[dependabot]

Updated cyclonedx from 6.2.0 to 6.3.1.

Release notes

Sourced from cyclonedx's releases.

6.3.1

Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#​1139, #​1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @​wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0

Added

• NuGet purls for project references (#​1137, fixes #​1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

• Development dependency scopes (#​1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
• --exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

• Assembly-name resolution (#​1128, fixes #​917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
• Exclusion filtering (#​1135, fixes #​1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
• Target-framework regression coverage (#​1131, fixes #​1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

• @​MichaelKopfMkf — NuGet purls for project references (#​1137, #​1136).
• @​mtsfoni — development dependency scopes and compatible exclusion behavior (#​1138).
• @​uo-uhbc — exclusion-filter orphan handling fix and reproduction (#​1135, #​1133).
• @​mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#​1131).
• @​Eljees — root-namespace assembly-name resolution fix (#​1128).
• @​TobiDimmel — reported the assembly-name property resolution issue (#​917).
• @​jasonlhills — reported the exclusion-filter failure (#​1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

• @​MichaelKopfMkf made their first contribution in #​1137.
• @​mgnslndh made their first contribution in #​1131.
• @​Eljees made their first contribution in #​1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1

CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

• Resolve dependency ranges with multiple matching package versions (#​1113, fixes #​1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
• Fix hash computation for uncached NuGet packages (#​1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

• Update .NET dependencies and CI tooling.
• Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

• Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

• @​LukasChristel — fix hash computation for uncached NuGet packages (#​1099).
• @​michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#​1110).
• @​mtsfoni — dependency range resolution fix and regression coverage (#​1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)