Bump github.com/spdx/tools-golang from 0.5.0-rc1 to 0.5.0

[dependabot]

Bumps github.com/spdx/tools-golang from 0.5.0-rc1 to 0.5.0.

Release notes

Sourced from github.com/spdx/tools-golang's releases.

v0.5.0

This is the first release which includes a significant refactoring of this library and includes the ability to convert between SPDX document versions (2.1 - 2.3).

NOTE: This version has a major refactoring how to use the library. This is now much more streamlined. Prior to this change, it was required to import things like spdx/v2_2 and directly reference those version files. This refactoring moves usage to have a "common model", which ends up being the latest SPDX version, available at the same package across releases: github.com/spdx/tools-golang/spdx. This means when upgrading versions of tools-golang, you can always get the latest version supported by the library and support reading older versions due to the automatic conversions that the reading functions provide.

To get an idea of what is involved (it really isn't a lot of work), you can have a look at the Syft PR that upgraded to use the new interfaces: anchore/syft#1503

After upgrading to this usage pattern, subsequent updates of the tools-golang library will only require changes to your code if the latest model changes (for example, when 3.0 is implemented -- but your older 2.x files will still work fine to read in and export).

What's new

• Refactor: maintain the latest SPDX model and provide conversions from previous by @​kzantow in spdx/tools-golang#172
• Added more const for external reference to external.go by @​neilnaveen in spdx/tools-golang#188

Bug fixes

• Fixed Bug For DocumentComment by @​neilnaveen in spdx/tools-golang#185 and spdx/tools-golang#187
• Improve SPDX document validation by @​neilnaveen in spdx/tools-golang#200
• Read shortcut fields: documentDescribes and hasFiles by @​kzantow in spdx/tools-golang#201
• JSON reading/writing sets appropriate PACKAGE-MANAGER enum based on version by @​lumjjb in spdx/tools-golang#204

New Contributors

• @​jspeed-meyers made their first contribution in spdx/tools-golang#181
• @​neilnaveen made their first contribution in spdx/tools-golang#185

Full Changelog: spdx/tools-golang@v0.4.0...v0.5.0

Commits

• ee0b98b build(deps): Bump actions/setup-go from 3 to 4 (#202)
• a411a72 Merge pull request #204 from spdx/addJsonEnums
• abba8e6 JSON reading/writing appropriate external ref enum based on ver
• 3ccd09f fix: read shortcut fields: documentDescribes and hasFiles (#201)
• 76e74f6 build(deps): Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#199)
• be1c1c5 Improve SPDX document validation (#200)
• 105e17f Included fuzzing for utils (#189)
• e233b61 build(deps): Bump github.com/google/go-cmp from 0.5.7 to 0.5.9 (#193)
• 17eb3a7 build(deps): Bump actions/setup-go from 2 to 3 (#192)
• 672cc7d chore: dependabot configuration (#191)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sophiewigmore]

Closing in favour of #488

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.