Question on Relationship/to cardinality

[davaya]

This may not be an issue, but just for completeness, on May 5 #293 changed the Relationship "to" property from required to optional, to address issue #129.

VulnAssessmentRelationship requires a "to" property and so restricts it back to required.

The class inheritance tree is:

Subclass tree:
                       Package: [AIPackage, Dataset]
                              : [PresenceType, SafetyRiskAssessmentType, CreationInfo, DictionaryEntry, ExternalIdentifier, IntegrityMethod, AnnotationType, ExternalIdentifierType, ExternalReferenceType, HashAlgorithm, LifecycleScopeType, ProfileIdentifierType, RelationshipCompleteness, RelationshipType, ConfidentialityLevelType, DatasetAvailabilityType, DatasetType, ExploitCatalogType, SsvcDecisionType, VexJustificationType, DependencyConditionalityType, SbomType, SoftwareDependencyLinkType, SoftwarePurpose, String, Integer]
                       Element: [Build, Agent, Annotation, Artifact, ElementCollection, Relationship, Tool, LicenseAddition, Vulnerability, AnyLicenseInfo, SimpleLicensingText]
                        Bundle: [Bom, SpdxDocument]
             ElementCollection: [Bundle]
                          none: [Element, ExternalMap, ExternalReference, PositiveIntegerRange]
               IntegrityMethod: [Hash]
                  Relationship: [LifecycleScopedRelationship, VulnAssessmentRelationship]
                         Agent: [Organization, Person, SoftwareAgent]
                    xsd:string: [DateTime, MediaType, SemVer]
                AnyLicenseInfo: [ConjunctiveLicenseSet, DisjunctiveLicenseSet, ExtendableLicense, WithAdditionOperator, LicenseExpression]
                       License: [CustomLicense, ListedLicense]
               LicenseAddition: [CustomLicenseAddition, ListedLicenseException]
             ExtendableLicense: [License, OrLaterOperator]
    VulnAssessmentRelationship: [CvssV2VulnAssessmentRelationship, CvssV3VulnAssessmentRelationship, EpssVulnAssessmentRelationship, ExploitCatalogVulnAssessmentRelationship, SsvcVulnAssessmentRelationship, VexVulnAssessmentRelationship]
 VexVulnAssessmentRelationship: [VexAffectedVulnAssessmentRelationship, VexFixedVulnAssessmentRelationship, VexNotAffectedVulnAssessmentRelationship, VexUnderInvestigationVulnAssessmentRelationship]
              SoftwareArtifact: [File, Package, Snippet]
                           Bom: [Sbom]
                      Artifact: [SoftwareArtifact]
   LifecycleScopedRelationship: [SoftwareDependencyRelationship]
                        String: [AnyUri]

indicating that the only other Relationship classes are LifecycleScopedRelationship and SoftwareDependencyRelationship.

If either of these two classes require a "to" field, they should also restrict it like Security does. If they don't, everything is fine.

[goneall]

Since these may be used to express "known unknowns", the to will be optional. Closing this issue.

Thanks @davaya for verifying this.