CycloneDX / CycloneDX/cyclonedx-web-tool

Upgrade CycloneDX libraries to 10.0.2 (SPDX schema 3.26.0)

Open
#176 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
49
Forks
10
PR merge metrics
No merged PRs in 30d

Description

Hi,

The web tool is currently using `CycloneDX.Utils` and `CycloneDX.Spdx.Interop` at version 10.0.0, which ships with an outdated SPDX schema. This causes valid CycloneDX BOMs to fail validation.

Additionally, validation error messages reference the main branch schema URLs instead of using the schema version bundled with the library. This may be an upstream issue in the CycloneDX library itself.

## Proposed Changes

- Upgrade `CycloneDX.Utils` and `CycloneDX.Spdx.Interop` from 10.0.0 to 10.0.2, which includes SPDX schema 3.26.0
([source](https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/main/src/CycloneDX.Core/Schemas/spdx.xsd))

Thank you,
Agustin Groh

Contributor guide

Open the contributing guide

Research direction

Locate the dependency declarations for CycloneDX.Utils and CycloneDX.Spdx.Interop, then inspect the web tool's BOM validation entry point and any related tests. Update both packages to 10.0.2 and verify that BOMs using SPDX schema 3.26.0 validate successfully; check whether validation errors use the bundled schema URL.

Written by the indexing model from the issue text.

Assessment

Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.