Repository navigation
[TRACKING] Complete support for CycloneDX v1.7 #903
Description
The following items are not currently supported for CycloneDX v1.7 (as of release 11.4.x):
- external components
- version ranges on components
- requires feature "external components"
- see feat: Add version_range property to Component for CycloneDX v1.7 #1032
- multiple SPDX License Expressions alongside with other licenses
- license expression details and properties
- expressing BOM distribution constraints with the Traffic Light Protocol (TLP) in metadata
- representing patent information
- properties on external-references
- citations
- detailing cryptographic transparency information
- to be continued
this library is a community effort.
if you find a feature that you need is missing, feel free to donate/contribute the missing feature.
Reacted by Hakan Dilek, Jan Kowalleck, david-isaksson-hqv and David Isaksson
Activity
feat: add support for DistributionConstraints in BOM metadata (#906)
feat: add support for properties in external references (#907)
feat: add isExternal property to Component for CycloneDX v1.7
feat: add isExternal property to Component for CycloneDX v1.7
feat: Add version_range property to Component for CycloneDX v1.7
feat: Add version_range property to Component for CycloneDX v1.7
juliosuas commentedon Nov 3, 2026
Hi @jkowalleck, I'd like to contribute citations support for CycloneDX 1.7 (model, JSON/XML serialization, schema validation tests). No open PR seems to cover it yet. Is this item free, and do you have a preferred approach before I start a draft PR?
jkowalleck commentedon Nov 6, 2026
If a thing is still free, just open a (draft) PR and i the description, mention that it fixes a part if this ticket.
Discussions will follow in that PR