Repository navigation

[WIP] CycloneDX v2.0 Specification - #652

Draft

stevespringett wants to merge 451 commits into

masterfrom

2.0-dev

Draft

[WIP] CycloneDX v2.0 Specification#652
stevespringett wants to merge 451 commits into
masterfrom
2.0-dev

This pull request is big! We're only showing the most recent 250 commits

Commits on Jul 22, 2026
- Added missing quantity for device and material components
  stevespringett
  committed
  5c83b68
- Added additional test cases for quantity.
  stevespringett
  committed
  9312c82
Commits on Jul 29, 2026
- chore: mark generated
  jkowalleck
  committed
  62dee9e
- chore: mark generated
  jkowalleck
  committed
  2a86067
Commits on Aug 3, 2026
- fix: prevent refType/refLinkType from being a Bom-Link
  jkowalleck
  committed
  2c43df6
- feat: common `elementLink`
  jkowalleck
  committed
  97eec28
- refactor: use `elementLink`
  jkowalleck
  committed
  85c554d
- fix: use `elementLink` according to description
  jkowalleck
  committed
  4cdefa6
- docs
  jkowalleck
  committed
  72384fd
- refactor
  jkowalleck
  committed
  17bc865
- fix: linked elemenets
  jkowalleck
  committed
  34f1df7
- fix: linked elemenets
  jkowalleck
  committed
  1606d88
- [2.0] Tests: split schema 1.x 2.x (#999)
  jkowalleck
  authored
  e1c91b7
Commits on Aug 4, 2026
- 2.0 tests init (#1000)
  jkowalleck
  authored
  0c4b8c0
- 2.0 dev mergemaster 20260704 (#1002)
  
  authored
  de910cb
- Merge remote-tracking branch 'origin/master' into 2.0-dev_mergemaster-20260704-2
  jkowalleck
  committed
  ffae620
- 2.0 dev mergemaster 20260704 2 (#1003)
  jkowalleck
  authored
  f9a5002
- Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
  jkowalleck
  authored
  674b6a6
Commits on Aug 5, 2026
- chore: group tests by version
  jkowalleck
  committed
  854a91f
- tests: meta:enum tests
  jkowalleck
  committed
  1bd21ad
- tests: meta:enum tests (#1004)
  jkowalleck
  authored
  bb2800a
- tests: fix errorneous file output
  jkowalleck
  committed
  372efe6
- chore: tools private and gitignore
  jkowalleck
  committed
  8159643
- have schema paths
  jkowalleck
  committed
  8a32e0c
- feat: rewire excluded $ref
  jkowalleck
  committed
  94566fa
- tidy
  jkowalleck
  committed
  eb17a0b
- tidy
  jkowalleck
  committed
  915eaca
- schema fixes
  jkowalleck
  committed
  7bdca03
- tidy
  jkowalleck
  committed
  0aa32c3
- 2.0 dev bundler externals rewrite (#1006)
  jkowalleck
  authored
  3c2d065
- tests: validate bundled schema only on mainline
  jkowalleck
  committed
  ec7a40d
- tests: validate bundled schema only on mainline (#1007)
  jkowalleck
  authored
  67d3ec8
- chore: fix js test runner chain
  jkowalleck
  committed
  0bb19a1
- chore: fix schema-bundler workflow
  jkowalleck
  committed
  886366a
- chore: fix schema-bundler workflow
  jkowalleck
  committed
  93e1d82
Commits on Aug 7, 2026
- Add protocol registry to cryptography-defs
  bhess
  committed
  555294f
- Merge branch 'master' into 2.0-dev
  jkowalleck
  authored
  83c633a
- chore: editorconfir for cdx-2.0 bundled
  jkowalleck
  committed
  480a1c0
- chore: editorconfir for cdx-2.0 bundled
  jkowalleck
  committed
  724dfda
Commits on Aug 9, 2026
- Update schema/2.0/model/cyclonedx-risk-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  d9718d6
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  4109d01
- Update schema/2.0/model/cyclonedx-control-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  3ac3bea
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  217916f
- Update schema/behavior-taxonomy.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  eeb8a3f
- Update schema/2.0/model/cyclonedx-common-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  40c5873
- Update schema/2.0/model/cyclonedx-profile-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  75bb5bd
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  3e3282d
- Update schema/2.0/model/cyclonedx-weakness-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  b0e8640
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  713d4fb
- Update schema/2.0/model/cyclonedx-common-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  3dcab8a
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  906c579
Commits on Aug 10, 2026
- chore: split docs CDX1.x
  jkowalleck
  committed
  68da661
- chore: split docs CDX1.x
  jkowalleck
  committed
  c5fc0d5
- chore: split docs CDX1.x
  jkowalleck
  committed
  998df95
- chore: split docs CDX1.x
  jkowalleck
  committed
  1beae2b
- 2.0 dev split docsgen (#1017)
  jkowalleck
  authored
  6de25ce
Commits on Aug 14, 2026
- Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-vuln-evidence
  jkowalleck
  committed
  84b08a4
- revert docsgen scehma-v1 json mods
  jkowalleck
  committed
  d52129e
Commits on Aug 15, 2026
- Merge branch '2.0-dev' into chore/default-permisiosn-bundle_2.0_schemas
  jkowalleck
  authored
  fd53309
- chore: GH workflow default permissions for bundle_2.0_schemas.yml (#902)
  jkowalleck
  authored
  f692f77
Commits on Aug 18, 2026
- chore: dependabot config (#1032)
  jkowalleck
  authored
  721c601
- Removed constraint on enum.
  stevespringett
  committed
  1da95b5
Commits on Aug 20, 2026
Commits on Aug 21, 2026
- Add threat model library parity
  petra-dv
  committed
  fac5276
- chore: update test tools (#1038)
  jkowalleck
  authored
  673a118
Commits on Aug 24, 2026
Commits on Aug 25, 2026
- Extensible Property Object allow `integer`
  jkowalleck
  committed
  74e8a5e
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  32d19b0
- 2.0 dev tests default valus in range (#1044)
  jkowalleck
  authored
  e082072
- tests: check enum value constraints (#1046)
  jkowalleck
  authored
  5725251
- [2.0] linter detects enums literall "other" (#1047)
  jkowalleck
  authored
  44fb005
- linter-docs
  jkowalleck
  committed
  63294a0
- chore: GH workflow concurrency
  jkowalleck
  committed
  e600705
- Added support for GS1 Digital Link
  stevespringett
  committed
  ad035fc
- Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev
  stevespringett
  committed
  4338510
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  9be30e5
- [2.0] chema linter runs in in GH workflow (#1048)
  jkowalleck
  authored
  1a950b1
Commits on Aug 26, 2026
- chore: revisit CT and bundler
  jkowalleck
  committed
  a40ef14
- 2.0 dev remove duplicate tests (#1050)
  jkowalleck
  authored
  10f979b
- ci: linter as matrix (#1051)
  jkowalleck
  authored
  b86fe19
- linter: list with richer JSON (#1053)
  jkowalleck
  authored
  72b3734
Commits on Aug 27, 2026
- chore: CI/CT linter summary (#1055)
  jkowalleck
  authored
  0c2a413
- 2.0-dev ci linter summary download link (#1056)
  jkowalleck
  authored
  fb30595
- 2.0-dev ci linter artifact underscoped
  jkowalleck
  committed
  6ae0925
- 2.0-dev ci linter more data in result & more CI summary (#1057)
  jkowalleck
  authored
  10978a3
- linter summary fix
  jkowalleck
  committed
  9001443
- 2.0-dev ci linter rename enum-value-no-other (#1059)
  jkowalleck
  authored
  b5f7553
- [2.0] refactor: JSON schema - trip trailing spaces and add final newline (#1060)
  jkowalleck
  authored
  9065df8
- [2.0] refactor: JSON schema - fix indention (#1061)
  jkowalleck
  authored
  f1b38ce
Commits on Aug 28, 2026
- 2.0-dev ci linter check schema ID matches filepath (#1062)
  jkowalleck
  authored
  9035eb8
- docs
  jkowalleck
  committed
  9099e16
- linter checks bundled schemas (#1063)
  jkowalleck
  authored
  f429a48
- linter: no todo's (#1064)
  jkowalleck
  authored
  9228572
- Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
  jkowalleck
  authored
  6c13d40
- linter: no todo's
  jkowalleck
  committed
  e73bf57
Commits on Aug 31, 2026
- linter: refactor getEnabledChecks returns array
  jkowalleck
  committed
  ad6b143
- linter: add check ref-best-practice (#1068)
  jkowalleck
  authored
  14eea6b
- linter-docs
  jkowalleck
  committed
  3b38e2e
- 2.0 dev linter object strictness (#1069)
  jkowalleck
  authored
  1e9ca09
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  2299181
- linter: mixin fix (#1071)
  jkowalleck
  authored
  2c624a0
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  b53d6b9
- Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
  jkowalleck
  authored
  683a5d6
- 2.0 dev linter no deprecated (#1070)
  jkowalleck
  authored
  6cc5bf1
- linter_no-todos_more
  jkowalleck
  committed
  f216a9e
Commits on Sep 1, 2026
Commits on Sep 2, 2026
Commits on Sep 3, 2026
- 2.0 ci/ct: npm ci where lockfile exists (#1079)
  jkowalleck
  authored
  33a0e94
- docs: add CDX v2.0 in release history as "to be announced"
  jkowalleck
  committed
  a1c8aeb
Commits on Sep 8, 2026
- Refine threat model library parity
  petra-dv
  committed
  a481a61
Commits on Sep 9, 2026
- Split selectedBy into mechanism and selecting party
  bhess
  committed
  2e8b48a
- Document the registry join and add protocol type tests
  bhess
  committed
  0f67c4a
Commits on Sep 10, 2026
- revisit linter check for schema ref best practice (#1092)
  jkowalleck
  authored
  62eaac7
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  70393f9
- chore: linter order checks alhabetically (#1093)
  jkowalleck
  authored
  108c2e2
- add some clarification
  bhess
  committed
  c77c986
- chore: linter improv: config & comment-ckeck (#1096)
  jkowalleck
  authored
  73859c3
- tests: lint non-core schemas (#1095)
  jkowalleck
  authored
  7e16f47
- ci: less verbose (#1097)
  jkowalleck
  authored
  fb6775a
- Merge branch '2.0-dev' into bhe-protocol-registry
  jkowalleck
  authored
  ffc4845
- ci: fix lint_non-core_schemas artifact retention
  jkowalleck
  committed
  b91d157
- Merge branch '2.0-dev' into bhe-protocol-registry
  jkowalleck
  authored
  dcd8f24
Commits on Sep 14, 2026
- chore: fix liters literal other (#1105)
  jkowalleck
  authored
  ea6cb04
- refactor: const and enum shall have no type (#1104)
  jkowalleck
  authored
  32b778e
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  439d4eb
Commits on Sep 16, 2026
- Added inScope to dataset, zone, and boundary objects, as per today's working group call. The default is already true. No changes required for default.
  stevespringett
  committed
  7973584
Commits on Sep 17, 2026
- Merge remote-tracking branch 'origin/2.0-dev' into bhe-protocol-registry
  bhess
  committed
  ead821a
- Merge remote-tracking branch 'origin/master' into 2.0-dev_forward-port_1.7.2
  jkowalleck
  committed
  a179a6e
- 2.0 dev forward port 1.7.2 (#1111)
  jkowalleck
  authored
  34a3472
- Merge remote-tracking branch 'origin/master' into 2.0-dev
  jkowalleck
  committed
  a762b0a
- Added EPSS
  stevespringett
  committed
  b441fe8
- Fix linter findings and rename protocol type title
  bhess
  committed
  9f36451
Commits on Sep 18, 2026
- ci: zizmor fix ref to reusable workflows (#1114)
  jkowalleck
  authored
  90f99fe
- Created allowance for EPSS named measurements (percentile and probability) without restricting ourselves specifically to EPSS, or future scoring systems or versions of EPSS.
  stevespringett
  committed
  a859af8
Commits on Sep 21, 2026
Commits on Sep 24, 2026
- Merge branch 'master' into bhe-protocol-registry
  bhess
  committed
  c560531
- Merge branch '2.0-dev' into bhe-protocol-registry
  stevespringett
  authored
  65b5292
- CBOM: add protocol registry schema (#1010)
  stevespringett
  authored
  6362ed4
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  be4b157
Commits on Sep 30, 2026
- fix(linter): fix property order check (#1130)
  jkowalleck
  authored
  ad51902
Commits on Oct 1, 2026
- fix(linter): property order check supports optionals (#1131)
  jkowalleck
  authored
  8db6cfd
Commits on Oct 2, 2026
- bundler: add tests (#1137)
  jkowalleck
  authored
  8228262
- bundler: autodetect externals (#1138)
  jkowalleck
  authored
  39fac80
- bundler: print error
  jkowalleck
  committed
  b3841c7
- bundler: test fixtures have title, comment and description (#1139)
  jkowalleck
  authored
  b86d93b
Commits on Oct 5, 2026
- refactor: rename `model` -> `module` (#1129)
  jkowalleck
  authored
  1a3f959
- feat: safety impact of changes on classified contexts (#954, #1041)
  
  stevespringett
  authored and
  jkowalleck
  committed
  ba042b4
- feat: damage scenarios and impact methodology (ISO/SAE 21434, RDX alignment). Added test cases.
  
  stevespringett
  authored and
  jkowalleck
  committed
  d617426
- refactor: align threat and risk models with ISO 31000, ISO/SAE 21434, and ISO 26262
  
  stevespringett
  authored and
  jkowalleck
  committed
  7312c7f
- Added EPSS
  
  stevespringett
  authored and
  jkowalleck
  committed
  4d7182e
- Created allowance for EPSS named measurements (percentile and probability) without restricting ourselves specifically to EPSS, or future scoring systems or versions of EPSS.
  
  stevespringett
  authored and
  jkowalleck
  committed
  4dab872
- tests: cleanup semantic tests (#1144)
  jkowalleck
  authored
  7a3ab08
- formulation environmentVars as key-value
  jkowalleck
  committed
  447a3c3
- tests
  jkowalleck
  committed
  fcecec1
- examples
  jkowalleck
  committed
  63877f3
- docs
  jkowalleck
  committed
  cd9331b
- docs
  jkowalleck
  committed
  e5750dd
- docs
  jkowalleck
  committed
  6a20ed0
- remarks on name and no constraints, added examples
  jkowalleck
  committed
  acdb844
Commits on Oct 7, 2026
- Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-product-inventory
  stevespringett
  committed
  73320bf
- Update schema/2.0/modules/cyclonedx-certification-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  ff232f6
- Update schema/2.0/modules/cyclonedx-common-2.0.schema.json
  
  stevespringett
  and
  jkowalleck
  authored
  e98c96d
- Corrected merge issue
  stevespringett
  committed
  0407e3c
- Corrected bundler issue
  stevespringett
  committed
  09c31d0
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  f6dcf4d
- Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-product-inventory
  stevespringett
  committed
  2dbfb07
Commits on Oct 12, 2026
- Merge remote-tracking branch 'origin/master' into 2.0-dev
  jkowalleck
  committed
  762e4b7
Commits on Oct 13, 2026
- chore: GH conditions
  jkowalleck
  committed
  989d158
- fix: add label to persona and system party identities
  stevespringett
  committed
  d092de2
- fix: add label to persona and system party identities (#1156)
  stevespringett
  authored
  b5641a3
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  81d8c3f
- Merge branch '2.0-dev' into 2.0-dev-product-inventory
  stevespringett
  authored
  3173d76
- Reverting defect fix
  stevespringett
  committed
  baa6e81
- Fixing mediatype defect in regex pattern
  stevespringett
  committed
  81359be
- Fixing mediatype defect in regex pattern (#1158)
  stevespringett
  authored
  f43b077
- chore: update bundled schemas [skip ci]
  github-actions[bot]
  committed
  7fa1f29
Commits on Oct 14, 2026
Commits on Oct 15, 2026
- [2.0] bundler rewrite (#1146)
  
  jkowalleck
  and
  github-actions[bot]
  authored
  4339678
- Merge branch '2.0-dev' into 2.0-dev-product-inventory
  jkowalleck
  authored
  104bb4a
- Fixing unit tests and putting back item that was omitted during prior merge.
  stevespringett
  committed
  8709e87
- Inventory refactor and definitions registry (#1075)
  stevespringett
  authored
  8b1fa66
- chore: update bundled schemas
  github-actions[bot]
  committed
  e880981
- Merge branch '2.0-dev' into 2.0-dev_revisit-workflows
  stevespringett
  authored
  c055eaf
- formulation environmentVars as system-independent key-value (#1088)
  stevespringett
  authored
  4c68902
- chore: update bundled schemas
  github-actions[bot]
  committed
  f8fcbee
- Merge branch '2.0-dev' into 2.0-dev-threatmodeling-library-parity
  stevespringett
  authored
  e259a95
- feat: Add OWASP Threat Model Library parity (#1034)
  stevespringett
  authored
  d3a045d
- chore: update bundled schemas
  github-actions[bot]
  committed
  ae0d684
- Merge remote-tracking branch 'origin/2.0-dev-epss' into 2.0-dev-epss
  stevespringett
  committed
  f16cfef
- Apply suggestion from @jkowalleck
  
  stevespringett
  and
  jkowalleck
  authored
  754cb59
- Minor corrections
  stevespringett
  committed
  5c34d1a
- Merge remote-tracking branch 'origin/2.0-dev-epss' into 2.0-dev-epss
  stevespringett
  committed
  c862476
- Merge branch '2.0-dev' into 2.0-dev-epss
  stevespringett
  authored
  7cafa43
- Add EPSS and other scoring systems that leverage measurements rather than scores. (#1117)
  stevespringett
  authored
  e8869cf
- chore: update bundled schemas
  github-actions[bot]
  committed
  6bdc06a
- Merge branch '2.0-dev' into 2.0-dev-safety
  stevespringett
  authored
  b6fd250
- Merge remote-tracking branch 'origin/2.0-dev-safety' into 2.0-dev-safety
  stevespringett
  committed
  6e01384
- Aligned test cases to match recent changes in main.
  stevespringett
  committed
  fd6ea25
- Added RDX risk alignment. Add safety. Minor refactor (#1120)
  stevespringett
  authored
  7272b6c
- chore: update bundled schemas
  github-actions[bot]
  committed
  b316d3c

Commits

Commits on Jul 22, 2026

Commits on Jul 29, 2026

Commits on Aug 3, 2026

Commits on Aug 4, 2026

Commits on Aug 5, 2026

Commits on Aug 7, 2026

Commits on Aug 9, 2026

Commits on Aug 10, 2026

Commits on Aug 14, 2026

Commits on Aug 15, 2026

Commits on Aug 18, 2026

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Commits on Aug 27, 2026

Commits on Aug 28, 2026

Commits on Aug 31, 2026