CycloneDX/specification
View on GitHubOWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
- Stars
- 547
- Forks
- 93
- Open beginner issues
- 0
- Indexed issues
- 179
- Avg merge
- 4h 32m
- Merged PRs (30d)
- 38
- Dominant language
- XSLT
- License
- Apache-2.0
- Last GitHub push
- Sep 2, 2026
- Latest indexed
- Sep 15, 2026
- Contributing guide
- Contributing guide
- Code of conduct
- Code of conduct
- Beginner labels
- help wanted
-
proposed core enhancement
CycloneDX/specification#590 · 3 comments · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#591 · 5 comments · 1 reaction · 1 assignee ·
-
help wanted proposed core enhancement
CycloneDX/specification#605 · 2 comments · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#612 · 18 comments · 0 reactions · 0 assignees ·
-
proposed core enhancement request for comment RFC notice sent RFC vote accepted
CycloneDX/specification#619 · 16 comments · 0 reactions · 1 assignee ·
-
CycloneDX 2.0 Openbreaking-changes CDX 2.0 proposed core enhancement
CycloneDX/specification#631 · 5 comments · 4 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#633 · 3 comments · 0 reactions · 0 assignees ·
-
breaking-changes proposed core enhancement
CycloneDX/specification#636 · 0 comments · 0 reactions · 1 assignee ·
-
defect
CycloneDX/specification#638 · 1 comment · 0 reactions · 1 assignee ·
-
breaking-changes format: ProtoBuf proposed core enhancement
CycloneDX/specification#640 · 0 comments · 0 reactions · 0 assignees ·
-
format: XML help wanted
CycloneDX/specification#641 · 0 comments · 0 reactions · 0 assignees ·
-
CDX 1.6
CycloneDX/specification#666 · 2 comments · 1 reaction · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#668 · 0 comments · 1 reaction · 1 assignee ·
-
cap: cryptography proposed core enhancement
CycloneDX/specification#669 · 4 comments · 0 reactions · 0 assignees ·
-
CDX 2.0 proposed core enhancement
CycloneDX/specification#673 · 0 comments · 1 reaction · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#674 · 0 comments · 0 reactions · 0 assignees ·
-
cap: ai/ml CDX 2.0 proposed core enhancement
CycloneDX/specification#702 · 2 comments · 0 reactions · 1 assignee ·
-
proposed core enhancement
CycloneDX/specification#731 · 0 comments · 0 reactions · 0 assignees ·
-
defect
CycloneDX/specification#734 · 0 comments · 1 reaction · 1 assignee ·
-
defect
CycloneDX/specification#735 · 1 comment · 0 reactions · 1 assignee ·
-
cap: cryptography proposed core enhancement
CycloneDX/specification#756 · 3 comments · 0 reactions · 0 assignees ·
-
License Placement OpenCDX 2.0 proposed core enhancement
CycloneDX/specification#778 · 6 comments · 0 reactions · 1 assignee ·
-
CycloneDX/specification#779 · 9 comments · 0 reactions · 1 assignee ·
-
cap: cryptography-registry defect
CycloneDX/specification#782 · 1 comment · 0 reactions · 0 assignees ·
-
[Defect]: Missing variable {dkLen} in HKDF[-{hashFunction}] variant of the algorithm family HKDF Opencap: cryptography proposed core enhancement request for comment RFC notice sent
CycloneDX/specification#799 · 6 comments · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#807 · 1 comment · 0 reactions · 0 assignees ·
-
CycloneDX/specification#816 · 0 comments · 0 reactions · 0 assignees ·
-
defect
CycloneDX/specification#832 · 0 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#848 · 0 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry proposed core enhancement
CycloneDX/specification#857 · 1 comment · 0 reactions · 0 assignees ·
-
cap: cryptography-registry
CycloneDX/specification#861 · 1 comment · 0 reactions · 0 assignees ·
-
cap: ai/ml proposed core enhancement
CycloneDX/specification#862 · 2 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#866 · 1 comment · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#890 · 1 comment · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#891 · 1 comment · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#900 · 4 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#901 · 2 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#904 · 3 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#905 · 0 comments · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#906 · 1 comment · 0 reactions · 0 assignees ·
-
cap: cryptography-registry defect
CycloneDX/specification#918 · 0 comments · 0 reactions · 0 assignees ·
-
cap: ai/ml
CycloneDX/specification#927 · 13 comments · 0 reactions · 0 assignees ·
-
proposed core enhancement
CycloneDX/specification#943 · 0 comments · 0 reactions · 0 assignees ·
-
CycloneDX/specification#954 · 16 comments · 0 reactions · 0 assignees ·
-
CycloneDX/specification#955 · 3 comments · 0 reactions · 0 assignees ·
-
CycloneDX/specification#956 · 3 comments · 0 reactions · 1 assignee ·
-
proposed core enhancement
CycloneDX/specification#959 · 3 comments · 0 reactions · 0 assignees ·
-
CDX 2.0 defect
CycloneDX/specification#961 · 3 comments · 0 reactions · 0 assignees ·
-
CycloneDX/specification#964 · 1 comment · 1 reaction · 1 assignee ·
-
CDX 2.0 test-data
CycloneDX/specification#971 · 0 comments · 0 reactions · 1 assignee ·