CycloneDX / CycloneDX/cyclonedx-web-tool
Upgrade CycloneDX libraries to 10.0.2 (SPDX schema 3.26.0)
- Dominant language
- HTML
- Stars
- 49
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
The web tool is currently using `CycloneDX.Utils` and `CycloneDX.Spdx.Interop` at version 10.0.0, which ships with an outdated SPDX schema. This causes valid CycloneDX BOMs to fail validation.
Additionally, validation error messages reference the main branch schema URLs instead of using the schema version bundled with the library. This may be an upstream issue in the CycloneDX library itself.
## Proposed Changes
- Upgrade `CycloneDX.Utils` and `CycloneDX.Spdx.Interop` from 10.0.0 to 10.0.2, which includes SPDX schema 3.26.0
([source](https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/main/src/CycloneDX.Core/Schemas/spdx.xsd))
Thank you,
Agustin Groh
Contributor guide
Research direction
Locate the dependency declarations for CycloneDX.Utils and CycloneDX.Spdx.Interop, then inspect the web tool's BOM validation entry point and any related tests. Update both packages to 10.0.2 and verify that BOMs using SPDX schema 3.26.0 validate successfully; check whether validation errors use the bundled schema URL.
Written by the indexing model from the issue text.
Assessment
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100