete model for bom.metadata (#162, 2938a6c)

  • Support for bom.externalReferences in JSON and XML #124 (1b733d7)

  • Support services in XML BOMs (9edf6c9)

Breaking Changes

  • Adopt PEP-3102

  • Optional Lists are now non-optional Sets

  • Remove concept of DEFAULT schema version - replaced with LATEST schema version

  • Added BomRef data type

v1.3.0 (2022-01-24)

Features

  • bom-ref for Component and Vulnerability default to a UUID (#142, 3953bb6)

  • bom-ref for Component and Vulnerability default to a UUID if not supplied ensuring they have a unique value #141 (#142, 3953bb6)

v1.2.0 (2022-01-24)

Features

v1.1.1 (2022-01-19)

Bug Fixes

v1.1.0 (2022-01-13)

Features

  • Add support for bom.metadata.component (#118, 1ac31f4)

v1.0.0 (2022-01-13)

v0.12.3 (2021-12-15)

Bug Fixes

  • Removed requirements-parser as dependency (temp) as not available for Python 3 as Wheel (#98, 3677d9f)

v0.12.2 (2021-12-09)

Bug Fixes

  • Tightened dependency packageurl-python (#95, eb4ae5c)

v0.12.1 (2021-12-09)

Bug Fixes

  • Further loosened dependency definitions (8bef6ec)

v0.12.0 (2021-12-09)

Bug Fixes

  • Typing definitions to be PY 3.6 compatible (07ebedc)

  • Update conda package parsing to handle build containing underscore (#66, 2c6020a)

Features

  • Loosed dependency versions to make this library more consumable (55f10fb)

  • Lowering minimum dependency versions (55f10fb)

  • Lowering minimum dependency versions - importlib-metadata raising minimum to ensure we get a typed library (55f10fb)

  • Lowering minimum version for importlib-metadata to 3.4.0 with modified import statement (55f10fb)

v0.11.1 (2021-11-10)

Bug Fixes

v0.11.0 (2021-11-10)

Features

v0.10.2 (2021-10-21)

Bug Fixes

  • Correct way to write utf-8 encoded files (49f9369)

v0.10.1 (2021-10-21)

Bug Fixes

  • Ensure output to file is UTF-8 (a10da20)

  • Ensure output to file is UTF-8 (193bf64)

v0.10.0 (2021-10-20)

Features

v0.9.1 (2021-10-19)

v0.9.0 (2021-10-19)

Bug Fixes

  • Missing check for Classifiers in Environment Parser (b7fa38e)

Features

  • Add support for parsing package licenses when using the Environment Parsers (c414eaf)

v0.8.3 (2021-10-14)

Bug Fixes

  • Coding standards violations (00cd1ca)

  • Handle Pipfile.lock dependencies without an index specified (26c62fb)

v0.8.2 (2021-10-14)

Bug Fixes

  • Add namespace and subpath support to Component to complete PackageURL Spec support (780adeb)

v0.8.1 (2021-10-12)

Bug Fixes

  • Multiple hashes being created for an externalRefernce which is not as required (970d192)

v0.8.0 (2021-10-12)

Features

  • Add support for externalReferneces for Components and associated enhancements to parsers to obtain information where possible/known (a152852)

v0.7.0 (2021-10-11)

Features

  • Support for pipenv.lock file parsing (68a2dff)

v0.6.2 (2021-10-11)

v0.6.1 (2021-10-11)

Bug Fixes

  • Added ability to add tools in addition to this library when generating CycloneDX + plus fixes relating to multiple BOM instances (e03a25c)

  • Better methods for checking if a Component is already represented in the BOM, and the ability to get the existing instance (5fee85f)

v0.6.0 (2021-10-11)

Features

v0.5.0 (2021-10-11)

Bug Fixes

  • Bumped a dependency version (efc1053)

Build System

  • Updated dependencies, moved pdoc3 to a dev dependency (6a9947d)

Features

  • Add support for tool(s) that generated the SBOM (7d1e6ef)

v0.4.1 (2021-09-27)

Bug Fixes

  • Improved handling for requirements.txt content without pinned or declared versions (7f318cb)

Build System

v0.4.0 (2021-09-16)

Bug Fixes

  • Relaxed typing of parameter to be compatible with Python < 3.9 (f9c7990)

  • Remove unused commented out code (ba4f285)

  • Removed print call (8806553)

  • Removed print call (d272d2e)

Features

  • Helper methods for deriving Severity and SourceType (6a86ec2)

  • Support for localising vectors (i.e. stripping out any scheme prefix) (b9e9e17)

v0.3.0 (2021-09-15)

Features

  • Adding support for extension schema that descriptions vulnerability disclosures (d496695)

v0.2.0 (2021-09-14)

Bug Fixes

  • Whitespace on empty line removed (cfc952e)

v0.1.0 (2021-09-13)

Features

  • Add poetry support (f3ac42f)

  • Added helper method to return a PackageURL object representing a Component (367bef1)

v0.0.11 (2021-09-10)

Bug Fixes

  • build: Removed artefacts associtated with non-poetry build (f9119d4)

  • build: Test failure and dependency missing (9a2cfe9)

  • test: Test was not updated for revised author statement (d1c9d37)

v0.0.10 (2021-09-08)

Bug Fixes

v0.0.9 (2021-09-08)

v0.0.8 (2021-09-08)

Bug Fixes

  • Additional info to poetry, remove circleci (2fcfa5a)

v0.0.7 (2021-09-08)

Bug Fixes

  • Initial release to pypi, tell poetry to include cyclonedx package (a030177)

  • Release with full name (4c620ed)

v0.0.6 (2021-09-08)

Bug Fixes

  • Initial release to pypi (99687db)

v0.0.5 (2021-09-08)

v0.0.4 (2021-09-08)

v0.0.3 (2021-09-08)

v0.0.2 (2021-09-08)

  • Initial Release