-
-
Notifications
You must be signed in to change notification settings - Fork 27
Description
Is your feature request related to a problem? Please describe.
I'm always frustrated when I have to manually look up the newest version of the CycloneDX spec and specify it manually via the cli. Newer versions of the spec bring improvements and defaulting to old versions hinders adoption.
Describe the solution you'd like
It would be very nice, if the newest supported version would be the default, then one doesn't have to specify a spec version and nevertheless can use the latest and greatest version of CycloneDX.
Describe alternatives you've considered
Adopt a clear guideline on when to change the default to a new version, when not changing it directly, but rather e.g. 1 week/month/year after release of the new spec version.
Additional context
Version 1.4 (the current default) has been released on 12 January 2022, so it is over a two years old now and is the default for at least 1.5 years now.
Version 1.5 has been released on 26 June 2023, so is almost a year old now as well.
Version 1.6 has been released on 09 April 2024, so it is almost 2 weeks old now as well, but has been supported since over a month now.
Dependency Track works flawlessly with CycloneDX 1.6.