Proto commits in CycloneDX/specification

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-05-19

fix: back-port schema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix: backport schema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2026-05-18

chore: bump schema versions for upcoming changes Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

chore: bump schema versions for upcoming changes Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge branch '1.7.1-dev' into fix/modelcard-missing-properties

chore: bump schema versions for upcoming changes Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2026-03-18

Merge branch 'master' into feat/licenses/acknowledgement-should-be-unique

2026-02-09

Merge branch 'master' into fix/modelcard-missing-properties

fix(proto): correct 'plain text' typo in AttachedText comment (#786) Corrects a typo in Protocol Buffers schema documentation: "plan text" -> "plain text" for the example. Closes #785.

2026-02-05

fix(spec): improve ratings descriptions in schema files for clarity on VEX usage Signed-off-by: Fahed Dorgaa <fahed.dorgaa@gmail.com>

Update vulnerability ratings description in XML and Protobuf schemas, and revert extension changes Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>

2026-01-25

fix(proto): correct 'plain text' typo in AttachedText comment Closes #785 Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>

2025-12-17

fix: add properties field to ModelCard xml and proto to resolve mismatch with json Signed-off-by: wievdndr <wiebe.vandendriessche@ugent.be>

2025-10-19

Merge branch 'master' into 1.7-dev

The documentation is generated from this commit.

2025-10-17

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-10-14

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-09-29

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs: update link to version-range-spec Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-09-07

docs: streamlined deprecated fields'd descriptions Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge remote-tracking branch 'origin/1.7-dev' into 1.7-dev-cryptography

[1.7] - Updates from CBOM working group - remove any BREAKING CHANGES for ProtoBuf (#677) removed breaking changes in Protocol Buffer schema regarding CBOM changes caused by https://github.com/CycloneDX/specification/pull/657#issuecomment-3244561693

fix: remove the word "optional", align some docs (#680) removed the word "optional" whenever possible, as the schemas clearly tell when something is optional or required. as agreed in https://github.com/CycloneDX/specification/issues/616#issuecomment-2761792157 and https://github.com/CycloneDX/specification/issues/649#issuecomment-2964680048 - fixes #616 - fixes #649

2025-09-04

refactor: metadata distribution to be an object (#653) Refactored `metadata.distribution` to be more verbose in its name, and made it more versatile by converting it to an "object" with "TLP" as a property. caused by https://github.com/CycloneDX/specification/pull/603#issuecomment-2972771553

2025-09-03

Update schema/bom-1.7.proto Co-authored-by: Jan Kowalleck <jan.kowalleck@owasp.org> Signed-off-by: Steve Springett <steve@springett.us>

fix: remove the word "optional", align some docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-09-02

simplified nested message names of `Ikev2TransformTypesDetailed` Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

[1.7] - Updates from CBOM working group - remove any BREAKING CHANGES Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-08-21

Removing JOSE from protocol - as it technically doesn't fit the definition of one. Each JOSE component (tokens, algorithms, etc) can be represented as individual components within the CBOM. Signed-off-by: Steve Springett <steve@springett.us>

2025-08-14

PB: fixes and reverts Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-08-11

streamline docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

streamline docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix: streamline schema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-08-08

streamline proto schema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge remote-tracking branch 'origin/1.7-dev' into feat/licenses/acknowledgement-should-be-unique

2025-08-06

streamlined some docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

wip Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge branch '1.7-dev' into 1.7-dev-citations

2025-08-05

Added expressions - JSONPath and XPath as an alternative to JSON Pointer. Updated formulation description. Updated test cases. Signed-off-by: Steve Springett <steve@springett.us>

2025-07-25

Porting JSON changes to protobuf Signed-off-by: Steve Springett <steve@springett.us>

2025-07-24

feat: support multi license mix (#582) As discussed in ticket #454, this PR adds the following abilities: - have multiple license expressions - have a mix of license expressions, SPDX license IDs, and named licenses Please read the original ticket and see the provided example data for use-cases. fixes #454

2025-07-03

Merge branch '1.7-dev' into 1.7-dev-citations

2025-07-02

Added explicit documentation in XSD and Proto that either attributedTo or process (or both) are required. Added invalid JSON test case. Signed-off-by: Steve Springett <steve@springett.us>

2025-06-16

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

refactor: make `medatada.distribution` an object Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-06-10

wording Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-06-06

feat: JIT compilers and interpreters are platforms Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge branch '1.7-dev' into feat/licenses/acknowledgement-should-be-unique

Merge branch '1.7-dev' into feat/licenses-multi-mix-all

2025-06-05

Add support for representing patent information (#597) Implements patent support. Closes #596

feat: license expression details and properties - text attachment, licensing, etc (#599) As discussed via #549, this PR adds new structures to allow documenting the licensing and "properties" of SPDX expressions As discussed via #554, this PR adds new structures to allow documenting the license texts for SPDX expressions' individual parts. ---- TODO - [x] agree on data models & finalize examples - [x] write the schemata - [x] write the spec - [x] write a proper summary for this PR ---- - fixes #554 - fixes #549

feat: add custom properties to external references (#610) With this property external references can be annotated with additional metadata in a machine-readable format. As discussed in #608 this adds support for custom properties in external references. fixes #608

feat: Add support for TLP marking in metadata (#604) As discussed in ticket #595, this PR adds TLP marking in the BOM metadata. This PR superseeds #603 fixes #595

2025-05-20

docs: annotations Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-05-15

docs: add ProtoBuf enum docs - taken from JSON Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-05-02

Updated comments Signed-off-by: Steve Springett <steve@springett.us>

Ported to protobuf and added test case Signed-off-by: Steve Springett <steve@springett.us>

2025-05-01

Added external ref for citation Signed-off-by: Steve Springett <steve@springett.us>

corrected pointer repeating Signed-off-by: Steve Springett <steve@springett.us>

Added citation support and test cases. Signed-off-by: Steve Springett <steve@springett.us>

2025-04-14

feat: license acknowledge should beunique Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-04-03

feat: support for external components with version-ranges (#586) As discussed in ticket #321, this PR adds the following abilities: - mark components as **external** > Determine whether this component is external. > An external component is one that is not part of an assembly, but is expected to be provided by the environment, regardless of the component's `@scope`. This setting can be useful for distinguishing which components are bundled with the product and which can be relied upon to be present in the deployment environment. > This may be set to `true` for runtime components only. For `/metadata/component`, it must be set to `false`. - external components may have **version-ranges** instead of a specific version > For an external component, this specifies the accepted version range. > The value must adhere to the Package URL Version Range syntax (vers), as defined at <https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>. > May only be used if `.isExternal` is set to `true`. > Must be used exclusively, either 'version' or 'versionRange', but not both. fixes #321 ---- > [!NOTE] > this one supersedes #326 <-- read there for more background and previous discussions implementing with `components`, because the objects referenced/required are actually used at runtime and therefore are considered a "component". Sketch/proposal for #321 - [x] sketch JSON schema - properties and assert - test cases - [x] sketch XML schema - elements & attributes. no asserts - this would require XSD1.1 which is not broadly implemented, yet. - test cases - [x] sketch ProtoBuff schema - fields - test cases ---- > [!NOTE] > ALL FEEDBACK IS WELCOME! Yes, everything. > but some might not be resolved in this very PR, but in the authoritative guides. See https://github.com/CycloneDX/specification/pull/586#issuecomment-2639335084

2025-03-10

feat: add custom properties to external references With this property external references can be annotated with additional metadata in a machine-readable format. Signed-off-by: Christoph Steiger <christoph.steiger@siemens.com>

2025-03-06

feat: Add support for TLP marking in metadata - correct TLP description (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

feat: Add support for TLP marking in metadata - correct TLP description (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

style fixes Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fixed schema and docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-27

feat: license expression licensing and properties Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

feat: license url Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

licenseexpression details bom-ref Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

refactor: rename and docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-26

style Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs: SPDX expression examplefor `LicenseRef-` Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-25

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

struct proto Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs: proto Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-24

ework license expression lext attachments and add shema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

rework license expression lext attachments and add shema Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

`TLP_CLEAR_UNSPECIFIED` -> `TLP_CLEAR` Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-23

feat: Add support for TLP marking in metadata - add default values and documentation (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

feat: Add support for TLP marking in metadata (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

feat: Add support for TLP marking in metadata (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

feat: Add support for TLP marking in metadata - fix protobuf enum (fixes #595) Signed-off-by: anthonyharrison <anthony.p.harrison@gmail.com>

2025-02-08

component's version and versionRange exclusively Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

rename `isExtranous `-> `isExternal` + wording Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

spec: isExtraneous only for runtime-components Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-06

Merge branch '1.7-dev' into add-streebog-hashalg

Merge branch '1.7-dev' into feat/licenses-multi-mix-all

wip Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

wip Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

wip Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

2025-02-03

forward-port #581 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge remote-tracking branch 'origin/master' into 1.7-dev