Last repository tag picked over first reachable when determining version

Hi,

I have the following situation:

I have a Git repository, where the master branch serves as the development head, with tags for release points, and maintenance branches for previous major releases that receive bugfixes and tags for updates.

.
.
C
| B'
| |
B / A'
|   |
A __/
|
o

Where A, B and C are releases (let's presume v1.0.0, v2.0.0 and v3.0.0 respectively), and A' and B' are maintenance commits for the respective releases (let's assume v1.0.1 and v2.0.1).

When I generate an SBOM document for the module, as it is at B', the version detection malfunctions, and determines the version of the module to be whatever the latest tag is (in the example, this is C, i.e. v3.0.0). I've verified that it is the version control system tags that affect this, as after removing all tags from the repository, the result was a pseudo-version.

Is this the Go tooling that's doing this, or the cyclonedx-gomod utility incorrectly determining the version of the module?

Apologies in advance if this isn't the cyclonedx-gomod utilities fault - my Go-fu isn't great, and I'm just managing this aspect of the subject project.

Start by reproducing SBOM generation for the described maintenance commit B' with the repository's release and maintenance tags, then compare the result with Go tooling after tags are removed. Trace how cyclonedx-gomod determines the module version from Git tags and verify that the selected version is the first reachable release tag rather than the latest repository tag.