Skip to content

Releases: CycloneDX/cyclonedx-go

v0.9.2

13 Dec 14:43
cba06ff
Compare
Choose a tag to compare

Changelog

Features

Fixes

Building and Packaging

Others

v0.9.1

14 Sep 10:46
02759af
Compare
Choose a tag to compare

Changelog

Fixes

Building and Packaging

v0.9.0

04 Jun 17:40
98a070d
Compare
Choose a tag to compare

Changelog

Features

Fixes

Building and Packaging

  • ec6291e: build(deps): bump actions/checkout from 4.1.1 to 4.1.5 (@dependabot[bot])
  • 899fe39: build(deps): bump actions/checkout from 4.1.5 to 4.1.6 (@dependabot[bot])
  • 8674ed5: build(deps): bump actions/setup-go from 5.0.0 to 5.0.1 (@dependabot[bot])
  • db3a114: build(deps): bump apache/skywalking-eyes from 0.4.0 to 0.6.0 (@dependabot[bot])
  • a3bd055: build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (@dependabot[bot])
  • 1179dd9: build(deps): bump gitpod/workspace-go from 8b9a0f6 to 8d15123 (@dependabot[bot])
  • d98494e: build(deps): bump gitpod/workspace-go from 9118b93 to 8b9a0f6 (@dependabot[bot])
  • 1e2a3a0: build(deps): bump gitpod/workspace-go from 94ae638 to 9118b93 (@dependabot[bot])
  • d4d6e35: build(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (@dependabot[bot])
  • 521d1ce: build(deps): bump golangci/golangci-lint-action from 4.0.0 to 6.0.1 (@dependabot[bot])
  • f1ebafe: build(deps): bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (@dependabot[bot])

Others

v0.8.0

10 Dec 16:00
b9654ae
Compare
Choose a tag to compare

This release ships with almost complete support for v1.5 of the CycloneDX specification.

The only exception being the extended data flow support, as used in SaaS BOMs.

Unfortunately, there are also breaking changes in this release:

  • The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
    • ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
    • The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
    • During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
    • When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
    • It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.

Changelog

Fixes

  • 64eb0c8: fix: remove format linters that require extra tooling (@nscuro)

Building and Packaging

Others

  • 61dd91e: feat(spec1-5): add support for machine learning (@nscuro)
  • f831960: feat(spec1-5): update valid-vulnerability test snapshots (@nscuro)
  • ffc9a4e: ci: enable more linters (@mmorel-35)
  • 3feda75: feat(spec1-5): add additional external reference types (@nscuro)
  • bd66a36: feat(spec1-5): add support for CVSSv4 scoring method (@nscuro)
  • d597bb9: feat(spec1-5): add support for firstIssued and lastUpdated in vuln analysis (@nscuro)
  • 2ae5445: feat(spec1-5): add support for additional compositions and composition identity (@nscuro)
  • f856daa: feat(spec1-5): add support for formulation (@nscuro)
  • 2fbde0e: feat(spec1-5): add support for identity, occurrences, and callstack evidence (@nscuro)
  • 745a35a: feat(spec1-5): add support for licensing (@nscuro)
  • b02255f: feat(spec1-5): add support for lifecycles (@nscuro)
  • fe3a904: feat(spec1-5): add support for ssvc scoring method (@nscuro)
  • 7d2713f: feat(spec1-5): add support for vulnerability proof of concept (@nscuro)
  • 25b250a: feat(spec1-5): add support for vulnerability rejected timestamps (@nscuro)
  • c7a84ac: feat(spec1-5): handle deprecation of tools (@nscuro)

v0.7.2

23 Aug 17:13
83031d6
Compare
Choose a tag to compare

This is a bugfix release that ships with minimal support for the CycloneDX v1.5 specification.

Full support is being worked on and planned to be released soon. The progress may be tracked in #90.

The reason for publishing partial support like this is to allow the consumption of v1.5 BOMs, which fails with cyclonedx-go <= v0.7.1.

Warning
The default SpecVersion has been updated to SpecVersion1_5. If your application generates BOMs, and you're not ready (or willing) to distribute BOMs following the v1.5 specification yet, consider using EncodeVersion to generate output for an older version of the spec.

Changelog

Features

Fixes

Building and Packaging

  • 966c223: build(deps): bump CycloneDX/gh-gomod-generate-sbom from 1.1.0 to 2.0.0 (@dependabot[bot])
  • 1e83e85: build(deps): bump actions/checkout from 3.5.0 to 3.5.1 (@dependabot[bot])
  • 78f6593: build(deps): bump actions/checkout from 3.5.1 to 3.5.2 (@dependabot[bot])
  • 868f6db: build(deps): bump actions/checkout from 3.5.2 to 3.5.3 (@dependabot[bot])
  • 5885827: build(deps): bump actions/setup-go from 4.0.0 to 4.0.1 (@dependabot[bot])
  • d772b54: build(deps): bump actions/setup-go from 4.0.1 to 4.1.0 (@dependabot[bot])
  • 578e862: build(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 (@dependabot[bot])
  • f83e6a7: build(deps): bump gitpod/workspace-go from 2be827f to 910daeb (@dependabot[bot])
  • cd7b23a: build(deps): bump gitpod/workspace-go from 910daeb to d7a41f5 (@dependabot[bot])
  • 668553d: build(deps): bump gitpod/workspace-go from d7a41f5 to f37c673 (@dependabot[bot])
  • d9a5f8c: build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 (@dependabot[bot])
  • 66f96df: build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 (@dependabot[bot])
  • 8b51c39: build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (@dependabot[bot])
  • e44f7de: build(deps): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 (@dependabot[bot])
  • 6360fe1: build(deps): bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (@dependabot[bot])

Others

v0.7.1

31 Mar 16:55
b1105ec
Compare
Choose a tag to compare

Changelog

Features

Fixes

Building and Packaging

Others

v0.7.0

28 Sep 22:05
39a1d8f
Compare
Choose a tag to compare

Changelog

Features

Fixes

Building and Packaging

  • f43660c: build(deps): bump actions/setup-go from 3.1.0 to 3.2.0 (@dependabot[bot])
  • 2458312: build(deps): bump actions/setup-go from 3.2.0 to 3.2.1 (@dependabot[bot])
  • 760fae3: build(deps): bump actions/setup-go from 3.2.1 to 3.3.0 (@dependabot[bot])
  • 4dddf51: build(deps): bump apache/skywalking-eyes from 0.3.0 to 0.4.0 (@dependabot[bot])
  • 6eb6521: build(deps): bump github.com/bradleyjkemp/cupaloy/v2 from 2.7.0 to 2.8.0 (@dependabot[bot])
  • bff00ef: build(deps): bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (@dependabot[bot])
  • fc11b56: build(deps): bump github.com/stretchr/testify from 1.7.2 to 1.7.4 (@dependabot[bot])
  • f521d75: build(deps): bump github.com/stretchr/testify from 1.7.4 to 1.7.5 (@dependabot[bot])
  • d5d1ab6: build(deps): bump github.com/stretchr/testify from 1.7.5 to 1.8.0 (@dependabot[bot])
  • b83bbe8: build(deps): bump goreleaser/goreleaser-action from 2 to 3 (@dependabot[bot])

Documentation

Others

  • 5f10aea: refactor: refine spec version conversion to cover more cases (@nscuro)
  • 0c2ebff: refactor: separate custom marshalling logic from model (@nscuro)

v0.6.0

20 May 15:13
7d9a561
Compare
Choose a tag to compare

Changelog

Features

Fixes

Building and Packaging

v0.5.2

27 Apr 13:41
2de8eaf
Compare
Choose a tag to compare

Changelog

Fixes

Building and Packaging

v0.5.1

19 Mar 12:55
404f9a3
Compare
Choose a tag to compare

Changelog

Fixes

Building and Packaging