cyclonedx/cyclonedx-library

Added

• Support CycloneDX 1.7.1 (#633 via #634)
• Support CycloneDX 1.6.2 (via #634)
• Support CycloneDX 1.5.1 (via #634)
• Pulled SPDX license IDs v1.1-3.28.0 (#607 via #635)

What's Changed

• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.94.0 to 3.94.2 in /tools/php-cs-fixer by @dependabot[bot] in #606
• docs: summarize CDX by @jkowalleck in #610
• Update commit command for signed-off commits by @jkowalleck in #613
• Delete .github/FUNDING.yml by @jkowalleck in #614
• chore(ci): pin GitHub Action references to immutable SHAs while preserving tag tracking by @Copilot in #618
• tools(deps-dev): Update vimeo/psalm requirement from 6.15.1 to 6.16.1 in /tools/psalm by @dependabot[bot] in #611
• Clarify issue resolution instructions in PR template by @jkowalleck in #627
• Update CONTRIBUTING.md by @jkowalleck in #628
• feat: add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1 by @jkowalleck in #634
• gh-actions(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.1 by @dependabot[bot] in #623
• gh-actions(deps): Bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #624
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.50.0 to 2.52.0 in /tools/composer-normalize by @dependabot[bot] in #629
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.94.2 to 3.95.3 in /tools/php-cs-fixer by @dependabot[bot] in #632
• gh-actions(deps): Bump softprops/action-gh-release from 2.6.2 to 3.0.0 by @dependabot[bot] in #619
• gh-actions(deps): Bump shivammathur/setup-php from 728c6c6b8cf02c2e48117716a91ee48313958a19 to v2.37.1 by @dependabot[bot] in #621
• Pulled SPDX license IDs v1.1-3.28.0 by @jkowalleck in #635
• chore: prep v4.1.0 by @jkowalleck in #636

New Contributors

• @Copilot made their first contribution in #618

Full Changelog: v4.0.0...v4.1.0

• Added
  • Support CycloneDX 1.7.1 (#633 via #634)
  • Support CycloneDX 1.6.2 (via #634)
  • Support CycloneDX 1.5.1 (via #634)
  • Pulled SPDX license IDs v1.1-3.28.0 (#607 via #635)

⚠️ BREAKING changes

• Removed deprecated symbols
• Changed constructor of CycloneDX\Contrib\License\Factories\LicenseFactory
• Changed dependencies

Removed

• Class CycloneDX\Core\Factories\LicenseFactory (#571 via #587)
  Use CycloneDX\Contrib\License\Factories\LicenseFactory instead.
• Class CycloneDX\Core\Utils\BomUtility (#571 via #587)
  Use CycloneDX\Contrib\Bom\Utils\BomUtils instead.
• Method CycloneDX\Core\Validation\BaseValidator::getSpec() (#590 via #591)

Changed

• CycloneDX\Contrib\License\Factories\LicenseFactory::__construct() parameters are no longer autopopulated (#571 via #587)
  Downstream implementations have to populate the parameters on their own, now.
• CycloneDX\Core\Models\Component::setPackageUrl() accepts ?string (#571 via #588)
  Downstream implementations may use package-url/packageurl-php for generation.
• CycloneDX\Core\Models\Component::getPackageUrl() returns ?string (#571 via #588)
  Downstream implementations may use package-url/packageurl-php for parsing.
• CycloneDX\Core\Validation\BaseValidator::__construct() parameter is type CycloneDX\Core\Spec\Version (#590 via #591)
  Was internal type CycloneDX\Core\Spec\_SpecProtocol.

Dependencies

• No longer depends on, but suggests composer/spdx-licenses:^1.5 (#571 via #587)
  May be used when utilizing CycloneDX\Contrib\License\Factories\LicenseFactory.
• No longer depend on, but suggests package-url/packageurl-php (#571 via #588)
  May be used for parsing and crafting PackageURL strings downstream.

What's Changed

• BC: removed deprecated symbols by @jkowalleck in #587
• BC: PackageUrl as string by @jkowalleck in #588
• Feat/base validator store version by @jkowalleck in #591
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.92.3 to 3.92.5 in /tools/php-cs-fixer by @dependabot[bot] in #592
• chore(deps): bump phpunit for github.com/advisories/GHSA-vvj3-c3rp-c85p by @jkowalleck in #598
• tools(deps-dev): Update vimeo/psalm requirement from 6.14.3 to 6.15.0 in /tools/psalm by @dependabot[bot] in #595
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.5 to 0.9.6 in /tools/composer-unused by @dependabot[bot] in #596
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.48.2 to 2.49.0 in /tools/composer-normalize by @dependabot[bot] in #599
• BC: v4.0.0 by @jkowalleck in #589
• chore: prep v4.0.0 by @jkowalleck in #604
• tools(deps-dev): Update vimeo/psalm requirement from 6.15.0 to 6.15.1 in /tools/psalm by @dependabot[bot] in #602
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.49.0 to 2.50.0 in /tools/composer-normalize by @dependabot[bot] in #601
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.92.5 to 3.94.0 in /tools/php-cs-fixer by @dependabot[bot] in #600
• docs: hint for parsing PURL by @jkowalleck in #605

Full Changelog: v3.10.0...v4.0.0

• BREAKING changes
  • Removed deprecated symbols
  • Changed constructor of CycloneDX\Contrib\License\Factories\LicenseFactory
  • Changed dependencies
• Removed
  • Class CycloneDX\Core\Factories\LicenseFactory (#571 via #587)
    Use CycloneDX\Contrib\License\Factories\LicenseFactory instead.
  • Class CycloneDX\Core\Utils\BomUtility (#571 via #587)
    Use CycloneDX\Contrib\Bom\Utils\BomUtils instead.
  • Method CycloneDX\Core\Validation\BaseValidator::getSpec() (#590 via #591)
• Changed
  • CycloneDX\Contrib\License\Factories\LicenseFactory::__construct() parameters are no longer autopopulated (#571 via #587)
    Downstream implementations have to populate the parameters on their own, now.
  • CycloneDX\Core\Models\Component::setPackageUrl() accepts ?string (#571 via #588)
    Downstream implementations may use package-url/packageurl-php for generation.
  • CycloneDX\Core\Models\Component::getPackageUrl() returns ?string (#571 via #588)
    Downstream implementations may use package-url/packageurl-php for parsing.
  • CycloneDX\Core\Validation\BaseValidator::__construct() parameter is type CycloneDX\Core\Spec\Version (#590 via #591)
    Was internal type CycloneDX\Core\Spec\_SpecProtocol.
• Dependencies
  • No longer depends on, but suggests composer/spdx-licenses:^1.5 (#571 via #587)
    May be used when utilizing CycloneDX\Contrib\License\Factories\LicenseFactory.
  • No longer depend on, but suggests package-url/packageurl-php (#571 via #588)
    May be used for parsing and crafting PackageURL strings downstream.
• Style
  • Applied latest PHP Coding Standards (via #600)

tests

Signed-off-by: Jan Kowalleck <[email protected]>

normalize

Signed-off-by: Jan Kowalleck <[email protected]>

Added

• Officially support PHP 8.5 (#566 via #574)

What's Changed

• docs: modernize RTD setup by @jkowalleck in #575
• docs: modernize RTD setup by @jkowalleck in #576
• gh-actions(deps): Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #578
• gh-actions(deps): Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #579
• gh-actions(deps): Bump actions/cache from 4 to 5 by @dependabot[bot] in #581
• chore: PR template by @jkowalleck in #585
• tools(deps-dev): Update vimeo/psalm requirement from 6.13.1 to 6.14.3 in /tools/psalm by @dependabot[bot] in #584
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.91.0 to 3.92.3 in /tools/php-cs-fixer by @dependabot[bot] in #583
• feat: support php 8.5 by @jkowalleck in #574
• chore: prep v3.10.0 by @jkowalleck in #586

Full Changelog: v3.9.0...v3.10.0

• Added
  • Officially support PHP 8.5 (#566 via #574)

Added

• new Entry point \CycloneDX\Contrib (via #569)

Changed

• Moved non‑standard implementations to Contrib area (#571 via #569)

Deprecated

• Certain exports have been deprecated; downstream imports should be updated to the new locations (#571 via #569)
  Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.

Refactored

• The following symbols were moved (#571 via #569)
  The symbols are still import-able through their old location.
  • OLD -> NEW
  • \CycloneDX\Core\Factories\LicenseFactory -> \CycloneDX\Contrib\License\Factories\LicenseFactory
  • \CycloneDX\Core\Utils\BomUtility -> \CycloneDX\Contrib\Bom\Utils\BomUtils

What's Changed

• docs: examples for CDX 1.7 by @jkowalleck in #561
• gh-actions(deps): Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #562
• gh-actions(deps): Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #563
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.88.2 to 3.89.1 in /tools/php-cs-fixer by @dependabot[bot] in #564
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.89.1 to 3.89.2 in /tools/php-cs-fixer by @dependabot[bot] in #565
• gh-actions(deps): Bump actions/checkout from 5 to 6 by @dependabot[bot] in #567
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.89.2 to 3.91.0 in /tools/php-cs-fixer by @dependabot[bot] in #570
• docs: use phpdocumentor 3.9.1 by @jkowalleck in #572
• feat: prepare "contrib" area by @jkowalleck in #569
• chore: prep v3.9.0 by @jkowalleck in #573

Full Changelog: v3.8.0...v3.9.0

• Added
  • new Entry point \CycloneDX\Contrib (via #569)
• Changed
  • Moved non‑standard implementations to Contrib area (#571 via #569)
• Deprecated
  • Certain exports have been deprecated; downstream imports should be updated to the new locations (#571 via #569)
    Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.
• Refactored
  • The following symbols were moved (#571 via #569)
    The symbols are still import-able through their old location.
    • OLD -> NEW
    • \CycloneDX\Core\Factories\LicenseFactory -> \CycloneDX\Contrib\License\Factories\LicenseFactory
    • \CycloneDX\Core\Utils\BomUtility -> \CycloneDX\Contrib\Bom\Utils\BomUtils

Added

• Support CycloneDX 1.7 (#558 via #559)

What's Changed

• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.48.1 to 2.48.2 in /tools/composer-normalize by @dependabot[bot] in #555
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.87.1 to 3.87.2 in /tools/php-cs-fixer by @dependabot[bot] in #554
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.4 to 0.9.5 in /tools/composer-unused by @dependabot[bot] in #557
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.87.2 to 3.88.2 in /tools/php-cs-fixer by @dependabot[bot] in #556
• feat: basic support for CycloneDX 1.7 by @jkowalleck in #559
• chore: prep v3.8.0 by @jkowalleck in #560

Full Changelog: v3.7.0...v3.8.0

• Added
  • Support CycloneDX 1.7 (#558 via #559)

Added

• Pulled SPDX license IDs v1.0-3.27.0 (via #553)

What's Changed

• tools(deps-dev): Update vimeo/psalm requirement from 6.12.0 to 6.12.1 in /tools/psalm by @dependabot[bot] in #538
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.75.0 to 3.76.0 in /tools/php-cs-fixer by @dependabot[bot] in #539
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.76.0 to 3.82.2 in /tools/php-cs-fixer by @dependabot[bot] in #540
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.82.2 to 3.84.0 in /tools/php-cs-fixer by @dependabot[bot] in #541
• tools(deps-dev): Update vimeo/psalm requirement from 6.12.1 to 6.13.0 in /tools/psalm by @dependabot[bot] in #542
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.84.0 to 3.85.1 in /tools/php-cs-fixer by @dependabot[bot] in #543
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.3 to 0.9.4 in /tools/composer-unused by @dependabot[bot] in #544
• tools(deps-dev): Update vimeo/psalm requirement from 6.13.0 to 6.13.1 in /tools/psalm by @dependabot[bot] in #546
• gh-actions(deps): Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #547
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.85.1 to 3.86.0 in /tools/php-cs-fixer by @dependabot[bot] in #549
• gh-actions(deps): Bump actions/checkout from 4 to 5 by @dependabot[bot] in #548
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.47.0 to 2.48.1 in /tools/composer-normalize by @dependabot[bot] in #550
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.86.0 to 3.87.1 in /tools/php-cs-fixer by @dependabot[bot] in #551
• feat: Updating SPDX license list to 3.27.0 by @jkowalleck in #553

Full Changelog: v3.6.0...v3.7.0

• Added
  • Pulled SPDX license IDs v1.0-3.27.0 (via #553)

Added

• Pulled SPDX license IDs v1.0-3.26.0 (via #537)

What's Changed

• tools(deps-dev): Update vimeo/psalm requirement from 6.10.3 to 6.11.0 in /tools/psalm by @dependabot in #535
• tools(deps-dev): Update vimeo/psalm requirement from 6.11.0 to 6.12.0 in /tools/psalm by @dependabot in #536
• feat: Pulled SPDX license IDs v1.0-3.26.0 by @jkowalleck in #537

Full Changelog: v3.5.4...v3.6.0

• Added
  • Pulled SPDX license IDs v1.0-3.26.0 (via #537)

Maintenance release.

What's Changed

• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.69.0 to 3.69.1 in /tools/php-cs-fixer by @dependabot in #510
• tools(deps-dev): Update vimeo/psalm requirement from 6.7.1 to 6.8.6 in /tools/psalm by @dependabot in #511
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.6 to 6.8.8 in /tools/psalm by @dependabot in #512
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.69.1 to 3.70.0 in /tools/php-cs-fixer by @dependabot in #513
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.70.0 to 3.71.0 in /tools/php-cs-fixer by @dependabot in #514
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.8.11 to 0.9.0 in /tools/composer-unused by @dependabot in #516
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.71.0 to 3.72.0 in /tools/php-cs-fixer by @dependabot in #517
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.8 to 6.8.9 in /tools/psalm by @dependabot in #518
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.72.0 to 3.73.1 in /tools/php-cs-fixer by @dependabot in #521
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.9 to 6.9.4 in /tools/psalm by @dependabot in #520
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.0 to 0.9.2 in /tools/composer-unused by @dependabot in #519
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.73.1 to 3.74.0 in /tools/php-cs-fixer by @dependabot in #523
• docs: lib note by @jkowalleck in #524
• tools(deps-dev): Update vimeo/psalm requirement from 6.9.4 to 6.9.6 in /tools/psalm by @dependabot in #522
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.74.0 to 3.75.0 in /tools/php-cs-fixer by @dependabot in #526
• tools(deps-dev): Update vimeo/psalm requirement from 6.9.6 to 6.10.0 in /tools/psalm by @dependabot in #525
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.45.0 to 2.46.0 in /tools/composer-normalize by @dependabot in #527
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.46.0 to 2.47.0 in /tools/composer-normalize by @dependabot in #528
• tools(deps-dev): Update vimeo/psalm requirement from 6.10.0 to 6.10.1 in /tools/psalm by @dependabot in #529
• tools(deps-dev): Update vimeo/psalm requirement from 6.10.1 to 6.10.3 in /tools/psalm by @dependabot in #530
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.2 to 0.9.3 in /tools/composer-unused by @dependabot in #531
• chore: GH workflow permissions by @jkowalleck in #532
• chore: release via softprops action by @jkowalleck in #534

Full Changelog: v3.5.3...v3.5.4

Maintenance release.

• Added
  • Officially support PHP 8.4 (#464 via #488)
• Misc
  • AddedOverride markers where needed (via #508)
    See also: https://wiki.php.net/rfc/marking_overriden_methods

• Style
  • Applied latest PHP Coding Standards (via #495)
• Misc
  • Various refactors

• Docs
  • Fixed the documentations of the \CycloneDX\Core\Enums classes (via #490)
• Style
  • Applied latest PHP Coding Standards (via #485)

• Added
  • Support CycloneDX 1.6.1 (#483 via #484)

• Fixed
  • Encode quotation mark in URLs (via #477)

• Docs
  • Fixed typos in DocBlocks (via #466)
• Style
  • Applied latest PHP Coding Standards (via #465)
• Misc
  • Fetched latest schema definition files for offline usage (via #467)

• Changed
  • Updated SPDX license list to v3.24.0 (via #439)

• Fixed
  • JSON validator allow arbitrary $schema value (#435 via #436)

• Changed
  • Classes \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\LicenseNormalizer support license acknowledgement now (#428 via #429)
• Added
  • Namespace \CycloneDX\Core\Enums
    • New enum: LicenseAcknowledgement (#428 via #429)
  • Namespace \CycloneDX\Core\Models\License
    • New methods LicenseExpression::{get,set}Acknowledgement() (#428 via #429)
    • New methods NamedLicense::{get,set}Acknowledgement() (#428 via #429)
    • New methods SpdxLicense::{get,set}Acknowledgement() (#428 via #429)

Added basic support for CycloneDX Specification-1.6.

• Changed
  • Method \CycloneDX\Core\Spec\SpecFactory::makeForVersion() supports CycloneDX Specification-1.6 now (#421 via #422)
  • Classes \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\* support CycloneDX Specification-1.6 now (#421 via #422)
  • Classes \CycloneDX\Core\Validation\Validators\* support CycloneDX Specification-1.6 now (#421 via #422)
• Added
  • Namespace \CycloneDX\Core\Enums
    • Enum ComponentType got new cases (#421 via #422)
      New: CryptographicAsset
  • Enum ExternalReferenceType got new cases (#421 via #422)
    New: SourceDistribution, ElectronicSignature, DigitalSignature, RFC9116
  • Namespace \CycloneDX\Core\Spec
    • New method SpecFactory::make1dot6() to reflect CycloneDX Specification-1.6 (#421 via #422)
    • Enum Version got new case v1dot6 to reflect CycloneDX Specification-1.6 (#421 via #422)
• Style
  • Applied latest PHP Coding Standards (via #415)

• Documentation
  • Rendered (API) docs are hosted on readthedocs (#8 via #414)

• Style
  • Applied latest PHP Coding Standards (via #395, #398, #399, #402)

• Added
  • Migration/fixup of URL(iri-reference) when normalizing to JSON (via #380)

• Misc
  • Officially support PHP 8.3 (via #265)
  • Integration tests compare against human-readable snapshots, for regression (via #371, #372)

• Fixed
  • fixed a possible JSON schema validation issue regarding "version" property (via #352)

• BREAKING
  • Interface \CycloneDX\Core\Spec\Spec was removed from public API (#344 via #345)
    This is only a breaking change if you custom-implemented this interface downstream; internal usage is non-breaking.
    This change was necessary, so that implementing more spec-features cause no breaking changes.
• Style
  • Applied latest PHP Coding Standards (via #341)

Added support for CycloneDX Specification-1.5.

• Changed
  • Method \CycloneDX\Core\Spec\SpecFactory::makeForVersion() supports CycloneDX Specification-1.5 now (#193 via #255)
  • Classes \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\* support CycloneDX Specification-1.5 now (#193 via #255)
  • Classes \CycloneDX\Core\Validation\Validators\* support CycloneDX Specification-1.5 now (#193 via #255)
• Added
  • Namespace \CycloneDX\Core\Enums
    • Enum ComponentType got new cases (#193 via #255)
      New: Data, DeviceDriver, MachineLearningModel, Platform
    • Enum ExternalReferenceType got new cases (#193 via #255)
      New: AdversaryModel, Attestation, CertificationReport, CodifiedInfrastructure, ComponentAnalysisReport, Configuration, DistributionIntake, DynamicAnalysisReport, Evidence, ExploitabilityStatement, Formulation, Log, MaturityReport, ModelCard, POAM, PentestReport, QualityMetrics, RiskAssessment, RuntimeAnalysisReport, SecurityContact, StaticAnalysisReport, ThreatModel, VulnerabilityAssertion
  • Namespace \CycloneDX\Core\Spec
    • New method SpecFactory::make1dot5() to reflect CycloneDX Specification-1.5 (#193 via #255)
    • Enum Version got new case v1dot5 to reflect CycloneDX Specification-1.5 (#193 via #255)
• Misc
  • Added functional and integration tests for CycloneDX Specification-1.5 (#193 via #255)
  • Fetched latest stable schema definition files for offline usage (via #255)

• Changed
  • Class \CycloneDX\Core\Serialization\JsonSerializer
    • Property normalizerFactory became protected readonly, was private readonly (#305 via #306)
    • Property jsonEncodeFlags became protected readonly, was private readonly (#305 via #306)
  • Class \CycloneDX\Core\Serialization\XmlSerializer
    • Property normalizerFactory became protected readonly, was private readonly (#305 via #306)
    • Property xmlVersion became protected readonly, was private readonly (#305 via #306)
    • Property xmlEncoding became protected readonly, was private readonly (#305 via #306)
• Style
  • Applied latest PHP Coding Standards (via #302)
    Some parameters allow nullables implicitly, was explicitly.
  • Wrote some class properties with constructor promotion (via #309)

• Fixed
  • \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\LicenseRepositoryNormalizer::normalize() now omits invalid license combinations (#285 via #290)
    If there is any LicenseExpression, then this is the only license normalized; otherwise all licenses are normalized.
• Docs
  • Fixed link to CycloneDX-specification in README (via #288)

• Docs
  • Announce and annotate the generator for BOM's SerialNumber ([#277] via #282)

• Fixed
  • "Bom.serialNumber" data model can have values following the alternative format allowed in CycloneDX XML specification (#277 via #278)
  • \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\BomNormalizer::normalize() now omits invalid/unsupported values for serialNumber (#277 via #278)
• Changed
  • \CycloneDX\Core\Models\Bom::setSerialNumber() no longer throws \DomainException when the value is of an unsupported format (#277 via #278)
    This is considered a non-breaking behaviour change, because the corresponding normalizers assure valid data results.
• Added
  • Published generator for BOM's SerialNumber: \CycloneDX\Core\Utils\BomUtility::randomSerialNumber() (#277 via #278)
    The code was donated from cyclonedx-php-composer.

• BREAKING
  • Removed support for PHP v7.3 (#6 via #125)
  • Removed support for PHP v7.4 (#114 via #125)
  • Removed support for PHP v8.0 (via #204)
  • Changed models' aggregation properties to be no longer optional (#66 via #131)
  • Changed models to be less restrictive (#247 via #249)
  • Streamlined repository data structures to follow a common method naming scheme (via #131)
  • Enumeration-like classes were converted to native PHP Enumerations (#140, #256 via #204, #257)
• Added
  • Support for CycloneDX schema/spec v1.4 (#57 via #65, #118, #123)
  • Support for properties (#228 via #165, #229, #231)
• Misc
  • All class properties now enforce the correct types (#6, #114 via #125)
    This is considered a non-breaking change, because the types were already correctly annotated.
  • Migrated internals to PHP8 language features (#114 via #125)

API changes v2 - the details

• Overall
  • BREAKING: enforced the use of concrete UnionTypes instead of protocols/interfaces/abstracts (#114 via #125)
    Affected the usages of no longer public \CycloneDX\Core\Models\License\AbstractDisjunctiveLicense and methods that used license-related classes. This was possible due to PHP8's UnionType language feature.
  • Changed some methods to no longer throw \InvalidArgumentException (via #125)
    PhpDoc annotations were updated, so that code analysis tools should pick up. This was possible by enforcing correct typing on PHP8 language level.
  • BREAKING: every occurrence of {M,m}etaData with a capital "D" was renamed to {M,m}etadata with a small "d" (#133 via #131, #149)
    This affects class names, method names, variable names, property names, file names, documentation - everything.
• \CycloneDX\Core\Collections namespace
  • Added new class CopyrightRepository (#238 via #241)
  • Added new class PropertyRepository (#228 via #165)
• \CycloneDX\Core\Enum namespace
  • Classification class
    • BREAKING: renamed class to ComponentType (via #170)
    • BREAKING: became a native PHP Enumeration type (#140 via #204)
    • BREAKING: all const converted to case with UpperCamelCase naming scheme (#256 via #257)
    • BREAKING: method isValidValue() was removed (via #204)
  • ExternalReferenceType class
    • BREAKING: became a native PHP Enumeration type (#140 via #204)
    • BREAKING: all const converted to case with UpperCamelCase naming scheme (#256 via #257)
    • BREAKING: method isValidValue() was removed (via #204)
    • Added case RELEASE_NOTES to reflect CycloneDX v1.4 (#57 via #65)
  • HashAlgorithm class
    • BREAKING: became a native PHP Enumeration type (#140 via #204)
    • BREAKING: all const converted to case with UpperCamelCase naming scheme (#256 via #257)
    • BREAKING: method isValidValue() was removed (via #204)
• CycloneDX\Core\Factories namespace
  • LicenseFactory class
    • BREAKING: check whether something is a valid SPDX Expression is now complete, was best effort implementation (#247 via #249)
      This affects all methods that potentially would create LicenseExpression models.
      Utilizes composer/spdx-licenses.
    • BREAKING: changed constructor method __construct() (via #249)
    • BREAKING: removed method makeDisjunctiveFromExpression() (#163 vial #166)
    • BREAKING: removed method setSpdxLicenseValidator() (via #249)
    • BREAKING: renamed method getSpdxLicenseValidator() -> getLicenseIdentifiers() (via #249)
    • BREAKING: renamed method makeDisjunctiveWithId() -> makeSpdxLicense() (#164 vial #168)
    • BREAKING: renamed method makeDisjunctiveWithName() -> makeNamedLicense() (#164 vial #168)
    • Added new method getSpdxLicenses() (via #249)
• \CycloneDX\Core\Models namespace
  • Bom class
    • BREAKING: changed constructor to no longer accept components (#187 via #188)
    • BREAKING: renamed methods {get,set}ComponentRepository() -> {get,set}Components() (#133 via #131)
    • BREAKING: renamed methods {get,set}ExternalReferenceRepository() -> {get,set}ExternalReferences() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: renamed methods {get,set}MetaData() -> {get,set}Metadata() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • Added new methods {get,set}Properties() (#228 via #229)
    • Added new methods {get,set}SerialNumber() (via #186)
  • Component class
    • BREAKING: renamed methods {get,set}DependenciesBomRefRepository() -> {get,set}Dependencies() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: renamed methods {get,set}ExternalReferenceRepository() -> {get,set}ExternalReferences() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: renamed methods {get,set}HashRepository() -> {get,set}Hashes() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: renamed methods {get,set}License() -> {get,set}Licenses() (via #131)
      Also changed it work with class LicenseRepository only, was working with various Models\License\* types (#66 via #131)
    • BREAKING: changed class property version to be optional, to reflect CycloneDX v1.4 (#27 via #118, #131)
      This affects constructor arguments, and affects methods {get,set}Version().
    • BREAKING: changed property type to be of type \CycloneDX\Core\Enum\ComponentType (#140 via #204)
      This affects constructor arguments, and affects methods {get,set}Type().
    • Added new methods {get,set}Author() ([#184] via #185)
    • Added new methods {get,set}Copyright() (#238 via #239)
    • Added new methods {get,set}Evidence() (#238 via #241)
    • Added new methods {get,set}Properties() (#228 via #165)
  • Added new class ComponentEvidence (#238 via #241)
  • ExternalReference class
    • BREAKING: renamed methods {get,set}HashRepository() -> {get,set}Hashes() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: changed property type to be of type \CycloneDX\Core\Enum\ExternalReferenceType (#140 via #204)
      This affects constructor arguments, and affects methods {get,set}Type().
  • Licenses namespace
    • AbstractDisjunctiveLicense
      • BREAKING: removed this class (via #125, #131)
    • DisjunctiveLicenseWithName class
      • BREAKING: renamed class to NamedLicense (#164 via #168)
    • DisjunctiveLicenseWithId class
      • BREAKING: renamed class to SpdxLicense (#164 via #168)
      • BREAKING: removed factory method makeValidated() (#247 via #249) To assert valid values use \CycloneDX\Core\Factories\LicenseFactory::makeSpdxLicense().
      • Changed: constructor __construct() is public now, was private (#247 via #249)
      • Added new method setId() (#247 via #249)
    • LicenseExpression class
      • BREAKING: constructor __construct() and method setExpression() no longer do validation, but only assert that the parameter is no empty string (#247 ia #249)
        To assert valid values use \CycloneDX\Core\Factories\LicenseFactory::makeExpression().
      • BREAKING: removed method isValid() (#247 via #249)
  • MetaData class
    • BREAKING: renamed class to Metadata (#133 via #131)
      Even though PHP is case-insensitive with class names, autoloaders may be case-sensitive. Therefore, this is considered a breaking change.
    • BREAKING: changed methods {get,set}Tools() so that their parameter & return type is non-nullable, was nullable (#66 via #131)
    • Added new methods {get,set}Properties() (#228 via #165)
    • Added new methods {get,set}Timestamp() (via #180, #181)
  • Added new class Property (#228 via #165)
  • Tool class
    • BREAKING: renamed methods {get,set}ExternalReferenceRepository() -> {get,set}ExternalReferences() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
    • BREAKING: renamed methods {get,set}HashRepository() -> {get,set}Hashes() (#133 via #131)
      Also changed parameter & return type to non-nullable, was nullable (#66 via #131)
• \CycloneDX\Core\Repositories namespace
  • Overall:
    • BREAKING: renamed the namespace to \CycloneDX\Core\Collections (#133 via #131)
    • BREAKING: streamlined all classes, renamed all getters to getItems() and all setters to setItems() (#133 via #131)
      In addition, the method arguments were renamed to generic $items.
  • DisjunctiveLicenseRepository class
    • BREAKING: renamed the class to \CycloneDX\Core\Collections\LicenseRepository (via #131)
    • BREAKING: added the capability to also aggregate instances of class Models\LicenseExpression (via #131)
      Therefore, various getters and setters and the constructor changed their signatures, was usage of \CycloneDX\Core\Models\License\AbstractDisjunctiveLicense only.
  • HashRepository class
    • BREAKING: renamed to \CycloneDX\Core\Collections\HashDictionary (#133 via #131)
    • BREAKING: renamed all methods and changed all method signatures to match the overall streamlined scheme (#133 via #131)
    • BREAKING: changed all method signatures to enable handling of native PHP Enumeration type \CycloneDX\Core\Enum\HashAlgorithm (#140 via #204)
• \CycloneDX\Core\Serialize namespace
  • Overall
    • BREAKING: renamed namespace to Serialization (#5 via #146)
  • SerializerInterface interface
    • BREAKING: renamed to Serializer (#133 via #155)
    • BREAKING: method serialize() got a new optional parameter $prettyPrint (via #155)
    • BREAKING: method serialize() may throw \Throwable, was \Exception (via #253)
  • BaseSerializer abstract class
    • BREAKING: complete redesign (via #155)
  • {Json,Xml}Serializer class
    • BREAKING: complete redesign (via #155)
  • {DOM,JSON}\NormalizerFactory classes
    • BREAKING: removed method makeForLicenseExpression() (via #131)
    • BREAKING: removed method makeForDisjunctiveLicense() (via #131)
    • BREAKING: removed method makeForDisjunctiveLicenseRepository() (via #131)
    • BREAKING: removed method makeForHashRepositonary() - use makeForHashDictionary() instead (#133 via #131)
    • BREAKING: removed method setSpec() (via #131)
    • Added new method makeForComponentEvidence() (#238 via #241)
    • Added new method makeForHashDictionary() (#133 via #131)
    • Added new method makeForLicense() (via #131)
    • Added new method makeForLicenseRepository() (via #131)
  • {DOM,JSON}\Normalizers namespaces
    • BREAKING: removed classes DisjunctiveLicenseNormalizer - use LicenseNormalizer instead (via #131)
    • BREAKING: removed classes LicenseExpressionNormalizer - use LicenseNormalizer instead (via #131)
    • BREAKING: removed classes DisjunctiveLicenseRepositoryNormalizer (via #131)
    • BREAKING: renamed classes HashRepositoryNormalizer -> HashDictionaryNormalizer (#133 via #131)
      Also changed signatures to accept Models\HashDictionary instead of Models\HashRepository
    • BREAKING: changed signatures of class HashNormalizer to accept native PHP Enumeration type \CycloneDX\Core\Enum\HashAlgorithm (#140 via #204)
    • Added new classes ComponentEvidenceNormalizer that can normalize ComponentEvidence (#238 via #241)
    • Added new classes LicenseNormalizer that can normalize every existing license model (via #131)
    • Added new classes LicenseRepositoryNormalizer that can normalize LicenseRepository (via #131)
    • ExternalReferenceNormalizer classes
      • Changed the method normalize() to actually throw \DomainException when \ExternalReference's type was not supported by the spec (via #65)
        This is considered a non-breaking change, because the behaviour was already documented in the API, even though there was no need for an implementation before.
    • ExternalReferenceNormalizer classes
      • Changed, so that it tries to convert unsupported types to "other", before it throws a \DomainException (#137 via #147)
  • JSON\Normalizers\BomNormalizer class
    • Changed: method normalize()'s result data may contain the $schema string (via #155)
  • JSON\Normalizers\ExternalReferenceNormalizer class
    • BREAKING: method normalize() may throw \UnexpectedValueException when the url is invalid to format "ini-reference" (via #151)
• \CycloneDX\Core\Spdx namespace
  • BREAKING: renamed the class License -> LicenseIdentifiers (#133 via #143, #249)
  • BREAKING: renamed method getLicense() -> fixLicense() (via #249)
  • BREAKING: renamed method getLicenses() -> getKnownLicenses(), and removed keys from return value (via #249)
  • BREAKING: renamed method validate() -> isKnownLicense() (via #249)
• \CycloneDX\Core\Spec namespace
  • BREAKING: completely reworked everything (#139 via #142, #174, #204)
    See the code base for references
• \CycloneDX\Core\Validation namespace
  • BaseValidator class
    • BREAKING: removed deprecated method setSpec() (via #144)
  • ValidatorInterface interface
    • BREAKING: renamed interface to Validator (#133 via #143)
    • Removed specification of constructor __construct() (via #253)
    • Removed specification of method getSpec() (via #253)
  • Validators\{Json,JsonStrict,Xml}Validator classes
    • Added support for CycloneDX v1.4 (#57 via #65)
  • Validators\{Json,JsonStrict}Validator classes
    • Utilizes a much more competent validation library than before (#80 via #151)

Maintenance Release.

• Legal:
  • Transferred copyright to OWASP Foundation. (via #121)

Maintenance release.

• Docs:
  • Added "Responsibilities", "Capabilities" and "Usage" sections to README. (via #115)

• Maintenance release.

• Changed
  • Use version 9b04a94 of CycloneDX specification for XML and JSON schema validation. (via #105)
  • Use SPDX license enumeration from version 9b04a94 of CycloneDX specification. (via #105)
• Style
  • Fixe some whitespaces. (via #82)

• Changed
  • Use version 82bf9e3 of CycloneDX specification for XML and JSON schema validation. (via #79)
  • Use SPDX license enumeration from version 82bf9e3 of CycloneDX specification. (via #79)

• Fixed
  • Return type of CycloneDX\Core\Serialize\SerializerInterface::serialize() and implementations/usage are documented as non-empty-string, were undocumented string before. (via #70)

• Fixed
  • CycloneDX\Core\Validation\ValidatorInterface::validateString() and implementations are documented as non-empty-string, were undocumented string before. (via #63)

• Added
  • Resulting JSON files hold the correct $schema. (#43 via #42)

• Fixed
  • XML serializer & DOM normalizer no longer generate invalid XML::anyURI. (via #34)

• Changed
  • JSON result does no longer have slashes escaped in strings. (via #33)
    Old: "http:\/\/exampe.com"
    New: "http://exampe.com"

• Added
  • Prevention of information-loss on metadata-component's ExternalReferences, when normalizing to a specification that does not support bom.metadata (via #26)

• Added
  • Support for ExternalReferences in BOM and Component (via #17)

• Fixed
  • CycloneDX\Core\Models\License\AbstractDisjunctiveLicense::setUrl() no longer restricts the argument to be a valid URL.
    Per schema definition licenseType.url should be a URI, not a URL. See #18
• Changed
  • CycloneDX\Core\Models\License\AbstractDisjunctiveLicense::setUrl() no longer throws InvalidArgumentException if the argument is not a URL (via #19)

• Fixed
  • Psalm-annotation of CycloneDX\Core\Enums\Classification::isValidValue() (via #10)

Removed composer's conflict constraint.
This was done to enable some workflows with package forks/mirrors that don't have proper version detection. See #9

Initial release.
Split the library from /src/Core of cyclonedx-php-composer (346e6200fb2f5086061b15c2ee44f540893ce97d)