Skip to content

Commit a51b0e9

Browse files
jkowalleckjkowalleck
committed
docs: history
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent e736a63 commit a51b0e9

File tree

1 file changed

+286
-5
lines changed

1 file changed

+286
-5
lines changed

‎CHANGELOG.md‎

Lines changed: 286 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,19 @@
5656

5757
## v9.0.0 (2025-02-26)
5858

59-
### Features
60-
61-
- 9.0.1 ([#777](https://github.com/CycloneDX/cyclonedx-python-lib/pull/777),
62-
[`e6f91fa`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/e6f91fa98cbb02cda62fd0bc5b1f1b9bf19902ee))
63-
59+
### BREAKING Changes
60+
61+
* Fix: `model.vulnerability.VulnerabilityReference`'s properties are all mandatory ([#790](https://github.com/CycloneDX/cyclonedx-python-lib/issues/790) via
62+
[#792](https://github.com/CycloneDX/cyclonedx-python-lib/pull/792))
63+
* Refactor: Rename `spdx.is_compund_expression` -> `spdx.is_expression`
64+
([#779](https://github.com/CycloneDX/cyclonedx-python-lib/pull/779))
65+
* Behavior: `BomRef` affects comparison/hashing ([#754](https://github.com/CycloneDX/cyclonedx-python-lib/pull/754) &
66+
[#780](https://github.com/CycloneDX/cyclonedx-python-lib/pull/780))
67+
This is only a breaking change if you relied on ordering of elements.
68+
* Behavior: streamline comparison/hashing functions ([#755](https://github.com/CycloneDX/cyclonedx-python-lib/pull/755)) This is only a breaking
69+
change if you relied on ordering of elements.
70+
* Dependency: bump dependency `py-serializable >=2 <3`, was `>=1.1.1 <2` ([#775](https://github.com/CycloneDX/cyclonedx-python-lib/pull/775)) This is
71+
only a breaking change if you have other packages depend on that specific version.
6472

6573
## v8.9.0 (2025-02-25)
6674

@@ -218,6 +226,43 @@
218226
- V8.0.0 ([#665](https://github.com/CycloneDX/cyclonedx-python-lib/pull/665),
219227
[`002f966`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/002f96630ce8fc6f1766ee6cc92a16b35a821c69))
220228

229+
### BREAKING Changes
230+
231+
* Removed `cyclonedx.mode.ThisTool`, utilize `cyclonedx.builder.this.this_tool()` instead. * Moved
232+
`cyclonedx.model.Tool` to `cyclonedx.model.tool.Tool`.
233+
* Property `cyclonedx.mode.bom.BomMetaData.tools` is of type `cyclonedx.model.tool.ToolRepository` now, was
234+
`SortedSet[cyclonedx.model.Tool]`. The getter will act accordingly; the setter might act in a
235+
backwards-compatible way.
236+
* Property `cyclonedx.mode.vulnerability.Vulnerability.tools` is of type `cyclonedx.model.tool.ToolRepository` now, was `SortedSet[cyclonedx.model.Tool]`. The getter will
237+
act accordingly; the setter might act in a backwards-compatible way.
238+
* Constructor `cyclonedx.model.license.LicenseExpression()` accepts optional argument `acknowledgement` only as
239+
key-word argument, no longer as positional argument.
240+
241+
### Changes
242+
243+
* Constructor of `cyclonedx.model.bom.BomMetaData` also accepts an instance of
244+
`cyclonedx.model.tool.ToolRepository` for argument `tools`. * Constructor of
245+
`cyclonedx.model.bom.BomMetaData` no longer adds this very library as a tool. Downstream users
246+
SHOULD add it manually, like
247+
`my-bom.metadata.tools.components.add(cyclonedx.builder.this.this_component())`.
248+
249+
### Fixes
250+
251+
* Deserialization of CycloneDX that do not include tools in the metadata are no longer unexpectedly
252+
modified/altered.
253+
254+
### Added
255+
256+
Enabled Metadata Tools representation and serialization in accordance with CycloneDX 1.5
257+
258+
* New class `cyclonedx.model.tool.ToolRepository`. * New function
259+
`cyclonedx.builder.this.this_component()` -- representation of this very python library as a
260+
`Component`. * New function `cyclonedx.builder.this.this_tool()` -- representation of this very
261+
python library as a `Tool`. * New function `cyclonedx.model.tool.Tool.from_component()`.
262+
263+
### Dependencies
264+
265+
* Raised runtime dependency `py-serializable>=1.1.1,<2`, was `>=1.1.0,<2`.
221266

222267
## v7.6.2 (2024-10-07)
223268

@@ -373,6 +418,15 @@
373418
- Support for CycloneDX v1.6
374419
([`8bbdf46`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/8bbdf461434ab66673a496a8305c2878bf5c88da))
375420

421+
* added draft v1.6 schemas and boilerplate for v1.6
422+
* re-generated test snapshots for v1.6
423+
* note `bom.metadata.manufacture` as deprecated
424+
* work on `bom.metadata` for v1.6
425+
* Deprecated `.component.author`. Added `.component.authors` and `.component.manufacturer`
426+
* work to add `.component.omniborid` - but tests deserialisation tests fail due to schema
427+
differences (`.component.author` not in 1.6)
428+
* work to get deserialization tests passing
429+
376430

377431
## v6.4.4 (2024-03-18)
378432

@@ -500,6 +554,99 @@
500554
- V6.0.0 ([#492](https://github.com/CycloneDX/cyclonedx-python-lib/pull/492),
501555
[`74865f8`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/74865f8e498c9723c2ce3556ceecb6a3cfc4c490))
502556

557+
### Breaking Changes
558+
559+
* Removed symbols that were already marked as deprecated (via [#493])
560+
* Removed symbols in `parser.*` ([#489] via [#495])
561+
* Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
562+
* Serialization of unsupported enum values might downgrade/migrate/omit them ([#490] via
563+
[#496]) Handling might raise warnings if a data loss occurred due to omitting. The result is a
564+
guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.
565+
* Serialization of any `model.component.Component` with unsupported `type` raises
566+
`exception.serialization.SerializationOfUnsupportedComponentTypeException` ([#490] via [#496]) *
567+
Object `model.bom_ref.BomRef`'s property `value` defaults to `Null`, was arbitrary `UUID` ([#504]
568+
via [#505]) This change does not affect serialization. All `bom-ref`s are guaranteed to have
569+
unique values on rendering.
570+
* Removed helpers from public API ([#503] via [#506])
571+
572+
### Added
573+
574+
* Basic support for CycloneDX 1.5 ([#404] via [#488]) * No data models were enhanced nor added, yet.
575+
Pull requests to add functionality are welcome. * Existing enumerable got new cases, to reflect
576+
features of CycloneDX 1.5 ([#404] via [#488]) * Outputters were enabled to render CycloneDX 1.5
577+
([#404] via [#488])
578+
579+
### Tests
580+
581+
* Created (regression/unit/integration/functional) tests for CycloneDX 1.5 ([#404] via [#488]) *
582+
Created (regression/functional) tests for Enums' handling and completeness ([#490] via [#496])
583+
584+
### Misc
585+
586+
* Bumped dependency `py-serializable@^0.16`, was `@^0.15` (via [#496])
587+
588+
### API Changes — the details for migration
589+
590+
* Added new sub-package `exception.serialization` (via [#496])
591+
* Removed class
592+
`models.ComparableTuple` ([#503] via [#506])
593+
* Enum `model.ExternalReferenceType` got new cases,
594+
to reflect features for CycloneDX 1.5 ([#404] via [#488])
595+
* Removed function `models.get_now_utc`
596+
([#503] via [#506]) * Removed function `models.sha1sum` ([#503] via [#506])
597+
* Enum
598+
`model.component.ComponentType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via
599+
[#488])
600+
* Removed `model.component.Component.__init__()`'s deprecated optional kwarg `namespace`
601+
(via [#493]) Use kwarg `group` instead.
602+
* Removed `model.component.Component.__init__()`'s
603+
deprecated optional kwarg `license_str` (via [#493]) Use kwarg `licenses` instead.
604+
* Removed
605+
deprecated method `model.component.Component.get_namespace()` (via [#493])
606+
* Removed class
607+
`models.dependency.DependencyDependencies` ([#503] via [#506])
608+
* Removed
609+
`model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_name` (via
610+
[#493]) Use kwarg `source` instead.
611+
* Removed `model.vulnerability.Vulnerability.__init__()`'s
612+
deprecated optional kwarg `source_url` (via [#493]) Use kwarg `source` instead.
613+
* Removed
614+
`model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `recommendations` (via
615+
[#493]) Use kwarg `recommendation` instead.
616+
* Removed
617+
`model.vulnerability.VulnerabilityRating.__init__()`'s deprecated optional kwarg `score_base` (via
618+
[#493]) Use kwarg `score` instead.
619+
* Enum `model.vulnerability.VulnerabilityScoreSource` got new
620+
cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
621+
* Removed
622+
`output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
623+
* Removed deprecated function
624+
`output.get_instance()` (via [#493]) Use function `output.make_outputter()` instead. * Added new
625+
class `output.json.JsonV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
626+
* Added new item to
627+
dict `output.json.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
628+
* Added new
629+
class `output.xml.XmlV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
630+
* Added new item to
631+
dict `output.xml.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
632+
* Removed class
633+
`parser.ParserWarning` ([#489] via [#495])
634+
* Removed class `parser.BaseParser` ([#489] via [#495])
635+
* Enum `schema.SchemaVersion` got new case `V1_5`, to reflect CycloneDX 1.5 ([#404] via [#488])
636+
637+
[#404]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/404
638+
[#488]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/488
639+
[#489]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/489
640+
[#490]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/490
641+
[#491]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/491
642+
[#493]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/493
643+
[#494]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/494
644+
[#495]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/495
645+
[#496]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/496
646+
[#503]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/503
647+
[#504]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/504
648+
[#505]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/505
649+
[#506]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/506
503650

504651
## v5.2.0 (2023-12-02)
505652

@@ -556,6 +703,134 @@
556703
- V5.0.0 ([#440](https://github.com/CycloneDX/cyclonedx-python-lib/pull/440),
557704
[`26b151c`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/26b151cba7d7d484f23ee7888444f09ad6d016b1))
558705

706+
### BREAKING CHANGES
707+
* Dropped support for python<3.8 ([#436] via [#441]; enable
708+
[#433])
709+
* Reworked license related models, collections, and factories ([#365] via [#466])
710+
* Behavior * Method `model.bom.Bom.validate()` will throw
711+
`exception.LicenseExpressionAlongWithOthersException`, if detecting invalid license constellation
712+
([#453] via [#452])
713+
* Fixed tuple comparison when unequal lengths (via [#461])
714+
* API * Enum
715+
`schema.SchemaVersion` is no longer string-like ([#442] via [#447])
716+
* Enum `schema.OutputVersion`
717+
is no longer string-like ([#442] via [#447])
718+
* Abstract class `output.BaseOutput` requires
719+
implementation of new method `output_format` ([#446] via [#447])
720+
* Abstract method
721+
`output.BaseOutput.output_as_string()` got new optional parameter `indent` ([#437] via [#458]) *
722+
Abstract method `output.BaseOutput.output_as_string()` accepts arbitrary kwargs (via [#458],
723+
[#462])
724+
* Removed class `factory.license.LicenseChoiceFactory` (via [#466]) The old functionality
725+
was integrated into `factory.license.LicenseFactory`.
726+
* Method
727+
`factory.license.LicenseFactory.make_from_string()`'s parameter `name_or_spdx` was renamed to
728+
`value` (via [#466])
729+
* Method `factory.license.LicenseFactory.make_from_string()`'s return value
730+
can also be a `LicenseExpression` ([#365] via [#466]) The behavior imitates the old
731+
`factory.license.LicenseChoiceFactory.make_from_string()`
732+
* Renamed class `module.License` to
733+
`module.license.DisjunctliveLicense` ([#365] via [#466])
734+
* Removed class `module.LicenseChoice`
735+
([#365] via [#466]) Use dedicated classes `module.license.DisjunctliveLicense` and
736+
`module.license.LicenseExpression` instead
737+
* All occurrences of `models.LicenseChoice` were
738+
replaced by `models.licenses.License` ([#365] via [#466])
739+
* All occurrences of
740+
`SortedSet[LicenseChoice]` were specialized to `models.license.LicenseRepository` ([#365] via
741+
[#466])
742+
743+
### Fixed
744+
* Serialization of multy-licenses ([#365] via [#466]) * Detect unused
745+
"dependent" components in `model.bom.validate()` (via [#464])
746+
747+
### Changed
748+
* Updated latest supported list of supported SPDX license identifiers (via
749+
[#433])
750+
* Shipped schema files are moved to a protected space (via [#433])
751+
These files were never
752+
intended for public use.
753+
* XML output uses a default namespace, which makes results smaller.
754+
([#438] via [#458])
755+
756+
### Added
757+
* Support for Python 3.12 (via [#460])
758+
* JSON- & XML-Validators ([#432],
759+
[#446] via [#433], [#448])
760+
The functionality might require additional dependencies, that can be
761+
installed with the extra "validation". See the docs in section "Installation" for details. * JSON
762+
& XML can be generated in a more human-friendly form ([#437], [#438] via [#458])
763+
* Type hints,
764+
typings & overloads for better integration downstream (via [#463]) * API * New function
765+
`output.make_outputter()` (via [#469]) This replaces the deprecated function
766+
`output.get_instance()`.
767+
* New sub-package `validation` ([#432], [#446] via [#433], [#448],
768+
[#469], [#468], [#469])
769+
* New class `exception.MissingOptionalDependencyException` ([#432] via
770+
[#433]) * New class `exception.LicenseExpressionAlongWithOthersException` ([#453] via [#452]) *
771+
New dictionaries `output.{json,xml}.BY_SCHEMA_VERSION` ([#446] via [#447]) * Existing
772+
implementations of class `output.BaseOutput` now have a new method `output_format` ([#446] via
773+
[#447])
774+
* Existing implementations of method `output.BaseOutput.output_as_string()` got new
775+
optional parameter `indent` ([#437] via [#458])
776+
* Existing implementations of method
777+
`output.BaseOutput.output_to_file()` got new optional parameter `indent` ([#437] via [#458]) * New
778+
method `factory.license.LicenseFactory.make_with_expression()` (via [#466])
779+
* New class
780+
`model.license.DisjunctiveLicense` ([#365] via [#466])
781+
* New class
782+
`model.license.LicenseExpression` ([#365] via [#466])
783+
* New class
784+
`model.license.LicenseRepository` ([#365] via [#466])
785+
* New class
786+
`serialization.LicenseRepositoryHelper` ([#365] via [#466])
787+
788+
### Deprecated
789+
* Function `output.get_instance()` might be removed, use
790+
`output.make_outputter()` instead (via [#469])
791+
792+
### Tests
793+
* Added validation tests with official CycloneDX schema test data ([#432] via
794+
[#433])
795+
* Use proper snapshots, instead of pseudo comparison ([#437] via [#464])
796+
* Added
797+
regression test for bug [#365] (via [#466], [#467])
798+
799+
### Misc
800+
* Dependencies: bumped `py-serializable@^0.15.0`, was `@^0.11.1` (via [#458],
801+
[#463], [#464], [#466])
802+
* Style: streamlined quotes and strings (via [#472])
803+
* Chore: bumped
804+
internal dev- and QA-tools ([#436] via [#441], [#472])
805+
* Chore: added more QA tools to prevent
806+
common security issues (via [#473])
807+
808+
[#432]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/432
809+
[#433]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/433
810+
[#436]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/436
811+
[#437]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/437
812+
[#365]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/365
813+
[#438]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/438
814+
[#440]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/440
815+
[#441]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/441
816+
[#442]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/442
817+
[#446]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/446
818+
[#447]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/447
819+
[#448]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/448
820+
[#452]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/452
821+
[#453]: https://github.com/CycloneDX/cyclonedx-python-lib/issues/453
822+
[#458]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/458
823+
[#460]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/460
824+
[#461]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/461
825+
[#462]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/462
826+
[#463]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/463
827+
[#464]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/464
828+
[#466]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/466
829+
[#467]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/467
830+
[#468]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/468
831+
[#469]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/469
832+
[#472]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/472
833+
[#473]: https://github.com/CycloneDX/cyclonedx-python-lib/pull/473
559834

560835
## v4.2.3 (2023-10-16)
561836

@@ -886,6 +1161,12 @@
8861161

8871162
## v2.0.0 (2022-02-21)
8881163

1164+
### BREAKING Changes
1165+
- BREAKING CHANGE: Adopt PEP-3102
1166+
- BREAKING CHANGE: Optional Lists are now non-optional Sets
1167+
- BREAKING CHANGE: Remove concept of DEFAULT schema version - replaced with LATEST schema version
1168+
- BREAKING CHANGE: Added `BomRef` data type
1169+
8891170
### Bug Fixes
8901171

8911172
- `component.bom_ref` is not Optional in our model implementation (in the schema it is) - we

0 commit comments

Comments
 (0)