cyclonedx/cyclonedx-php-composer

Refactor

• Migrated to cyclonedx/cyclonedx-library:^4.0 (via #619)

Dependencies

• Raised dependency cyclonedx/cyclonedx-library:^4.0, was :^3.9 (via #619)

Style

• Applied latest PHP Coding Standards (via #617)

What's Changed

• chore(deps): bump phpunit for github.com/advisories/GHSA-vvj3-c3rp-c85p by @jkowalleck in #614
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.5 to 0.9.6 in /tools/composer-unused by @dependabot[bot] in #613
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.48.2 to 2.49.0 in /tools/composer-normalize by @dependabot[bot] in #611
• tools(deps-dev): Update vimeo/psalm requirement from 6.14.3 to 6.15.0 in /tools/psalm by @dependabot[bot] in #612
• chore: set dev-master 6.x-dev by @jkowalleck in #618
• feat: migrate to CycloneDX libary v4 by @jkowalleck in #619
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.49.0 to 2.50.0 in /tools/composer-normalize by @dependabot[bot] in #616
• tools(deps-dev): Update vimeo/psalm requirement from 6.15.0 to 6.15.1 in /tools/psalm by @dependabot[bot] in #615
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.92.3 to 3.94.0 in /tools/php-cs-fixer by @dependabot[bot] in #617
• chore: prep v6.2.0 by @jkowalleck in #620
• chore: prep v6.2.0 by @jkowalleck in #621

Full Changelog: v6.1.0...v6.2.0

• Refactor
  • Migrated to cyclonedx/cyclonedx-library:^4.0 (via #619)
• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^4.0, was :^3.9 (via #619)
• Style
  • Applied latest PHP Coding Standards (via #617)

Added

• Officially support PHP 8.5 (#595 via #587)

Refactor

• Migrated to cyclonedx/cyclonedx-library:^3.9 (via #594)

Dependencies

• Raised dependency cyclonedx/cyclonedx-library:^3.9, was :^3.3 (via #594)

What's Changed

• tests: fix test app compat by @jkowalleck in #593
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.89.2 to 3.91.0 in /tools/php-cs-fixer by @dependabot[bot] in #592
• gh-actions(deps): Bump actions/checkout from 5 to 6 by @dependabot[bot] in #590
• refactor: migrated to cyclonedx/cyclonedx-library:^3.9 by @jkowalleck in #594
• ci: test composer 2.9 by @jkowalleck in #596
• gh-actions(deps): Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #598
• gh-actions(deps): Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #602
• gh-actions(deps): Bump actions/cache from 4 to 5 by @dependabot[bot] in #599
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.91.1 to 3.92.3 in /tools/php-cs-fixer by @dependabot[bot] in #603
• chore: PR remplate by @jkowalleck in #605
• chore(deps): fix min version inconsistency by @jkowalleck in #606
• tools(deps-dev): Update vimeo/psalm requirement from 6.13.1 to 6.14.3 in /tools/psalm by @dependabot[bot] in #604
• feat: support PHP 8.5 by @jkowalleck in #595
• chore: prep v6.1.0 by @jkowalleck in #607

Full Changelog: v6.0.0...v6.1.0

• Added
  • Officially support PHP 8.5 (#595 via #587)
• Refactor
  • Migrated to cyclonedx/cyclonedx-library:^3.9 (via #594)
• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^3.9, was :^3.3 (via #594)

BREAKING changes

• Fix: no longer issue git/hg commit IDs when analyzing dev-resource. (#586 via #588)

What's Changed

• docs: what was refactored in v5.3.0 by @jkowalleck in #584
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.89.1 to 3.89.2 in /tools/php-cs-fixer by @dependabot[bot] in #585
• fix!: dont use Packages' dev-version by @jkowalleck in #588
• chore: prep v6.0.0 by @jkowalleck in #589

Full Changelog: v5.3.0...v6.0.0

• Breaking Change
  • Fix: no longer issue git/hg commit IDs when analysing dev-resource. (#586 via #588)

Added basic support for CycloneDX Specification-1.7.

Changed

• This tool may support CycloneDX Specification-1.7 now (via #579)
  This feature depends on cyclonedx/cyclonedx-library:^3.8.

Refactor

• Reworked internals to automatically support any SpecVersion provided by cyclonedx/cyclonedx-library. (via #579)
  Previously, the supported versions were managed by this very tool and needed manual updates.

What's Changed

• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.2 to 0.9.3 in /tools/composer-unused by @dependabot[bot] in #554
• tools(deps-dev): Update vimeo/psalm requirement from 6.10.3 to 6.12.0 in /tools/psalm by @dependabot[bot] in #560
• tools(deps-dev): Update vimeo/psalm requirement from 6.12.0 to 6.12.1 in /tools/psalm by @dependabot[bot] in #561
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.75.0 to 3.82.2 in /tools/php-cs-fixer by @dependabot[bot] in #563
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.82.2 to 3.84.0 in /tools/php-cs-fixer by @dependabot[bot] in #564
• tools(deps-dev): Update vimeo/psalm requirement from 6.12.1 to 6.13.0 in /tools/psalm by @dependabot[bot] in #565
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.3 to 0.9.4 in /tools/composer-unused by @dependabot[bot] in #566
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.84.0 to 3.85.1 in /tools/php-cs-fixer by @dependabot[bot] in #567
• tools(deps-dev): Update vimeo/psalm requirement from 6.13.0 to 6.13.1 in /tools/psalm by @dependabot[bot] in #569
• gh-actions(deps): Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in #568
• gh-actions(deps): Bump actions/checkout from 4 to 5 by @dependabot[bot] in #570
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.47.0 to 2.48.0 in /tools/composer-normalize by @dependabot[bot] in #572
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.85.1 to 3.86.0 in /tools/php-cs-fixer by @dependabot[bot] in #571
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.48.0 to 2.48.2 in /tools/composer-normalize by @dependabot[bot] in #573
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.86.0 to 3.87.1 in /tools/php-cs-fixer by @dependabot[bot] in #574
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.87.1 to 3.87.2 in /tools/php-cs-fixer by @dependabot[bot] in #575
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.87.2 to 3.88.2 in /tools/php-cs-fixer by @dependabot[bot] in #577
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.4 to 0.9.5 in /tools/composer-unused by @dependabot[bot] in #576
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.88.2 to 3.89.0 in /tools/php-cs-fixer by @dependabot[bot] in #578
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.89.0 to 3.89.1 in /tools/php-cs-fixer by @dependabot[bot] in #582
• gh-actions(deps): Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #581
• gh-actions(deps): Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #580
• feat: basic support cdx17 by @jkowalleck in #579
• chore: prep v5.3.0 by @jkowalleck in #583

Full Changelog: v5.2.3...v5.3.0

Added basic support for CycloneDX Specification-1.7.

• Changed
  • This tool may support CycloneDX Specification-1.7 now (via #579)
    This feature depends on cyclonedx/cyclonedx-library:^3.8.
• Refactor
  • Reworked internals to automatically support any SpecVersion provided by cyclonedx/cyclonedx-library. (via #579)
    Previously, the supported versions were managed by this very tool and needed manual updates.

Maintenance release.

What's Changed

• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.69.0 to 3.69.1 in /tools/php-cs-fixer by @dependabot in #532
• tools(deps-dev): Update vimeo/psalm requirement from 6.7.1 to 6.8.6 in /tools/psalm by @dependabot in #533
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.69.1 to 3.70.0 in /tools/php-cs-fixer by @dependabot in #534
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.6 to 6.8.8 in /tools/psalm by @dependabot in #535
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.70.0 to 3.71.0 in /tools/php-cs-fixer by @dependabot in #536
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.8.11 to 0.9.1 in /tools/composer-unused by @dependabot in #539
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.8 to 6.8.9 in /tools/psalm by @dependabot in #538
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.71.0 to 3.72.0 in /tools/php-cs-fixer by @dependabot in #537
• docs by @jkowalleck in #540
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.72.0 to 3.73.1 in /tools/php-cs-fixer by @dependabot in #541
• tools(deps-dev): Update icanhazstring/composer-unused requirement from 0.9.1 to 0.9.2 in /tools/composer-unused by @dependabot in #542
• tools(deps-dev): Update vimeo/psalm requirement from 6.8.9 to 6.9.4 in /tools/psalm by @dependabot in #543
• tools(deps-dev): Update vimeo/psalm requirement from 6.9.4 to 6.9.6 in /tools/psalm by @dependabot in #545
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.73.1 to 3.74.0 in /tools/php-cs-fixer by @dependabot in #546
• docs: fix style by @jkowalleck in #547
• tools(deps-dev): Update vimeo/psalm requirement from 6.9.6 to 6.10.0 in /tools/psalm by @dependabot in #548
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.74.0 to 3.75.0 in /tools/php-cs-fixer by @dependabot in #549
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.45.0 to 2.46.0 in /tools/composer-normalize by @dependabot in #550
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.46.0 to 2.47.0 in /tools/composer-normalize by @dependabot in #551
• tools(deps-dev): Update vimeo/psalm requirement from 6.10.0 to 6.10.2 in /tools/psalm by @dependabot in #553
• tools(deps-dev): Update vimeo/psalm requirement from 6.10.2 to 6.10.3 in /tools/psalm by @dependabot in #555
• chore: GH workflow permissions by @jkowalleck in #557
• chore: release via GH action from softprops by @jkowalleck in #556

Full Changelog: v5.2.2...v5.2.3

Maintenance release.

chore: release via GH action from softprops

Signed-off-by: Jan Kowalleck <[email protected]>

Added

• Officially support PHP 8.4 (#500 via #522)

Misc

• AddedOverride markers where needed (via #531)
  See also: https://wiki.php.net/rfc/marking_overriden_methods

What's Changed

• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.68.1 to 3.68.5 in /tools/php-cs-fixer by @dependabot in #525
• chore: pin psalm by @jkowalleck in #526
• chore: tools adjusted php 8.1 by @jkowalleck in #527
• chore: modernize composer-require-checker by @jkowalleck in #528
• chore: modernize phpunit by @jkowalleck in #529
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from 3.68.5 to 3.69.0 in /tools/php-cs-fixer by @dependabot in #530
• tools(deps-dev): Update vimeo/psalm requirement from 6.5.1 to 6.7.1 in /tools/psalm by @dependabot in #531
• feat: official support for php8.4 by @jkowalleck in #522

Full Changelog: v5.2.1...v5.2.2

• Added
  • Officially support PHP 8.4 (#500 via #522)
• Misc
  • AddedOverride markers where needed (via #531)
    See also: https://wiki.php.net/rfc/marking_overriden_methods

Maintenance release.

Added

• Officially support Composer 2.8 (#520 via #523)
• Officially support Composer 2.7 (#521 via #523)

Style

• Applied latest PHP Coding Standards (via #507)

Misc

• Various refactors

What's Changed

• ci: modernize artifact operations by @jkowalleck in #483
• chore: psalm php-version auto-detect by @jkowalleck in #484
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.54.0 to v3.56.1 in /tools/php-cs-fixer by @dependabot in #485
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.56.1 to v3.57.1 in /tools/php-cs-fixer by @dependabot in #486
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.57.1 to v3.57.2 in /tools/php-cs-fixer by @dependabot in #487
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.57.2 to v3.58.1 in /tools/php-cs-fixer by @dependabot in #488
• docs: OSSF best practice shield as percentage by @jkowalleck in #489
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.58.1 to v3.59.1 in /tools/php-cs-fixer by @dependabot in #490
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.20 to 10.5.21 in /tools/phpunit by @dependabot in #491
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.59.1 to v3.59.3 in /tools/php-cs-fixer by @dependabot in #493
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.42.0 to 2.43.0 in /tools/composer-normalize by @dependabot in #492
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.21 to 10.5.24 in /tools/phpunit by @dependabot in #495
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.24 to 10.5.25 in /tools/phpunit by @dependabot in #496
• docs by @jkowalleck in #502
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.43.0 to 2.44.0 in /tools/composer-normalize by @dependabot in #503
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.59.3 to v3.65.0 in /tools/php-cs-fixer by @dependabot in #507
• tools(deps-dev): Update ergebnis/composer-normalize requirement from 2.44.0 to 2.45.0 in /tools/composer-normalize by @dependabot in #509
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.65.0 to v3.66.0 in /tools/php-cs-fixer by @dependabot in #510
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.66.0 to v3.67.0 in /tools/php-cs-fixer by @dependabot in #511
• Update 1-feature_request.md by @jkowalleck in #512
• Update 2-bug_report.md by @jkowalleck in #513
• chore: how to gather version for bugreports by @jkowalleck in #514
• chore: validation issues template version isntructions by @jkowalleck in #515
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.67.0 to v3.68.1 in /tools/php-cs-fixer by @dependabot in #518
• tools(deps-dev): Update vimeo/psalm requirement from 5.16.0 to 6.0.0 in /tools/psalm by @dependabot in #519
• tools(deps-dev): Update maglnet/composer-require-checker requirement from 4.7.1 to 4.14.0 in /tools/composer-require-checker by @dependabot in #516
• feat: support composer 2.7 2.8 by @jkowalleck in #523
• chore: streamline tools by @jkowalleck in #524

Full Changelog: v5.2.0...v5.2.1

• Added
  • Officially support Composer 2.8 (#520 via #523)
  • Officially support Composer 2.7 (#521 via #523)
• Style
  • Applied latest PHP Coding Standards (via #507)
• Misc
  • Various refactors

Added

• Declared licenses are marked as such (#474 via #479)

Dependencies

• Raised dependency cyclonedx/cyclonedx-library:^3.3, was :^3.2 (via #479)

What's Changed

• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.19 to 10.5.20 in /tools/phpunit by @dependabot in #478
• feat: populate license acknowledgement by @jkowalleck in #479
• chore: prep v5.2.0 by @jkowalleck in #481
• ci: modernize artifact action by @jkowalleck in #482

Full Changelog: v5.1.0...v5.2.0

• Added
  • Declared licenses are marked as such (#474 via #479)
• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^3.3, was :^3.2 (via #479)

Added basic support for CycloneDX Specification-1.6.

Changed

• This tool supports CycloneDX Specification-1.6 now (via #477)

Added

• CLI switch --spec-version now supports value 1.6 to reflect CycloneDX Specification-1.6 (via #477)
  Default value for that switch is unchanged - still 1.5.

Style

• Applied latest PHP Coding Standards (via #469)

Dependencies

• Raised dependency cyclonedx/cyclonedx-library:^3.2, was :^3.1 (via #477)

What's Changed

• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.9 to 10.5.10 in /tools/phpunit by @dependabot in #462
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.49.0 to v3.50.0 in /tools/php-cs-fixer by @dependabot in #463
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.50.0 to v3.51.0 in /tools/php-cs-fixer by @dependabot in #464
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.10 to 10.5.11 in /tools/phpunit by @dependabot in #465
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.11 to 10.5.12 in /tools/phpunit by @dependabot in #466
• chore: re-enable symfony/console:>=7 as dev-dep by @jkowalleck in #467
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.12 to 10.5.13 in /tools/phpunit by @dependabot in #468
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.13 to 10.5.15 in /tools/phpunit by @dependabot in #470
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.15 to 10.5.16 in /tools/phpunit by @dependabot in #471
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.51.0 to v3.52.1 in /tools/php-cs-fixer by @dependabot in #469
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.16 to 10.5.17 in /tools/phpunit by @dependabot in #472
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.52.1 to v3.53.0 in /tools/php-cs-fixer by @dependabot in #473
• feat: support CycloneDX v1.6 by @jkowalleck in #477
• tools(deps-dev): Update phpunit/phpunit requirement from 10.5.17 to 10.5.19 in /tools/phpunit by @dependabot in #476
• tools(deps-dev): Update friendsofphp/php-cs-fixer requirement from v3.53.0 to v3.54.0 in /tools/php-cs-fixer by @dependabot in #475

Full Changelog: v5.0.1...v5.1.0

Added basic support for CycloneDX Specification-1.6.

• Changed
  • This tool supports CycloneDX Specification-1.6 now (via #477)
• Added
  • CLI switch --spec-version now supports value 1.6 to reflect CycloneDX Specification-1.6 (via #477)
    Default value for that switch is unchanged - still 1.5.
• Style
  • Applied latest PHP Coding Standards (via #469)
• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^3.2, was :^3.1 (via #477)

• Style
  • Applied latest PHP Coding Standards (via #451, #459)

• BREAKING changes
  • CLI switch --spec-version defaults to 1.5, was 1.4 (#442 via #441)
• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^3.1, was :^2.3 || ^3.0 (via #441)

Maintenance release.

• Misc
  • Officially support PHP 8.3 (via #342)

• Added
  • SBOM results might have the externalReferences[].comment populated (via #432)
• Fixed
  • SBOM results might have the externalReferences[].hashes populated (#430 via #432)
    The hashes might have wrongly appeared as components[].hashes before.

• Docs
  • Moved all non-public API into a sub-namespace called _internal, so that its reliability is obvious. (via #427)

• Added
  • SBOM result might have additional items in metadata.tools populated (#402 via #403; #404 via #405)

• Dependencies
  • Requires cyclonedx/cyclonedx-library:^2.3||^3.0, was :^2.3 (via #398)
• Style
  • Applied latest PHP Coding Standards (via #395)

Added support for CycloneDX Specification-1.5.

• Changed
  • This tool supports CycloneDX Specification-1.5 now (#380 via #383)
• Added
  • CLI switch --spec-version now supports value 1.5 to reflect CycloneDX Specification-1.5 (#380 via #383)
    Default value for that switch is unchanged - still 1.4.
• Dependencies
  • Requires cyclonedx/cyclonedx-library:^2.3, was :^2.1 (#380 via #383)

• Fixed
  • Typo: "compoer" -> "composer" (#367 via #368)

• Fixed
  • Improved error reporting in case an invalid BOM would be created (via #363)

Based on OWASP Software Component Verification Standard for Software Bill of Materials (SCVS SBOM) criteria, this tool is now capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).
Affective changes based on these SCVS SBOM criteria:

• 2.1 – Added Support for CycloneDX 1.4 (via #250)
• 2.3 – SBOM has a unique identifier (#279 via #250, #353)
• 2.7 – SBOM is timestamped (#112 via #250)
• 2.9 – Accuracy of Inventory was improved (#102, #122, #261, #313 via #250)
• 2.10 – Accuracy of Inventory of all test components was improved (#102, #122, #261, #313 via #250)
• 2.11 – SBOM metadata was enhanced (#171 via #250)
• 2.15 – SPDX license expression detection fixed (#128 via #250)

4.0.0 - Details

• BREAKING changes
  • Removed support for PHP <8.1 (#91, #128 via #250)
  • Removed support for Composer <2.3 (#153 via #250)
  • CLI
    • Removed deprecated composer command make-bom, call composer CycloneDX:make-sbom instead (#293 via #309)
    • Changed option output-file to default to - now, which causes to print to STDOUT (via #250)
    • Removed option exclude-dev in favor of new option omit (via #250)
    • Removed option exclude-plugins in favor of new option omit (via #250)
    • Removed option no-version-normalization (#102 via #250)
  • SBOM results
    • Components' version is no longer artificially normalized (#102 via #250)
  • Dependencies
    • Requires cyclonedx/cyclonedx-library:^2.1, was :^1.4.2 (#128 via #250, #353)
• Changed
  • Evidence analysis prefers actually installed packages over lock file (#122 via #250)
  • Root component's versions is unset, if version detection fails (#154 via #250)
  • Composer packages of type "composer-installer" are treated as composer plugins (via #250)
• Added
  • Evidence collection knows actually installed packages (#122 via #250)
  • SBOM results
    • Support for CycloneDX Spec v1.4 (via #250)
    • might have serialnumber populated (#279 via #250, #353)
    • might have metadata.timestamp populated (#112 via #250)
    • might have metadata.tools[].tool.externalReferences populated (#171 via #250)
    • might have components[].component.author populated (#261 via #250)
    • might have components[].component.properties populated according to cdx:composer Namespace Taxonomy (#313 via #250)
  • CLI
    • New option omit (via #250)
    • New switch validate to override no-validate (via #250)
    • New switches output-reproducible and no-output-reproducible (via #250)
• Misc
  • Added demo and reproducible continuous integration test "devReq" that is dedicated to composer's require-dev feature (via #250)
  • Reworked demo setups to be more global-install like (via #250)

• Changed
  • CLI via composer make-bom became deprecated, use composer CycloneDX:make-sbom instead. (#293 via #308)
    The composer command make-bom will be removed in the next major version.

Maintenance Release.

• Legal
  • Transferred copyright to OWASP Foundation. (via #244)

• Maintenance release.

• Dependencies
  • Raised dependency cyclonedx/cyclonedx-library:^1.4.2, was :^1.3.1. (via #192)
• Misc
  • Adjusted internal typing and typehints. (via #192)
  • Improved compatibility to Composer v2.3 (via #212)

• Fixed
  • ExternalReferences fetched from composer's support.email are correctly prefixed with "mailto:". (via #161)
    Value was unmodified in the past.

• Fixed
  • XML validation error for ExternalReference. (#158 via #159)
• Changed
  • The ValidationError message requests reporting with the "ValidationError" issue template. (via #160)
    No template was used in the past.

• Added
  • The resulting SBoM hold ExternalReferences as fetched from package descriptions. (via #145)

• Fixed
  • Compatibility with composer v2.0.0 to v2.0.4 was improved. (via #152)
  • Possible crashes when composer was not able to detect component's version properly.

• Added
  • CLI got a new switch --no-version-normalization. (via #138)
    That allows to omit component version-string normalization.
    Per default this plugin will normalize version strings by stripping leading "v".
    This is a compatibility-switch. The next major-version of this plugin will not modify component versions. (see #102)

• Added
  • CLI got a new option --mc-version. (via #133)
    That allows to set the main component's version in the resulting SBoM, so that the auto-detection can be overridden.
• Fixed
  • The resulting SBoM's main component's purl does not get a version assigned, if the version auto-detection fails. (via #134)

• Changed
  • Core library
    • Was moved to an own package: https://packagist.org/packages/cyclonedx/cyclonedx-library
      The new external package/library is a one-to-one copy of the original code from this project.
      The new external package/library is a dependency/required of this project. So usage/leverage of the original code is still possible without any changes for third parties.
      See #87 for details.

• Fixed
  • Improved compatibility to composer. (via #125)
    This was made possible since composer's type hints are getting fixed.
    See https://github.com/composer/composer/releases/tag/2.1.7

    Added many type annotations internally, which may have an effect on CI/static analysis for people using Composer as a dependency.

• Changed
  • Core library
    • Some repository data-types are lists of unique items, so no duplicates are kept.
      Affected classes/data-types:
      • ComponentRepository
      • DisjunctiveLicenseRepository
      • ToolRepository
• Added
  • CLI via composer make-bom
    • Will try to populate dependencies of the SBoM result.
  • Core library
    • Added BomRef model to link bom elements in general.
      Added BomRefRepository data type as a collection of unique BomRef.
    • Added bomRef to Component model to link components as dependencies.
      Added dependencies to Component model.
    • Added ability to serialize dependencies to XML.
    • Added ability to serialize dependencies to JSON.
• Misc
  • Moved development docs to docs/dev/.
  • Refactored the plugin's internals.

• Fixed
  • CLI via composer make-bom
    • Will ignore "AliasPackages" when generating the SBoM, since their alias-target is part of the SBoM already.

• Changed
  • Core library
    • SerializersGroups will skip unsupported elements silently, instead of forwarding caught exceptions.
      This results in an overall smoother SBoM generation process, just as intended.
• Added
  • CLI via composer make-bom
    • Will try to populate metadata of the SBoM result.
  • Core library
    • Added models for spec elements: metadata, tools, tool
    • Added ability to serialize metadata to XML.
    • Added ability to serialize metadata to JSON.
• Fixed
  • CLI via composer make-bom
    • composer packages of type project or composer-plugin result as CycloneDX component of type application, was library.
• Misc
  • Updated demos/examples to reflect current state of SBoM results including metadata.
  • Split some tests to more fine-grained scenarios.

• Changed
  • CLI via composer make-bom
    • All informational/error output will appear on STDERR, was STDOUT. Output of the SBoM might still happen on STDOUT.
      This makes utilization of STDOUT via --output-file=- more flexible (pipe, redirect) whilst verbosity can be increased via -v.
• Added
  • CLI via composer make-bom
    • Added an optional argument composer-file.
      If given, then the SBoM is generated based on that file instead of the file in the current working directory.
      This enables the plugin to analyze projects outside the plugin's own setup.
• Fixed
  • Fixed detection of invalid/outdated composer lock file.
  • Fixed a rare case that caused the CLI to crash unexpectedly, if the composer lock file was unexpected.
• Misc
  • Added composer keywords.
  • Refactored the plugin's internals.
  • Added more tests for internals.

• Misc
  • Updated some documentation.
  • Bumped some dev-tools.
  • Added normalizer for composer.json files.

• Added
  • CLI via composer make-bom
    • Per default the command will validate the resulting SBoM before writing it to file/stdOut.
    • Added a switch --no-validate to disable result validation.
    • When the verbosity at "debug" level, then detailed debug info will be put out. This should help to find validation issues.
  • Validation classes/methods to test SBoM in XML and JSON format for spec 1.1, 1.2, 1.3

• Breaking Changes
  • Now requires php ^7.3 || ^8.0, was ^7.1 || ^8.0.
  • Now requires composer v2 - composer-plugin-api:^2.0, was composer-plugin-api:^1.1||^2.0.
  • CLI via composer make-bom
    • Now defaults to the latest supported version of CycloneDX spec: 1.3
      See option --spec-version.
    • Deprecated switch --json was removed.
      Use option --output-format=JSON instead.
  • Component's license in SpdxLicenseExpression format is no longer split into disjunctive licenses. Still using licenses properly in the resulting output file.
  • Complete rewrite/refactor.
    Expect library classes/methods/functions to be removed, renamed or incompatible to previous versions - see the source for changes.
• Added
  • CLI
    • Output is less verbose per default. Can be increased via -v, -vv, -vvv.
    • Support for output to STDOUT. Use option --output-file=-.
    • Added an optional option --spec-version for the CycloneDX spec version.
      Supported values: "1.1", "1.2", "1.3".
      Defaults to "1.3".
  • Support for JSON output format.
    JSON support was a preview before and became a basic part of the plugin now.
• Removed
  • This plugin no longer supports php<7.3.
  • This plugin no longer supports composer v1.
  • CLI
    • Deprecated switch --json was removed.
      Use option --output-format=JSON instead.
• Fixed
  • Some cases when the JSON SBoM generator created schema-invalid data.
• Misc
  • Utilize package-url/packageurl-php over own implementation.
  • Added more tests during the build process.
  • Added Psalm & PHP-CS-Fixer to the CI chain and fixed all findings accordingly.
  • Added a demo run of the plugin to the CI chain.

• Maintenance release.

• Added
  • CLI got an option --output-format to decide the output format. (via #80)
    Supported values: "XML", "JSON".
    Defaults to "XML".
    The use of this new option replaces the switch --json.
• Deprecated
  • CLI switch --json was marked as deprecated. (via #80)
    Use option --output-format=JSON instead.

• Misc
  • Removed php-cs-fixer config from dist release.

• Misc
  • Applied latest rules of php-cs-fixer to the code. (via #78)

• Added
  • Support for slim dist-builds (via #24)
• Misc
  • Pinned dev-requirements to exact versions to ensure reproducible tests. (via #37)
  • Added (code) quality tests to the dev-process. (see #23)
  • CI's unit-tests just run reasonable combinations of OperatingSystem, PhpVersions, dependencies. (via #34, #54)
  • applied coding standards to all php files. (via #40)

• Fixed
  • Removed unneeded double forward slash from package URLs (via #7)
• Misc
  • Added release workflow (via #8)