Skip to content

[WIP] CycloneDX v2.0 Specification - #652

Draft
stevespringett wants to merge 158 commits into
masterfrom
2.0-dev
Draft

[WIP] CycloneDX v2.0 Specification#652
stevespringett wants to merge 158 commits into
masterfrom
2.0-dev

Conversation

@stevespringett

@stevespringett stevespringett commented Jun 15, 2025

Copy link
Copy Markdown
Member

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2


BREAKING Changes

  • Drop schema for XML.
    To be explained further.
  • Drop schema for Protocol Buffers
    Reasoning: Downstream spec users may build ontop of JSON schema.
    To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...


Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett stevespringett added this to the 2.0 milestone Jun 15, 2025
@stevespringett stevespringett self-assigned this Jun 15, 2025
@stevespringett stevespringett added the CDX 2.0 related to release v2.0 label Jun 15, 2025
@stevespringett stevespringett linked an issue Jun 15, 2025 that may be closed by this pull request
@jkowalleck jkowalleck changed the title CycloneDX v2.0 Specification [WIP] CycloneDX v2.0 Specification Jun 16, 2025
Comment thread .github/workflows/bundle-schema.yml Fixed
Signed-off-by: Steve Springett <steve@springett.us>
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
stevespringett and others added 7 commits November 11, 2025 17:20
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
stevespringett and others added 6 commits November 24, 2025 15:57
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
jkowalleck and others added 3 commits July 29, 2026 19:44
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
test scripts were split between CycloneDX v1.x and v2.x
(v2 tests do not exist, yet)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck

This comment was marked as outdated.

- [x] Java tests - functional
- [x] JS tests - functional - WIP
- found some false-positives/false-negatives - due to errors in test
resources
- [x] JS tests - schema validate
  - includes #996
  - includes #992
- JS tests - semantics
  - [x] #998
  - [x] #995
- [x] PHP tests - functional

added tests only,
no schema/res fixes - they are prepared in 
- #997 
- #1001

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck and others added 3 commits August 4, 2026 18:13
merge latest master and fix conflicts


caused by
#652 (comment)
---- 

there are currently some conflicts in the `.github/workflows/*` 
```text
This branch has conflicts that must be resolved

Use the command line to resolve conflicts before continuing.

    .github/workflows/bundle_2.0_schemas.yml
    .github/workflows/test_java.yml
    .github/workflows/test_js.yml
    .github/workflows/test_php.yml
    .github/workflows/test_proto.yml
    docgen/json/templates/cyclonedx/base.html
    docgen/json/templates/cyclonedx/section_properties.html
    docgen/proto/templates/html.tmpl
    docgen/xml/xs3p.xsl
    tools/src/test/js/json-schema-functional-tests.js
    tools/src/test/js/json-schema-lint-tests.js
```


i will sort this out soon.
basically this is a file being moved in our(`2.0-dev`) branch, and a
dependabot updating an action in their's(`master`) branch.
similar with tests and QA tools ... 

but i have no idea what to do with the docs - i guess we use "ours"?

---------

Signed-off-by: wievdndr <wiebe.vandendriessche@ugent.be>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: wievdndr <wiebe.vandendriessche@ugent.be>
Co-authored-by: Wiebe Vandendriessche <146532897+wiebe-vandendriessche@users.noreply.github.com>
Co-authored-by: Basil Hess <bhe@zurich.ibm.com>
Co-authored-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Co-authored-by: Steve Springett <steve@springett.us>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Joachim Vandersmissen <git@jvdsn.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
jkowalleck and others added 20 commits August 5, 2026 07:56
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
schema tests: every enum value is present in (optional) `meta:enum`
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
- fixes #1005
- fixes #992

and yes, the bundler already ran, and the result is the same as before
:-)
even though the schema module refs were actually fixed
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

breaking-changes CDX 2.0 related to release v2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CycloneDX 2.0

6 participants