Repository navigation
Conversation
--set-nuget-purl now also applies to -ipr projects. Closes CycloneDX#1136 Signed-off-by: Kopf, Michael <Michael.Kopf@vector.com>
Signed-off-by: Kopf, Michael <Michael.Kopf@vector.com>
Signed-off-by: Kopf, Michael <Michael.Kopf@vector.com>
Fixes Codacy markdownlint MD013; add PR and issue refs. Signed-off-by: Kopf, Michael <Michael.Kopf@vector.com>
mtsfoni
force-pushed
the
feature/project-reference-nuget-purl
branch
from
October 11, 2026 22:43
fd9cd03 to
d78c0f1
Compare
Signed-off-by: Michael Tsfoni <80639729+mtsfoni@users.noreply.github.com>
mtsfoni
force-pushed
the
feature/project-reference-nuget-purl
branch
from
October 11, 2026 22:44
d78c0f1 to
a7dfcb3
Compare
This was referenced Oct 12, 2026
This was referenced Oct 15, 2026
Ank-KhoaHo
pushed a commit
to Ank-KhoaHo/DocToolkit
that referenced
this pull request
Oct 16, 2026
Updated [cyclonedx](https://github.com/CycloneDX/cyclonedx-dotnet) from 6.2.0 to 6.3.0. <details> <summary>Release notes</summary> _Sourced from [cyclonedx's releases](https://github.com/CycloneDX/cyclonedx-dotnet/releases)._ ## 6.3.0 ## Added - **NuGet purls for project references** (#1137, fixes #1136): combining `--set-nuget-purl` with `--include-project-references` generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references. ## Changed - **Development dependency scopes** (#1138): development dependencies and their development-only transitive dependencies are included by default with `scope="excluded"`. Packages shared with production runtime use remain `required`. - **`--exclude-dev` is deprecated but continues to filter**: it omits development-only and test-project-only packages while retaining packages shared with production runtime use. ## Fixed - **Assembly-name resolution** (#1128, fixes #917): resolve `$(RootNamespace)` in assembly names, including nested `$(MSBuildProjectName)` tokens. Missing, empty, or circular `$(AssemblyName)`-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation. - **Exclusion filtering** (#1135, fixes #1133): `--exclude-filter` removes only packages it newly orphans; pre-existing orphans are retained. - **Target-framework regression coverage** (#1131, fixes #1126): verifies exclusion filtering for non-normalized target frameworks, including `net48`, `netstandard2.0`, `Net8.0`, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1. ## Contributors Thanks to everyone who contributed code, tests, and issue reports to this release: - @MichaelKopfMkf — NuGet purls for project references (#1137, #1136). - @mtsfoni — development dependency scopes and compatible exclusion behavior (#1138). - @uo-uhbc — exclusion-filter orphan handling fix and reproduction (#1135, #1133). - @mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#1131). - @Eljees — root-namespace assembly-name resolution fix (#1128). - @TobiDimmel — reported the assembly-name property resolution issue (#917). - @jasonlhills — reported the exclusion-filter failure (#1126). ## 🎉 New Contributors A warm welcome and a big thank you to our first-time contributors: - @MichaelKopfMkf made their first contribution in [#1137](CycloneDX/cyclonedx-dotnet#1137). - @mgnslndh made their first contribution in [#1131](CycloneDX/cyclonedx-dotnet#1131). - @Eljees made their first contribution in [#1128](CycloneDX/cyclonedx-dotnet#1128). **Full changelog:** CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0 ## 6.2.1 ## CycloneDX for .NET 6.2.1 This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages. ### Fixed - **Resolve dependency ranges with multiple matching package versions** (#1113, fixes #1110) — solution scans no longer fail with `Sequence contains more than one matching element` when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component. - **Fix hash computation for uncached NuGet packages** (#1099) — reset the package stream before computing hashes when falling back to downloading an uncached `.nupkg`. ### Changed - Update .NET dependencies and CI tooling. - Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI. ### Documentation - Add a [best-practices guide](https://github.com/CycloneDX/cyclonedx-dotnet/blob/v6.2.1/docs/best-practices.md) covering root project targeting, restore-first workflows, and BOM metadata setup. ### Contributors Thanks to everyone who contributed to this release: - @LukasChristel — fix hash computation for uncached NuGet packages (#1099). - @michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#1110). - @mtsfoni — dependency range resolution fix and regression coverage (#1113). **Full changelog:** CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1 Commits viewable in [compare view](CycloneDX/cyclonedx-dotnet@v6.2.0...v6.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 16, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As described in #1136
SBOMs and SBOM management tools profit from correct purls in the bom nodes.
This only takes affect for the combination of
--set-nuget-purland-ipras one can asume the project references will be published as nuget packages as well.see the issue for an example