v1.7

[jkowalleck]

Fixed

• XML schema: add type for ComponentData sub-elements (#600 via #601)
• JSON schema: added the correct deprecated mark for already deprecated structures (via a973a6b)

Deprecated

• Deprecated various fields and structures related to cryptographic transparency - CBOM . (via #657)
  Use the newly added structures and fields for detailing the information instead.

Changed

• Extended the scope of formulations. (via #647)
  From now on, formulations may be used to describe how any referencable object within the BOM came together, including components, services, metadata, declarations, or the BOM itself.
  Before, it was restricted to components and services.

Added

• Support for external components with version-ranges (#321 via #586)
• Support for multiple SPDX License Expressions alongside with other licenses (#454 via #582)
• Support for Streebog hashing algorithm (#485 via #525)
• Support for license expression details and properties (#549, #554 via #599)
• Support for expressing BOM distribution constraints with the Traffic Light Protocol (TLP) in metadata (#595 via #604, #653)
• Support for representing patent information (#596 via #597)
• Support for properties on external-references (#608 via #610)
• Support for citations (#630 via #629)
• Support for detailing cryptographic transparency information - CBOM (#569 via #657)

Documentation

• Elaborated component classification "platform", explicitly expressed that it includes just-in-time compilers and interpreters (#233 via #647)
• Removed the term "optional" from the schema where the definition was already unambiguous (#616, #649 via #680)

Test data

• Add test data for CycloneDX 1.7 implementations in XML, JSON, Protobuf

---

• fixes Feature Request: new ComponentType "runtime" #233
• fixes Feature: documenting external/extraneous dependencies #321
• fixes licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454
• fixes [FEATURE]: Adding Streebog hashing algorithm #485
• fixes [FEATURE]: "properties" on an SPDX-expression license #549
• fixes feat: (multiple) attachments for license texts of type "expression" #554
• fixes [FEATURE]: Include TLP marking in metadata #595
• fixes [FEATURE]: Add support for referencing patent information #596
• fixes [Defect]: Missing type in XML schema for ComponentData subelements #600
• fixes [FEATURE]: properties for externalReferences #608
• fixes [FEATURE]: Add citation support #629
• fixes bom-ref help text needs tweaking ❗  #616
• fixes Is bom-ref required or optional? #649

[Copilot]

Pull Request Overview

This PR introduces CycloneDX specification version 1.7, adding comprehensive test data for all supported formats (XML, JSON, and Protocol Buffers). The update includes new functionality for patent information, citations, cryptographic transparency (CBOM), external component version ranges, multiple SPDX license expressions, and enhanced formulation capabilities.

Key Changes:

• Adds comprehensive test data covering new CycloneDX 1.7 features including patent assertions, license expression details, and CBOM support
• Provides test coverage for enhanced formulation workflows and external reference properties
• Includes validation test cases for all major 1.7 schema elements across XML, JSON, and Protocol Buffer formats

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 264 out of 272 changed files in this pull request and generated 15 comments.

Comments suppressed due to low confidence (1)

tools/src/test/resources/1.7/valid-license-expression-with-text-1.7.json:1

• Inconsistent bom-ref values. Line 41 references 'component-B' but line 48 should reference 'component-C' based on the context, not 'component-C' twice.

{

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 264 out of 272 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

tools/src/test/resources/1.7/valid-license-expression-with-text-1.7.json:1

• Inconsistent bom-ref values: line 41 shows 'LicenseDetails-component-B' but line 48 shows 'LicenseDetails-component-C', while both should reference component-B and component-C respectively according to the text content.

{

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 264 out of 272 changed files in this pull request and generated no new comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}