CycloneDX / CycloneDX/specification

Consider making specVersion an integer with validations

Open
#438 2 comments 0 reactions 0 assignees View on GitHub
breaking-changes
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Currently specVersion is a [string](https://github.com/CycloneDX/specification/blob/master/schema/bom-1.6.schema.json#L25). This is creating confusion when consuming tools treat this value as both string and integer.

Example:

https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/925b04fdd74e4e412e1cc06d7fad9e7a102e329c/src/main/java/org/cyclonedx/maven/DefaultModelConverter.java#L236

https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/925b04fdd74e4e412e1cc06d7fad9e7a102e329c/src/it/makeBom/verify.groovy#L11

https://github.com/DependencyTrack/dependency-track/blob/b40ea44864d006079d38a8d159c2d9d1c5fb04f7/src/main/java/org/dependencytrack/model/Vex.java#L131

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.