SBOM conversion issue.

This may not even be an issue, but the spdx to CycloneDX converter rejects this string:

"referenceCategory": "PACKAGE-MANAGER"

but accepts

"referenceCategory": "PACKAGE_MANAGER"

It's certainly easy to repair these in any incoming spdx json, but the Microsoft's SBOM generation tool uses the former syntax, so it might be a convenience for those users to accept the sbom it produces.

Love the converter btw.

Start by reproducing the SPDX-to-CycloneDX conversion with the two referenceCategory values shown in the issue, then locate the validation or parsing path that rejects PACKAGE-MANAGER. Done means the Microsoft-generated SPDX input is accepted while the existing PACKAGE_MANAGER form continues to work.

Written by the indexing model from the issue text.