Repository navigation
fix: make VulnerabilityReference arguments mandatory #790
Description
This issue is created from this thread re: #786 (comment)
It's been noticed that VulnerabilityReference class in implementation has defined the attributes id and source as optional
ref: https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/cyclonedx/model/vulnerability.py#L486...L497
but if we refer the documentation of cyclonedx
<bom:references > [0..1]
Start Sequence [0..*]
<bom:reference > [1]
<bom:id> xs:normalizedString </bom:id> [1]
<bom:source> bom:vulnerabilitySourceType </bom:source> [1]
</bom:reference> Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*] End Sequence
</bom:references>The refrences is optional but if a reference is defined id and source are mandatory, but current implementation treats these as optional
Reacted by Jan Kowalleck
Activity
jkowalleck commentedon Feb 23, 2025
[-]make VulnerabilityReference arguments are mandatory[/-][+]make VulnerabilityReference arguments mandatory[/+][-]make VulnerabilityReference arguments mandatory[/-][+]fix: make VulnerabilityReference arguments mandatory[/+]jkowalleck commentedon Feb 25, 2025
this fix will alter public API, and is therefore considered breaking change.
this is not a stoper, just a remark.
jkowalleck commentedon Feb 25, 2025
i'll be working on this
jkowalleck commentedon Feb 25, 2025
did some research.
since JSON schema was chosen as the dominant schema, the one that serves as first spec implementation,
and since XML schema was "fixed" to work same as JSON schema,
I'd consider it canon/spec that both properties were always mandatory.
fix!: `VulnerabilityReference` all props mandatory (#792)
feat!: 9.0.1 (#777)
jkowalleck commentedon Feb 26, 2025
was released via https://github.com/CycloneDX/cyclonedx-python-lib/releases/tag/v9.0.0