Dependencies within Dependency class should be List<String> not List<Dependency>

the Dependency class currently contains a dependencies field which is typed as a List<Dependency>, which implies that dependencies can be nested. This is incorrect based on both the current specification and the JSON schema, which has "dependsOn" as a list of bom-refs. This can lead to developers believing dependencies can be nested, and producing invalid BOMs as a result.

To double check this, I also compared this with the JavaScript which does implement the dependencies list as a string.

Commencez par localiser la classe Dependency et examiner son champ dependencies par rapport à la spécification actuelle et au schéma JSON, où dependsOn est une liste de bom-refs. Comparez l’implémentation JavaScript correspondante, puis vérifiez que le modèle Java représente les références de dépendances sous forme de chaînes et ne suggère plus de dépendances imbriquées.