From ad3dc9e654e0b09fc4b244b4737aad8ec1be789e Mon Sep 17 00:00:00 2001 From: wievdndr Date: Wed, 17 Dec 2025 10:38:29 +0100 Subject: [PATCH 01/67] fix: add properties field to ModelCard xml and proto to resolve mismatch with json Signed-off-by: wievdndr --- schema/bom-1.5.proto | 2 ++ schema/bom-1.5.xsd | 12 +++++++++++- schema/bom-1.6.proto | 2 ++ schema/bom-1.6.xsd | 10 ++++++++++ schema/bom-1.7.proto | 2 ++ schema/bom-1.7.xsd | 10 ++++++++++ 6 files changed, 37 insertions(+), 1 deletion(-) diff --git a/schema/bom-1.5.proto b/schema/bom-1.5.proto index d99c1a9cc..5e177a5d2 100644 --- a/schema/bom-1.5.proto +++ b/schema/bom-1.5.proto @@ -1009,6 +1009,8 @@ message ModelCard { optional QuantitativeAnalysis quantitativeAnalysis = 3; // What considerations should be taken into account regarding the model's construction, training, and application? optional ModelCardConsiderations considerations = 4; + // Specifies optional, custom, properties + repeated Property properties = 5; message ModelParameters { // The overall approach to learning used by the model for problem solving. diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 0651bcddd..628b774eb 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -2998,7 +2998,7 @@ limitations under the License. describe any mitigation strategy implemented. - + @@ -3008,6 +3008,16 @@ limitations under the License. + + + Provides the ability to document properties in a name/value store. + This provides flexibility to include data not officially supported in the standard + without having to use additional namespaces or create extensions. Property names + of interest to the general public are encouraged to be registered in the + CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. + Formal registration is OPTIONAL. + + diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index ddcfc3f7d..23d48f3f4 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -1152,6 +1152,8 @@ message ModelCard { optional QuantitativeAnalysis quantitativeAnalysis = 3; // What considerations should be taken into account regarding the model's construction, training, and application? optional ModelCardConsiderations considerations = 4; + // Specifies optional, custom, properties + repeated Property properties = 5; message ModelParameters { // The overall approach to learning used by the model for problem-solving. diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 847c5261e..4f803e95a 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -3386,6 +3386,16 @@ limitations under the License. + + + Provides the ability to document properties in a name/value store. + This provides flexibility to include data not officially supported in the standard + without having to use additional namespaces or create extensions. Property names + of interest to the general public are encouraged to be registered in the + CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. + Formal registration is OPTIONAL. + + diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto index 6def360fe..93b085383 100644 --- a/schema/bom-1.7.proto +++ b/schema/bom-1.7.proto @@ -1254,6 +1254,8 @@ message ModelCard { optional QuantitativeAnalysis quantitativeAnalysis = 3; // What considerations should be taken into account regarding the model's construction, training, and application? optional ModelCardConsiderations considerations = 4; + // Specifies optional, custom, properties + repeated Property properties = 5; message ModelParameters { // The overall approach to learning used by the model for problem-solving. diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index deba3de2f..e035d07b7 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -3629,6 +3629,16 @@ limitations under the License. + + + Provides the ability to document properties in a name/value store. + This provides flexibility to include data not officially supported in the standard + without having to use additional namespaces or create extensions. Property names + of interest to the general public are encouraged to be registered in the + CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. + Formal registration is OPTIONAL. + + From f5b3f903c4fa74e55f00b35dda20e6a05639e48c Mon Sep 17 00:00:00 2001 From: wievdndr Date: Wed, 17 Dec 2025 10:56:43 +0100 Subject: [PATCH 02/67] fix: removed some unnecessary whitespace Signed-off-by: wievdndr --- schema/bom-1.5.xsd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 628b774eb..4a02350d2 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -2998,7 +2998,7 @@ limitations under the License. describe any mitigation strategy implemented. - + From 49b747031fe1ff3ddf7c46de5799e27b6307cc5d Mon Sep 17 00:00:00 2001 From: wievdndr Date: Wed, 17 Dec 2025 11:41:48 +0100 Subject: [PATCH 03/67] fix: allow multiple entries for ModelCard considerations lists in xml (so it matches the json spec) Signed-off-by: wievdndr --- schema/bom-1.5.xsd | 8 ++++---- schema/bom-1.6.xsd | 8 ++++---- schema/bom-1.7.xsd | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 0651bcddd..85888d8c0 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -2885,7 +2885,7 @@ limitations under the License. - + @@ -2897,7 +2897,7 @@ limitations under the License. - + @@ -2911,7 +2911,7 @@ limitations under the License. - + @@ -2923,7 +2923,7 @@ limitations under the License. - + diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 847c5261e..2c178462c 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -3256,7 +3256,7 @@ limitations under the License. - + @@ -3268,7 +3268,7 @@ limitations under the License. - + @@ -3282,7 +3282,7 @@ limitations under the License. - + @@ -3294,7 +3294,7 @@ limitations under the License. - + diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index deba3de2f..738cafcee 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -3499,7 +3499,7 @@ limitations under the License. - + @@ -3511,7 +3511,7 @@ limitations under the License. - + @@ -3525,7 +3525,7 @@ limitations under the License. - + @@ -3537,7 +3537,7 @@ limitations under the License. - + From c2c0f3425cfb5d4581628ceff666898c4d132887 Mon Sep 17 00:00:00 2001 From: wievdndr Date: Fri, 19 Dec 2025 09:43:37 +0100 Subject: [PATCH 04/67] fix: update XML schema versions to 1.5.1, 1.6.2, and 1.7.1 Signed-off-by: wievdndr --- schema/bom-1.5.xsd | 2 +- schema/bom-1.6.xsd | 2 +- schema/bom-1.7.xsd | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 85888d8c0..d7a17437c 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.5" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.5.0"> + version="1.5.1"> diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 2c178462c..7d162ee11 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.6" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.6.1"> + version="1.6.2"> diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index 738cafcee..b040c9a4f 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.7" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.7.0"> + version="1.7.1"> From f1b73013aec5e19c3db18f4b3414bbf55fd40c5d Mon Sep 17 00:00:00 2001 From: wievdndr Date: Thu, 15 Jan 2026 15:21:23 +0100 Subject: [PATCH 05/67] fix: bump version numbers in BOM schema files to 1.5.1, 1.6.2, and 1.7.1 Signed-off-by: wievdndr --- schema/bom-1.5.xsd | 2 +- schema/bom-1.6.xsd | 2 +- schema/bom-1.7.xsd | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 4a02350d2..cf00327e9 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.5" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.5.0"> + version="1.5.1"> diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 4f803e95a..cda595592 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.6" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.6.1"> + version="1.6.2"> diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index e035d07b7..c84b2e08f 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.7" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.7.0"> + version="1.7.1"> From 28eed10926d8560f04fbbe79c59cf216eb0ddc3d Mon Sep 17 00:00:00 2001 From: wievdndr Date: Fri, 16 Jan 2026 09:44:16 +0100 Subject: [PATCH 06/67] test: Add second entry for users, useCases, technicalLimitations, and performanceTradeoffs in valid-machine-learning-*.xml test files to verify the schema correctly validates multiple entries for these fields. Signed-off-by: wievdndr --- tools/src/test/resources/1.5/valid-machine-learning-1.5.xml | 4 ++++ tools/src/test/resources/1.6/valid-machine-learning-1.6.xml | 4 ++++ tools/src/test/resources/1.7/valid-machine-learning-1.7.xml | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml index 7c541ecb8..e4a871b85 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml @@ -61,15 +61,19 @@ Who are the intended users of the model? + Data scientists and ML researchers Who are the intended users of the model? + Text-to-image generation for creative applications What are the known technical limitations of the model? + Limited performance on non-photographic styles What are the known tradeoffs in accuracy/performance of the model? + Higher resolution output requires more computational resources diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml index 6013b1c3d..808be3f57 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml @@ -61,15 +61,19 @@ Who are the intended users of the model? + Data scientists and ML researchers Who are the intended users of the model? + Text-to-image generation for creative applications What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance? + Limited performance on non-photographic styles What are the known tradeoffs in accuracy/performance of the model? + Higher resolution output requires more computational resources diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml index 38df43ff7..c235c5693 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml @@ -63,15 +63,19 @@ Who are the intended users of the model? + Data scientists and ML researchers Who are the intended users of the model? + Text-to-image generation for creative applications What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance? + Limited performance on non-photographic styles What are the known tradeoffs in accuracy/performance of the model? + Higher resolution output requires more computational resources From 98eb26fdca2d0ff9acea16a5bdb6c7a66c9da178 Mon Sep 17 00:00:00 2001 From: wievdndr Date: Fri, 16 Jan 2026 10:38:02 +0100 Subject: [PATCH 07/67] test: add tests for custom properties field in modelCard (json, xml, proto) Signed-off-by: wievdndr --- .../test/resources/1.5/valid-machine-learning-1.5.json | 8 +++++++- .../resources/1.5/valid-machine-learning-1.5.textproto | 4 ++++ .../src/test/resources/1.5/valid-machine-learning-1.5.xml | 3 +++ .../test/resources/1.6/valid-machine-learning-1.6.json | 8 +++++++- .../resources/1.6/valid-machine-learning-1.6.textproto | 4 ++++ .../src/test/resources/1.6/valid-machine-learning-1.6.xml | 3 +++ .../test/resources/1.7/valid-machine-learning-1.7.json | 8 +++++++- .../resources/1.7/valid-machine-learning-1.7.textproto | 4 ++++ .../src/test/resources/1.7/valid-machine-learning-1.7.xml | 3 +++ 9 files changed, 42 insertions(+), 3 deletions(-) diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json index 59dc3ceef..58f5572a5 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json @@ -85,7 +85,13 @@ "mitigationStrategy": "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } ] - } + }, + "properties": [ + { + "name": "modelcard:custom-property", + "value": "custom-value" + } + ] } } ] diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto index 4e54321d7..42887baaa 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto @@ -62,5 +62,9 @@ components { mitigationStrategy: "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } } + properties: { + name: "modelcard:custom-property" + value: "custom-value" + } } } diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml index 7c541ecb8..946d0c8f7 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml @@ -86,6 +86,9 @@ + + custom-value + diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json index dbd0ea7b6..df09c03cb 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json @@ -87,7 +87,13 @@ "mitigationStrategy": "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } ] - } + }, + "properties": [ + { + "name": "modelcard:custom-property", + "value": "custom-value" + } + ] } } ] diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto index 54452d656..3a1456e6e 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto @@ -77,5 +77,9 @@ components { mitigationStrategy: "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } } + properties: { + name: "modelcard:custom-property" + value: "custom-value" + } } } diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml index 6013b1c3d..f44f6179d 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml @@ -86,6 +86,9 @@ + + custom-value + diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json index cb64ee801..e7a26820d 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json @@ -95,7 +95,13 @@ "mitigationStrategy": "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } ] - } + }, + "properties": [ + { + "name": "modelcard:custom-property", + "value": "custom-value" + } + ] } } ] diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto index 25b78f5dc..818de8f58 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto @@ -76,5 +76,9 @@ components: { mitigationStrategy: "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." } } + properties: { + name: "modelcard:custom-property" + value: "custom-value" + } } } diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml index 38df43ff7..34305ef92 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml @@ -88,6 +88,9 @@ + + custom-value + From af9df67f85345e78bffc548a36fcf9563c94f834 Mon Sep 17 00:00:00 2001 From: wievdndr Date: Mon, 9 Feb 2026 15:11:34 +0100 Subject: [PATCH 08/67] fix: add another custom property to ModelCard across JSON, XML, and proto files Signed-off-by: wievdndr --- tools/src/test/resources/1.5/valid-machine-learning-1.5.json | 4 ++++ .../test/resources/1.5/valid-machine-learning-1.5.textproto | 4 ++++ tools/src/test/resources/1.5/valid-machine-learning-1.5.xml | 1 + tools/src/test/resources/1.6/valid-machine-learning-1.6.json | 4 ++++ .../test/resources/1.6/valid-machine-learning-1.6.textproto | 4 ++++ tools/src/test/resources/1.6/valid-machine-learning-1.6.xml | 1 + tools/src/test/resources/1.7/valid-machine-learning-1.7.json | 4 ++++ .../test/resources/1.7/valid-machine-learning-1.7.textproto | 4 ++++ tools/src/test/resources/1.7/valid-machine-learning-1.7.xml | 1 + 9 files changed, 27 insertions(+) diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json index 58f5572a5..15ff354da 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json @@ -90,6 +90,10 @@ { "name": "modelcard:custom-property", "value": "custom-value" + }, + { + "name": "modelcard:another-custom-property", + "value": "another-custom-value" } ] } diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto index 42887baaa..a95a91200 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto @@ -66,5 +66,9 @@ components { name: "modelcard:custom-property" value: "custom-value" } + properties: { + name: "modelcard:another-custom-property" + value: "another-custom-value" + } } } diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml index 946d0c8f7..a347856d2 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.xml @@ -88,6 +88,7 @@ custom-value + another-custom-value diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json index df09c03cb..6ab6c4a68 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json @@ -92,6 +92,10 @@ { "name": "modelcard:custom-property", "value": "custom-value" + }, + { + "name": "modelcard:another-custom-property", + "value": "another-custom-value" } ] } diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto index 3a1456e6e..145c80dc7 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto @@ -81,5 +81,9 @@ components { name: "modelcard:custom-property" value: "custom-value" } + properties: { + name: "modelcard:another-custom-property" + value: "another-custom-value" + } } } diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml index f44f6179d..524790bd8 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.xml @@ -88,6 +88,7 @@ custom-value + another-custom-value diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json index e7a26820d..3283961cf 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json @@ -100,6 +100,10 @@ { "name": "modelcard:custom-property", "value": "custom-value" + }, + { + "name": "modelcard:another-custom-property", + "value": "another-custom-value" } ] } diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto index 818de8f58..487c3c721 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto @@ -80,5 +80,9 @@ components: { name: "modelcard:custom-property" value: "custom-value" } + properties: { + name: "modelcard:another-custom-property" + value: "another-custom-value" + } } } diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml index 34305ef92..721544960 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.xml @@ -90,6 +90,7 @@ custom-value + another-custom-value From 1cacb276efa182c283a345cd3eb529a94afef291 Mon Sep 17 00:00:00 2001 From: wievdndr Date: Mon, 9 Feb 2026 15:32:38 +0100 Subject: [PATCH 09/67] fix: add test cases for all supported formats Signed-off-by: wievdndr --- .../resources/1.5/valid-machine-learning-1.5.json | 12 ++++++++---- .../1.5/valid-machine-learning-1.5.textproto | 4 ++++ .../resources/1.6/valid-machine-learning-1.6.json | 12 ++++++++---- .../1.6/valid-machine-learning-1.6.textproto | 4 ++++ .../resources/1.7/valid-machine-learning-1.7.json | 12 ++++++++---- .../1.7/valid-machine-learning-1.7.textproto | 4 ++++ 6 files changed, 36 insertions(+), 12 deletions(-) diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json index 59dc3ceef..e718ecf19 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.json +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.json @@ -60,16 +60,20 @@ }, "considerations": { "users": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Data scientists and ML researchers" ], "useCases": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Text-to-image generation for creative applications" ], "technicalLimitations": [ - "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?", + "Limited performance on non-photographic styles" ], "performanceTradeoffs": [ - "What are the known tradeoffs in accuracy/performance of the model?" + "What are the known tradeoffs in accuracy/performance of the model?", + "Higher resolution output requires more computational resources" ], "ethicalConsiderations": [ { diff --git a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto index 4e54321d7..3d32ef412 100644 --- a/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto +++ b/tools/src/test/resources/1.5/valid-machine-learning-1.5.textproto @@ -48,9 +48,13 @@ components { } considerations: { users: "Who are the intended users of the model?" + users: "Data scientists and ML researchers" useCases: "Who are the intended users of the model?" + useCases: "Text-to-image generation for creative applications" technicalLimitations: "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + technicalLimitations: "Limited performance on non-photographic styles" performanceTradeoffs: "What are the known tradeoffs in accuracy/performance of the model?" + performanceTradeoffs: "Higher resolution output requires more computational resources" ethicalConsiderations: { name: "The name of the risk" mitigationStrategy: "Strategy used to address this risk" diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json index dbd0ea7b6..a96c5e9ce 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.json +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.json @@ -62,16 +62,20 @@ }, "considerations": { "users": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Data scientists and ML researchers" ], "useCases": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Text-to-image generation for creative applications" ], "technicalLimitations": [ - "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?", + "Limited performance on non-photographic styles" ], "performanceTradeoffs": [ - "What are the known tradeoffs in accuracy/performance of the model?" + "What are the known tradeoffs in accuracy/performance of the model?", + "Higher resolution output requires more computational resources" ], "ethicalConsiderations": [ { diff --git a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto index 54452d656..c4594c77f 100644 --- a/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto +++ b/tools/src/test/resources/1.6/valid-machine-learning-1.6.textproto @@ -63,9 +63,13 @@ components { } considerations: { users: "Who are the intended users of the model?" + users: "Data scientists and ML researchers" useCases: "Who are the intended users of the model?" + useCases: "Text-to-image generation for creative applications" technicalLimitations: "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + technicalLimitations: "Limited performance on non-photographic styles" performanceTradeoffs: "What are the known tradeoffs in accuracy/performance of the model?" + performanceTradeoffs: "Higher resolution output requires more computational resources" ethicalConsiderations: { name: "The name of the risk" mitigationStrategy: "Strategy used to address this risk" diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json index cb64ee801..76117eb72 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.json +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.json @@ -70,16 +70,20 @@ }, "considerations": { "users": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Data scientists and ML researchers" ], "useCases": [ - "Who are the intended users of the model?" + "Who are the intended users of the model?", + "Text-to-image generation for creative applications" ], "technicalLimitations": [ - "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?", + "Limited performance on non-photographic styles" ], "performanceTradeoffs": [ - "What are the known tradeoffs in accuracy/performance of the model?" + "What are the known tradeoffs in accuracy/performance of the model?", + "Higher resolution output requires more computational resources" ], "ethicalConsiderations": [ { diff --git a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto index 25b78f5dc..b76fe7a74 100644 --- a/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto +++ b/tools/src/test/resources/1.7/valid-machine-learning-1.7.textproto @@ -62,9 +62,13 @@ components: { } considerations: { users: "Who are the intended users of the model?" + users: "Data scientists and ML researchers" useCases: "Who are the intended users of the model?" + useCases: "Text-to-image generation for creative applications" technicalLimitations: "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?" + technicalLimitations: "Limited performance on non-photographic styles" performanceTradeoffs: "What are the known tradeoffs in accuracy/performance of the model?" + performanceTradeoffs: "Higher resolution output requires more computational resources" ethicalConsiderations: { name: "The name of the risk" mitigationStrategy: "Strategy used to address this risk" From c9f1780c06d2c6a295d97981f42e3e419a9ea4b4 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Mon, 23 Feb 2026 10:19:22 +0100 Subject: [PATCH 10/67] feat: enum labels for spdx.schema.json Signed-off-by: Jan Kowalleck --- schema/spdx.schema.json | 817 +++++++++++++++++- .../org/cyclonedx/tools/SpdxXsdGenerator.java | 31 +- 2 files changed, 839 insertions(+), 9 deletions(-) diff --git a/schema/spdx.schema.json b/schema/spdx.schema.json index 4b837b700..2dccc87e3 100644 --- a/schema/spdx.schema.json +++ b/schema/spdx.schema.json @@ -1,7 +1,7 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "$id": "http://cyclonedx.org/schema/spdx.schema.json", - "$comment": "v1.0-3.28.0", + "$comment": "v1.1-3.28.0", "type": "string", "enum": [ "0BSD", @@ -815,5 +815,818 @@ "vsftpd-openssl-exception", "WxWindows-exception-3.1", "x11vnc-openssl-exception" - ] + ], + "meta:enum": { + "0BSD": "BSD Zero Clause License", + "3D-Slicer-1.0": "3D Slicer License v1.0", + "AAL": "Attribution Assurance License", + "Abstyles": "Abstyles License", + "AdaCore-doc": "AdaCore Doc License", + "Adobe-2006": "Adobe Systems Incorporated Source Code License Agreement", + "Adobe-Display-PostScript": "Adobe Display PostScript License", + "Adobe-Glyph": "Adobe Glyph List License", + "Adobe-Utopia": "Adobe Utopia Font License", + "ADSL": "Amazon Digital Services License", + "Advanced-Cryptics-Dictionary": "Advanced Cryptics Dictionary License", + "AFL-1.1": "Academic Free License v1.1", + "AFL-1.2": "Academic Free License v1.2", + "AFL-2.0": "Academic Free License v2.0", + "AFL-2.1": "Academic Free License v2.1", + "AFL-3.0": "Academic Free License v3.0", + "Afmparse": "Afmparse License", + "AGPL-1.0": "Affero General Public License v1.0", + "AGPL-1.0-only": "Affero General Public License v1.0 only", + "AGPL-1.0-or-later": "Affero General Public License v1.0 or later", + "AGPL-3.0": "GNU Affero General Public License v3.0", + "AGPL-3.0-only": "GNU Affero General Public License v3.0 only", + "AGPL-3.0-or-later": "GNU Affero General Public License v3.0 or later", + "Aladdin": "Aladdin Free Public License", + "ALGLIB-Documentation": "ALGLIB Documentation License", + "AMD-newlib": "AMD newlib License", + "AMDPLPA": "AMD's plpa_map.c License", + "AML": "Apple MIT License", + "AML-glslang": "AML glslang variant License", + "AMPAS": "Academy of Motion Picture Arts and Sciences BSD", + "ANTLR-PD": "ANTLR Software Rights Notice", + "ANTLR-PD-fallback": "ANTLR Software Rights Notice with license fallback", + "any-OSI": "Any OSI License", + "any-OSI-perl-modules": "Any OSI License - Perl Modules", + "Apache-1.0": "Apache License 1.0", + "Apache-1.1": "Apache License 1.1", + "Apache-2.0": "Apache License 2.0", + "APAFML": "Adobe Postscript AFM License", + "APL-1.0": "Adaptive Public License 1.0", + "App-s2p": "App::s2p License", + "APSL-1.0": "Apple Public Source License 1.0", + "APSL-1.1": "Apple Public Source License 1.1", + "APSL-1.2": "Apple Public Source License 1.2", + "APSL-2.0": "Apple Public Source License 2.0", + "Arphic-1999": "Arphic Public License", + "Artistic-1.0": "Artistic License 1.0", + "Artistic-1.0-cl8": "Artistic License 1.0 w\/clause 8", + "Artistic-1.0-Perl": "Artistic License 1.0 (Perl)", + "Artistic-2.0": "Artistic License 2.0", + "Artistic-dist": "Artistic License 1.0 (dist)", + "Aspell-RU": "Aspell Russian License", + "ASWF-Digital-Assets-1.0": "ASWF Digital Assets License version 1.0", + "ASWF-Digital-Assets-1.1": "ASWF Digital Assets License 1.1", + "Baekmuk": "Baekmuk License", + "Bahyph": "Bahyph License", + "Barr": "Barr License", + "bcrypt-Solar-Designer": "bcrypt Solar Designer License", + "Beerware": "Beerware License", + "Bitstream-Charter": "Bitstream Charter Font License", + "Bitstream-Vera": "Bitstream Vera Font License", + "BitTorrent-1.0": "BitTorrent Open Source License v1.0", + "BitTorrent-1.1": "BitTorrent Open Source License v1.1", + "blessing": "SQLite Blessing", + "BlueOak-1.0.0": "Blue Oak Model License 1.0.0", + "Boehm-GC": "Boehm-Demers-Weiser GC License", + "Boehm-GC-without-fee": "Boehm-Demers-Weiser GC License (without fee)", + "BOLA-1.1": "Buena Onda License Agreement v1.1", + "Borceux": "Borceux license", + "Brian-Gladman-2-Clause": "Brian Gladman 2-Clause License", + "Brian-Gladman-3-Clause": "Brian Gladman 3-Clause License", + "BSD-1-Clause": "BSD 1-Clause License", + "BSD-2-Clause": "BSD 2-Clause \"Simplified\" License", + "BSD-2-Clause-Darwin": "BSD 2-Clause - Ian Darwin variant", + "BSD-2-Clause-first-lines": "BSD 2-Clause - first lines requirement", + "BSD-2-Clause-FreeBSD": "BSD 2-Clause FreeBSD License", + "BSD-2-Clause-NetBSD": "BSD 2-Clause NetBSD License", + "BSD-2-Clause-Patent": "BSD-2-Clause Plus Patent License", + "BSD-2-Clause-pkgconf-disclaimer": "BSD 2-Clause pkgconf disclaimer variant", + "BSD-2-Clause-Views": "BSD 2-Clause with views sentence", + "BSD-3-Clause": "BSD 3-Clause \"New\" or \"Revised\" License", + "BSD-3-Clause-acpica": "BSD 3-Clause acpica variant", + "BSD-3-Clause-Attribution": "BSD with attribution", + "BSD-3-Clause-Clear": "BSD 3-Clause Clear License", + "BSD-3-Clause-flex": "BSD 3-Clause Flex variant", + "BSD-3-Clause-HP": "Hewlett-Packard BSD variant license", + "BSD-3-Clause-LBNL": "Lawrence Berkeley National Labs BSD variant license", + "BSD-3-Clause-Modification": "BSD 3-Clause Modification", + "BSD-3-Clause-No-Military-License": "BSD 3-Clause No Military License", + "BSD-3-Clause-No-Nuclear-License": "BSD 3-Clause No Nuclear License", + "BSD-3-Clause-No-Nuclear-License-2014": "BSD 3-Clause No Nuclear License 2014", + "BSD-3-Clause-No-Nuclear-Warranty": "BSD 3-Clause No Nuclear Warranty", + "BSD-3-Clause-Open-MPI": "BSD 3-Clause Open MPI variant", + "BSD-3-Clause-Sun": "BSD 3-Clause Sun Microsystems", + "BSD-3-Clause-Tso": "BSD 3-Clause Tso variant", + "BSD-4-Clause": "BSD 4-Clause \"Original\" or \"Old\" License", + "BSD-4-Clause-Shortened": "BSD 4 Clause Shortened", + "BSD-4-Clause-UC": "BSD-4-Clause (University of California-Specific)", + "BSD-4.3RENO": "BSD 4.3 RENO License", + "BSD-4.3TAHOE": "BSD 4.3 TAHOE License", + "BSD-Advertising-Acknowledgement": "BSD Advertising Acknowledgement License", + "BSD-Attribution-HPND-disclaimer": "BSD with Attribution and HPND disclaimer", + "BSD-Inferno-Nettverk": "BSD-Inferno-Nettverk", + "BSD-Mark-Modifications": "BSD Mark Modifications License", + "BSD-Protection": "BSD Protection License", + "BSD-Source-beginning-file": "BSD Source Code Attribution - beginning of file variant", + "BSD-Source-Code": "BSD Source Code Attribution", + "BSD-Systemics": "Systemics BSD variant license", + "BSD-Systemics-W3Works": "Systemics W3Works BSD variant license", + "BSL-1.0": "Boost Software License 1.0", + "Buddy": "Buddy License", + "BUSL-1.1": "Business Source License 1.1", + "bzip2-1.0.5": "bzip2 and libbzip2 License v1.0.5", + "bzip2-1.0.6": "bzip2 and libbzip2 License v1.0.6", + "C-UDA-1.0": "Computational Use of Data Agreement v1.0", + "CAL-1.0": "Cryptographic Autonomy License 1.0", + "CAL-1.0-Combined-Work-Exception": "Cryptographic Autonomy License 1.0 (Combined Work Exception)", + "Caldera": "Caldera License", + "Caldera-no-preamble": "Caldera License (without preamble)", + "CAPEC-tou": "Common Attack Pattern Enumeration and Classification License", + "Catharon": "Catharon License", + "CATOSL-1.1": "Computer Associates Trusted Open Source License 1.1", + "CC-BY-1.0": "Creative Commons Attribution 1.0 Generic", + "CC-BY-2.0": "Creative Commons Attribution 2.0 Generic", + "CC-BY-2.5": "Creative Commons Attribution 2.5 Generic", + "CC-BY-2.5-AU": "Creative Commons Attribution 2.5 Australia", + "CC-BY-3.0": "Creative Commons Attribution 3.0 Unported", + "CC-BY-3.0-AT": "Creative Commons Attribution 3.0 Austria", + "CC-BY-3.0-AU": "Creative Commons Attribution 3.0 Australia", + "CC-BY-3.0-DE": "Creative Commons Attribution 3.0 Germany", + "CC-BY-3.0-IGO": "Creative Commons Attribution 3.0 IGO", + "CC-BY-3.0-NL": "Creative Commons Attribution 3.0 Netherlands", + "CC-BY-3.0-US": "Creative Commons Attribution 3.0 United States", + "CC-BY-4.0": "Creative Commons Attribution 4.0 International", + "CC-BY-NC-1.0": "Creative Commons Attribution Non Commercial 1.0 Generic", + "CC-BY-NC-2.0": "Creative Commons Attribution Non Commercial 2.0 Generic", + "CC-BY-NC-2.5": "Creative Commons Attribution Non Commercial 2.5 Generic", + "CC-BY-NC-3.0": "Creative Commons Attribution Non Commercial 3.0 Unported", + "CC-BY-NC-3.0-DE": "Creative Commons Attribution Non Commercial 3.0 Germany", + "CC-BY-NC-4.0": "Creative Commons Attribution Non Commercial 4.0 International", + "CC-BY-NC-ND-1.0": "Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic", + "CC-BY-NC-ND-2.0": "Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic", + "CC-BY-NC-ND-2.5": "Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic", + "CC-BY-NC-ND-3.0": "Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported", + "CC-BY-NC-ND-3.0-DE": "Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany", + "CC-BY-NC-ND-3.0-IGO": "Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO", + "CC-BY-NC-ND-4.0": "Creative Commons Attribution Non Commercial No Derivatives 4.0 International", + "CC-BY-NC-SA-1.0": "Creative Commons Attribution Non Commercial Share Alike 1.0 Generic", + "CC-BY-NC-SA-2.0": "Creative Commons Attribution Non Commercial Share Alike 2.0 Generic", + "CC-BY-NC-SA-2.0-DE": "Creative Commons Attribution Non Commercial Share Alike 2.0 Germany", + "CC-BY-NC-SA-2.0-FR": "Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France", + "CC-BY-NC-SA-2.0-UK": "Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales", + "CC-BY-NC-SA-2.5": "Creative Commons Attribution Non Commercial Share Alike 2.5 Generic", + "CC-BY-NC-SA-3.0": "Creative Commons Attribution Non Commercial Share Alike 3.0 Unported", + "CC-BY-NC-SA-3.0-DE": "Creative Commons Attribution Non Commercial Share Alike 3.0 Germany", + "CC-BY-NC-SA-3.0-IGO": "Creative Commons Attribution Non Commercial Share Alike 3.0 IGO", + "CC-BY-NC-SA-4.0": "Creative Commons Attribution Non Commercial Share Alike 4.0 International", + "CC-BY-ND-1.0": "Creative Commons Attribution No Derivatives 1.0 Generic", + "CC-BY-ND-2.0": "Creative Commons Attribution No Derivatives 2.0 Generic", + "CC-BY-ND-2.5": "Creative Commons Attribution No Derivatives 2.5 Generic", + "CC-BY-ND-3.0": "Creative Commons Attribution No Derivatives 3.0 Unported", + "CC-BY-ND-3.0-DE": "Creative Commons Attribution No Derivatives 3.0 Germany", + "CC-BY-ND-4.0": "Creative Commons Attribution No Derivatives 4.0 International", + "CC-BY-SA-1.0": "Creative Commons Attribution Share Alike 1.0 Generic", + "CC-BY-SA-2.0": "Creative Commons Attribution Share Alike 2.0 Generic", + "CC-BY-SA-2.0-UK": "Creative Commons Attribution Share Alike 2.0 England and Wales", + "CC-BY-SA-2.1-JP": "Creative Commons Attribution Share Alike 2.1 Japan", + "CC-BY-SA-2.5": "Creative Commons Attribution Share Alike 2.5 Generic", + "CC-BY-SA-3.0": "Creative Commons Attribution Share Alike 3.0 Unported", + "CC-BY-SA-3.0-AT": "Creative Commons Attribution Share Alike 3.0 Austria", + "CC-BY-SA-3.0-DE": "Creative Commons Attribution Share Alike 3.0 Germany", + "CC-BY-SA-3.0-IGO": "Creative Commons Attribution-ShareAlike 3.0 IGO", + "CC-BY-SA-4.0": "Creative Commons Attribution Share Alike 4.0 International", + "CC-PDDC": "Creative Commons Public Domain Dedication and Certification", + "CC-PDM-1.0": "Creative Commons Public Domain Mark 1.0 Universal", + "CC-SA-1.0": "Creative Commons Share Alike 1.0 Generic", + "CC0-1.0": "Creative Commons Zero v1.0 Universal", + "CDDL-1.0": "Common Development and Distribution License 1.0", + "CDDL-1.1": "Common Development and Distribution License 1.1", + "CDL-1.0": "Common Documentation License 1.0", + "CDLA-Permissive-1.0": "Community Data License Agreement Permissive 1.0", + "CDLA-Permissive-2.0": "Community Data License Agreement Permissive 2.0", + "CDLA-Sharing-1.0": "Community Data License Agreement Sharing 1.0", + "CECILL-1.0": "CeCILL Free Software License Agreement v1.0", + "CECILL-1.1": "CeCILL Free Software License Agreement v1.1", + "CECILL-2.0": "CeCILL Free Software License Agreement v2.0", + "CECILL-2.1": "CeCILL Free Software License Agreement v2.1", + "CECILL-B": "CeCILL-B Free Software License Agreement", + "CECILL-C": "CeCILL-C Free Software License Agreement", + "CERN-OHL-1.1": "CERN Open Hardware Licence v1.1", + "CERN-OHL-1.2": "CERN Open Hardware Licence v1.2", + "CERN-OHL-P-2.0": "CERN Open Hardware Licence Version 2 - Permissive", + "CERN-OHL-S-2.0": "CERN Open Hardware Licence Version 2 - Strongly Reciprocal", + "CERN-OHL-W-2.0": "CERN Open Hardware Licence Version 2 - Weakly Reciprocal", + "CFITSIO": "CFITSIO License", + "check-cvs": "check-cvs License", + "checkmk": "Checkmk License", + "ClArtistic": "Clarified Artistic License", + "Clips": "Clips License", + "CMU-Mach": "CMU Mach License", + "CMU-Mach-nodoc": "CMU Mach - no notices-in-documentation variant", + "CNRI-Jython": "CNRI Jython License", + "CNRI-Python": "CNRI Python License", + "CNRI-Python-GPL-Compatible": "CNRI Python Open Source GPL Compatible License Agreement", + "COIL-1.0": "Copyfree Open Innovation License", + "Community-Spec-1.0": "Community Specification License 1.0", + "Condor-1.1": "Condor Public License v1.1", + "copyleft-next-0.3.0": "copyleft-next 0.3.0", + "copyleft-next-0.3.1": "copyleft-next 0.3.1", + "Cornell-Lossless-JPEG": "Cornell Lossless JPEG License", + "CPAL-1.0": "Common Public Attribution License 1.0", + "CPL-1.0": "Common Public License 1.0", + "CPOL-1.02": "Code Project Open License 1.02", + "Cronyx": "Cronyx License", + "Crossword": "Crossword License", + "CryptoSwift": "CryptoSwift License", + "CrystalStacker": "CrystalStacker License", + "CUA-OPL-1.0": "CUA Office Public License v1.0", + "Cube": "Cube License", + "curl": "curl License", + "cve-tou": "Common Vulnerability Enumeration ToU License", + "D-FSL-1.0": "Deutsche Freie Software Lizenz", + "DEC-3-Clause": "DEC 3-Clause License", + "diffmark": "diffmark license", + "DL-DE-BY-2.0": "Data licence Germany \u2013 attribution \u2013 version 2.0", + "DL-DE-ZERO-2.0": "Data licence Germany \u2013 zero \u2013 version 2.0", + "DOC": "DOC License", + "DocBook-DTD": "DocBook DTD License", + "DocBook-Schema": "DocBook Schema License", + "DocBook-Stylesheet": "DocBook Stylesheet License", + "DocBook-XML": "DocBook XML License", + "Dotseqn": "Dotseqn License", + "DRL-1.0": "Detection Rule License 1.0", + "DRL-1.1": "Detection Rule License 1.1", + "DSDP": "DSDP License", + "dtoa": "David M. Gay dtoa License", + "dvipdfm": "dvipdfm License", + "ECL-1.0": "Educational Community License v1.0", + "ECL-2.0": "Educational Community License v2.0", + "eCos-2.0": "eCos license version 2.0", + "EFL-1.0": "Eiffel Forum License v1.0", + "EFL-2.0": "Eiffel Forum License v2.0", + "eGenix": "eGenix.com Public License 1.1.0", + "Elastic-2.0": "Elastic License 2.0", + "Entessa": "Entessa Public License v1.0", + "EPICS": "EPICS Open License", + "EPL-1.0": "Eclipse Public License 1.0", + "EPL-2.0": "Eclipse Public License 2.0", + "ErlPL-1.1": "Erlang Public License v1.1", + "ESA-PL-permissive-2.4": "European Space Agency Public License \u2013 v2.4 \u2013 Permissive (Type 3)", + "ESA-PL-strong-copyleft-2.4": "European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)", + "ESA-PL-weak-copyleft-2.4": "European Space Agency Public License \u2013 v2.4 \u2013 Weak Copyleft (Type 2)", + "etalab-2.0": "Etalab Open License 2.0", + "EUDatagrid": "EU DataGrid Software License", + "EUPL-1.0": "European Union Public License 1.0", + "EUPL-1.1": "European Union Public License 1.1", + "EUPL-1.2": "European Union Public License 1.2", + "Eurosym": "Eurosym License", + "Fair": "Fair License", + "FBM": "Fuzzy Bitmap License", + "FDK-AAC": "Fraunhofer FDK AAC Codec Library", + "Ferguson-Twofish": "Ferguson Twofish License", + "Frameworx-1.0": "Frameworx Open License 1.0", + "FreeBSD-DOC": "FreeBSD Documentation License", + "FreeImage": "FreeImage Public License v1.0", + "FSFAP": "FSF All Permissive License", + "FSFAP-no-warranty-disclaimer": "FSF All Permissive License (without Warranty)", + "FSFUL": "FSF Unlimited License", + "FSFULLR": "FSF Unlimited License (with License Retention)", + "FSFULLRSD": "FSF Unlimited License (with License Retention and Short Disclaimer)", + "FSFULLRWD": "FSF Unlimited License (With License Retention and Warranty Disclaimer)", + "FSL-1.1-ALv2": "Functional Source License, Version 1.1, ALv2 Future License", + "FSL-1.1-MIT": "Functional Source License, Version 1.1, MIT Future License", + "FTL": "Freetype Project License", + "Furuseth": "Furuseth License", + "fwlw": "fwlw License", + "Game-Programming-Gems": "Game Programming Gems License", + "GCR-docs": "Gnome GCR Documentation License", + "GD": "GD License", + "generic-xts": "Generic XTS License", + "GFDL-1.1": "GNU Free Documentation License v1.1", + "GFDL-1.1-invariants-only": "GNU Free Documentation License v1.1 only - invariants", + "GFDL-1.1-invariants-or-later": "GNU Free Documentation License v1.1 or later - invariants", + "GFDL-1.1-no-invariants-only": "GNU Free Documentation License v1.1 only - no invariants", + "GFDL-1.1-no-invariants-or-later": "GNU Free Documentation License v1.1 or later - no invariants", + "GFDL-1.1-only": "GNU Free Documentation License v1.1 only", + "GFDL-1.1-or-later": "GNU Free Documentation License v1.1 or later", + "GFDL-1.2": "GNU Free Documentation License v1.2", + "GFDL-1.2-invariants-only": "GNU Free Documentation License v1.2 only - invariants", + "GFDL-1.2-invariants-or-later": "GNU Free Documentation License v1.2 or later - invariants", + "GFDL-1.2-no-invariants-only": "GNU Free Documentation License v1.2 only - no invariants", + "GFDL-1.2-no-invariants-or-later": "GNU Free Documentation License v1.2 or later - no invariants", + "GFDL-1.2-only": "GNU Free Documentation License v1.2 only", + "GFDL-1.2-or-later": "GNU Free Documentation License v1.2 or later", + "GFDL-1.3": "GNU Free Documentation License v1.3", + "GFDL-1.3-invariants-only": "GNU Free Documentation License v1.3 only - invariants", + "GFDL-1.3-invariants-or-later": "GNU Free Documentation License v1.3 or later - invariants", + "GFDL-1.3-no-invariants-only": "GNU Free Documentation License v1.3 only - no invariants", + "GFDL-1.3-no-invariants-or-later": "GNU Free Documentation License v1.3 or later - no invariants", + "GFDL-1.3-only": "GNU Free Documentation License v1.3 only", + "GFDL-1.3-or-later": "GNU Free Documentation License v1.3 or later", + "Giftware": "Giftware License", + "GL2PS": "GL2PS License", + "Glide": "3dfx Glide License", + "Glulxe": "Glulxe License", + "GLWTPL": "Good Luck With That Public License", + "gnuplot": "gnuplot License", + "GPL-1.0": "GNU General Public License v1.0 only", + "GPL-1.0+": "GNU General Public License v1.0 or later", + "GPL-1.0-only": "GNU General Public License v1.0 only", + "GPL-1.0-or-later": "GNU General Public License v1.0 or later", + "GPL-2.0": "GNU General Public License v2.0 only", + "GPL-2.0+": "GNU General Public License v2.0 or later", + "GPL-2.0-only": "GNU General Public License v2.0 only", + "GPL-2.0-or-later": "GNU General Public License v2.0 or later", + "GPL-2.0-with-autoconf-exception": "GNU General Public License v2.0 w\/Autoconf exception", + "GPL-2.0-with-bison-exception": "GNU General Public License v2.0 w\/Bison exception", + "GPL-2.0-with-classpath-exception": "GNU General Public License v2.0 w\/Classpath exception", + "GPL-2.0-with-font-exception": "GNU General Public License v2.0 w\/Font exception", + "GPL-2.0-with-GCC-exception": "GNU General Public License v2.0 w\/GCC Runtime Library exception", + "GPL-3.0": "GNU General Public License v3.0 only", + "GPL-3.0+": "GNU General Public License v3.0 or later", + "GPL-3.0-only": "GNU General Public License v3.0 only", + "GPL-3.0-or-later": "GNU General Public License v3.0 or later", + "GPL-3.0-with-autoconf-exception": "GNU General Public License v3.0 w\/Autoconf exception", + "GPL-3.0-with-GCC-exception": "GNU General Public License v3.0 w\/GCC Runtime Library exception", + "Graphics-Gems": "Graphics Gems License", + "gSOAP-1.3b": "gSOAP Public License v1.3b", + "gtkbook": "gtkbook License", + "Gutmann": "Gutmann License", + "HaskellReport": "Haskell Language Report License", + "HDF5": "HDF5 License", + "hdparm": "hdparm License", + "HIDAPI": "HIDAPI License", + "Hippocratic-2.1": "Hippocratic License 2.1", + "HP-1986": "Hewlett-Packard 1986 License", + "HP-1989": "Hewlett-Packard 1989 License", + "HPND": "Historical Permission Notice and Disclaimer", + "HPND-DEC": "Historical Permission Notice and Disclaimer - DEC variant", + "HPND-doc": "Historical Permission Notice and Disclaimer - documentation variant", + "HPND-doc-sell": "Historical Permission Notice and Disclaimer - documentation sell variant", + "HPND-export-US": "HPND with US Government export control warning", + "HPND-export-US-acknowledgement": "HPND with US Government export control warning and acknowledgment", + "HPND-export-US-modify": "HPND with US Government export control warning and modification rqmt", + "HPND-export2-US": "HPND with US Government export control and 2 disclaimers", + "HPND-Fenneberg-Livingston": "Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant", + "HPND-INRIA-IMAG": "Historical Permission Notice and Disclaimer - INRIA-IMAG variant", + "HPND-Intel": "Historical Permission Notice and Disclaimer - Intel variant", + "HPND-Kevlin-Henney": "Historical Permission Notice and Disclaimer - Kevlin Henney variant", + "HPND-Markus-Kuhn": "Historical Permission Notice and Disclaimer - Markus Kuhn variant", + "HPND-merchantability-variant": "Historical Permission Notice and Disclaimer - merchantability variant", + "HPND-MIT-disclaimer": "Historical Permission Notice and Disclaimer with MIT disclaimer", + "HPND-Netrek": "Historical Permission Notice and Disclaimer - Netrek variant", + "HPND-Pbmplus": "Historical Permission Notice and Disclaimer - Pbmplus variant", + "HPND-sell-MIT-disclaimer-xserver": "Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer", + "HPND-sell-regexpr": "Historical Permission Notice and Disclaimer - sell regexpr variant", + "HPND-sell-variant": "Historical Permission Notice and Disclaimer - sell variant", + "HPND-sell-variant-critical-systems": "HPND - sell variant with safety critical systems clause", + "HPND-sell-variant-MIT-disclaimer": "HPND sell variant with MIT disclaimer", + "HPND-sell-variant-MIT-disclaimer-rev": "HPND sell variant with MIT disclaimer - reverse", + "HPND-SMC": "Historical Permission Notice and Disclaimer - SMC variant", + "HPND-UC": "Historical Permission Notice and Disclaimer - University of California variant", + "HPND-UC-export-US": "Historical Permission Notice and Disclaimer - University of California, US export warning", + "HTMLTIDY": "HTML Tidy License", + "hyphen-bulgarian": "hyphen-bulgarian License", + "IBM-pibs": "IBM PowerPC Initialization and Boot Software", + "ICU": "ICU License", + "IEC-Code-Components-EULA": "IEC Code Components End-user licence agreement", + "IJG": "Independent JPEG Group License", + "IJG-short": "Independent JPEG Group License - short", + "ImageMagick": "ImageMagick License", + "iMatix": "iMatix Standard Function Library Agreement", + "Imlib2": "Imlib2 License", + "Info-ZIP": "Info-ZIP License", + "Inner-Net-2.0": "Inner Net License v2.0", + "InnoSetup": "Inno Setup License", + "Intel": "Intel Open Source License", + "Intel-ACPI": "Intel ACPI Software License Agreement", + "Interbase-1.0": "Interbase Public License v1.0", + "IPA": "IPA Font License", + "IPL-1.0": "IBM Public License v1.0", + "ISC": "ISC License", + "ISC-Veillard": "ISC Veillard variant", + "ISO-permission": "ISO permission notice", + "Jam": "Jam License", + "JasPer-2.0": "JasPer License", + "jove": "Jove License", + "JPL-image": "JPL Image Use Policy", + "JPNIC": "Japan Network Information Center License", + "JSON": "JSON License", + "Kastrup": "Kastrup License", + "Kazlib": "Kazlib License", + "Knuth-CTAN": "Knuth CTAN License", + "LAL-1.2": "Licence Art Libre 1.2", + "LAL-1.3": "Licence Art Libre 1.3", + "Latex2e": "Latex2e License", + "Latex2e-translated-notice": "Latex2e with translated notice permission", + "Leptonica": "Leptonica License", + "LGPL-2.0": "GNU Library General Public License v2 only", + "LGPL-2.0+": "GNU Library General Public License v2 or later", + "LGPL-2.0-only": "GNU Library General Public License v2 only", + "LGPL-2.0-or-later": "GNU Library General Public License v2 or later", + "LGPL-2.1": "GNU Lesser General Public License v2.1 only", + "LGPL-2.1+": "GNU Lesser General Public License v2.1 or later", + "LGPL-2.1-only": "GNU Lesser General Public License v2.1 only", + "LGPL-2.1-or-later": "GNU Lesser General Public License v2.1 or later", + "LGPL-3.0": "GNU Lesser General Public License v3.0 only", + "LGPL-3.0+": "GNU Lesser General Public License v3.0 or later", + "LGPL-3.0-only": "GNU Lesser General Public License v3.0 only", + "LGPL-3.0-or-later": "GNU Lesser General Public License v3.0 or later", + "LGPLLR": "Lesser General Public License For Linguistic Resources", + "Libpng": "libpng License", + "libpng-1.6.35": "PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)", + "libpng-2.0": "PNG Reference Library version 2", + "libselinux-1.0": "libselinux public domain notice", + "libtiff": "libtiff License", + "libutil-David-Nugent": "libutil David Nugent License", + "LiLiQ-P-1.1": "Licence Libre du Qu\u00E9bec \u2013 Permissive version 1.1", + "LiLiQ-R-1.1": "Licence Libre du Qu\u00E9bec \u2013 R\u00E9ciprocit\u00E9 version 1.1", + "LiLiQ-Rplus-1.1": "Licence Libre du Qu\u00E9bec \u2013 R\u00E9ciprocit\u00E9 forte version 1.1", + "Linux-man-pages-1-para": "Linux man-pages - 1 paragraph", + "Linux-man-pages-copyleft": "Linux man-pages Copyleft", + "Linux-man-pages-copyleft-2-para": "Linux man-pages Copyleft - 2 paragraphs", + "Linux-man-pages-copyleft-var": "Linux man-pages Copyleft Variant", + "Linux-OpenIB": "Linux Kernel Variant of OpenIB.org license", + "LOOP": "Common Lisp LOOP License", + "LPD-document": "LPD Documentation License", + "LPL-1.0": "Lucent Public License Version 1.0", + "LPL-1.02": "Lucent Public License v1.02", + "LPPL-1.0": "LaTeX Project Public License v1.0", + "LPPL-1.1": "LaTeX Project Public License v1.1", + "LPPL-1.2": "LaTeX Project Public License v1.2", + "LPPL-1.3a": "LaTeX Project Public License v1.3a", + "LPPL-1.3c": "LaTeX Project Public License v1.3c", + "lsof": "lsof License", + "Lucida-Bitmap-Fonts": "Lucida Bitmap Fonts License", + "LZMA-SDK-9.11-to-9.20": "LZMA SDK License (versions 9.11 to 9.20)", + "LZMA-SDK-9.22": "LZMA SDK License (versions 9.22 and beyond)", + "Mackerras-3-Clause": "Mackerras 3-Clause License", + "Mackerras-3-Clause-acknowledgment": "Mackerras 3-Clause - acknowledgment variant", + "magaz": "magaz License", + "mailprio": "mailprio License", + "MakeIndex": "MakeIndex License", + "man2html": "man2html License", + "Martin-Birgmeier": "Martin Birgmeier License", + "McPhee-slideshow": "McPhee Slideshow License", + "metamail": "metamail License", + "Minpack": "Minpack License", + "MIPS": "MIPS License", + "MirOS": "The MirOS Licence", + "MIT": "MIT License", + "MIT-0": "MIT No Attribution", + "MIT-advertising": "Enlightenment License (e16)", + "MIT-Click": "MIT Click License", + "MIT-CMU": "CMU License", + "MIT-enna": "enna License", + "MIT-feh": "feh License", + "MIT-Festival": "MIT Festival Variant", + "MIT-Khronos-old": "MIT Khronos - old variant", + "MIT-Modern-Variant": "MIT License Modern Variant", + "MIT-open-group": "MIT Open Group variant", + "MIT-STK": "MIT-STK License", + "MIT-testregex": "MIT testregex Variant", + "MIT-Wu": "MIT Tom Wu Variant", + "MITNFA": "MIT +no-false-attribs license", + "MMIXware": "MMIXware License", + "MMPL-1.0.1": "Minecraft Mod Public License v1.0.1", + "Motosoto": "Motosoto License", + "MPEG-SSG": "MPEG Software Simulation", + "mpi-permissive": "mpi Permissive License", + "mpich2": "mpich2 License", + "MPL-1.0": "Mozilla Public License 1.0", + "MPL-1.1": "Mozilla Public License 1.1", + "MPL-2.0": "Mozilla Public License 2.0", + "MPL-2.0-no-copyleft-exception": "Mozilla Public License 2.0 (no copyleft exception)", + "mplus": "mplus Font License", + "MS-LPL": "Microsoft Limited Public License", + "MS-PL": "Microsoft Public License", + "MS-RL": "Microsoft Reciprocal License", + "MTLL": "Matrix Template Library License", + "MulanPSL-1.0": "Mulan Permissive Software License, Version 1", + "MulanPSL-2.0": "Mulan Permissive Software License, Version 2", + "Multics": "Multics License", + "Mup": "Mup License", + "NAIST-2003": "Nara Institute of Science and Technology License (2003)", + "NASA-1.3": "NASA Open Source Agreement 1.3", + "Naumen": "Naumen Public License", + "NBPL-1.0": "Net Boolean Public License v1", + "NCBI-PD": "NCBI Public Domain Notice", + "NCGL-UK-2.0": "Non-Commercial Government Licence", + "NCL": "NCL Source Code License", + "NCSA": "University of Illinois\/NCSA Open Source License", + "Net-SNMP": "Net-SNMP License", + "NetCDF": "NetCDF license", + "Newsletr": "Newsletr License", + "NGPL": "Nethack General Public License", + "ngrep": "ngrep License", + "NICTA-1.0": "NICTA Public Software License, Version 1.0", + "NIST-PD": "NIST Public Domain Notice", + "NIST-PD-fallback": "NIST Public Domain Notice with license fallback", + "NIST-PD-TNT": "NIST Public Domain Notice TNT variant", + "NIST-Software": "NIST Software License", + "NLOD-1.0": "Norwegian Licence for Open Government Data (NLOD) 1.0", + "NLOD-2.0": "Norwegian Licence for Open Government Data (NLOD) 2.0", + "NLPL": "No Limit Public License", + "Nokia": "Nokia Open Source License", + "NOSL": "Netizen Open Source License", + "Noweb": "Noweb License", + "NPL-1.0": "Netscape Public License v1.0", + "NPL-1.1": "Netscape Public License v1.1", + "NPOSL-3.0": "Non-Profit Open Software License 3.0", + "NRL": "NRL License", + "NTIA-PD": "NTIA Public Domain Notice", + "NTP": "NTP License", + "NTP-0": "NTP No Attribution", + "Nunit": "Nunit License", + "O-UDA-1.0": "Open Use of Data Agreement v1.0", + "OAR": "OAR License", + "OCCT-PL": "Open CASCADE Technology Public License", + "OCLC-2.0": "OCLC Research Public License 2.0", + "ODbL-1.0": "Open Data Commons Open Database License v1.0", + "ODC-By-1.0": "Open Data Commons Attribution License v1.0", + "OFFIS": "OFFIS License", + "OFL-1.0": "SIL Open Font License 1.0", + "OFL-1.0-no-RFN": "SIL Open Font License 1.0 with no Reserved Font Name", + "OFL-1.0-RFN": "SIL Open Font License 1.0 with Reserved Font Name", + "OFL-1.1": "SIL Open Font License 1.1", + "OFL-1.1-no-RFN": "SIL Open Font License 1.1 with no Reserved Font Name", + "OFL-1.1-RFN": "SIL Open Font License 1.1 with Reserved Font Name", + "OGC-1.0": "OGC Software License, Version 1.0", + "OGDL-Taiwan-1.0": "Taiwan Open Government Data License, version 1.0", + "OGL-Canada-2.0": "Open Government Licence - Canada", + "OGL-UK-1.0": "Open Government Licence v1.0", + "OGL-UK-2.0": "Open Government Licence v2.0", + "OGL-UK-3.0": "Open Government Licence v3.0", + "OGTSL": "Open Group Test Suite License", + "OLDAP-1.1": "Open LDAP Public License v1.1", + "OLDAP-1.2": "Open LDAP Public License v1.2", + "OLDAP-1.3": "Open LDAP Public License v1.3", + "OLDAP-1.4": "Open LDAP Public License v1.4", + "OLDAP-2.0": "Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)", + "OLDAP-2.0.1": "Open LDAP Public License v2.0.1", + "OLDAP-2.1": "Open LDAP Public License v2.1", + "OLDAP-2.2": "Open LDAP Public License v2.2", + "OLDAP-2.2.1": "Open LDAP Public License v2.2.1", + "OLDAP-2.2.2": "Open LDAP Public License 2.2.2", + "OLDAP-2.3": "Open LDAP Public License v2.3", + "OLDAP-2.4": "Open LDAP Public License v2.4", + "OLDAP-2.5": "Open LDAP Public License v2.5", + "OLDAP-2.6": "Open LDAP Public License v2.6", + "OLDAP-2.7": "Open LDAP Public License v2.7", + "OLDAP-2.8": "Open LDAP Public License v2.8", + "OLFL-1.3": "Open Logistics Foundation License Version 1.3", + "OML": "Open Market License", + "OpenMDW-1.0": "OpenMDW License Agreement v1.0", + "OpenPBS-2.3": "OpenPBS v2.3 Software License", + "OpenSSL": "OpenSSL License", + "OpenSSL-standalone": "OpenSSL License - standalone", + "OpenVision": "OpenVision License", + "OPL-1.0": "Open Public License v1.0", + "OPL-UK-3.0": "United Kingdom Open Parliament Licence v3.0", + "OPUBL-1.0": "Open Publication License v1.0", + "OSC-1.0": "OSC License 1.0", + "OSET-PL-2.1": "OSET Public License version 2.1", + "OSL-1.0": "Open Software License 1.0", + "OSL-1.1": "Open Software License 1.1", + "OSL-2.0": "Open Software License 2.0", + "OSL-2.1": "Open Software License 2.1", + "OSL-3.0": "Open Software License 3.0", + "OSSP": "OSSP License", + "PADL": "PADL License", + "ParaType-Free-Font-1.3": "ParaType Free Font Licensing Agreement v1.3", + "Parity-6.0.0": "The Parity Public License 6.0.0", + "Parity-7.0.0": "The Parity Public License 7.0.0", + "PDDL-1.0": "Open Data Commons Public Domain Dedication & License 1.0", + "PHP-3.0": "PHP License v3.0", + "PHP-3.01": "PHP License v3.01", + "Pixar": "Pixar License", + "pkgconf": "pkgconf License", + "Plexus": "Plexus Classworlds License", + "pnmstitch": "pnmstitch License", + "PolyForm-Noncommercial-1.0.0": "PolyForm Noncommercial License 1.0.0", + "PolyForm-Small-Business-1.0.0": "PolyForm Small Business License 1.0.0", + "PostgreSQL": "PostgreSQL License", + "PPL": "Peer Production License", + "PSF-2.0": "Python Software Foundation License 2.0", + "psfrag": "psfrag License", + "psutils": "psutils License", + "Python-2.0": "Python License 2.0", + "Python-2.0.1": "Python License 2.0.1", + "python-ldap": "Python ldap License", + "Qhull": "Qhull License", + "QPL-1.0": "Q Public License 1.0", + "QPL-1.0-INRIA-2004": "Q Public License 1.0 - INRIA 2004 variant", + "radvd": "radvd License", + "Rdisc": "Rdisc License", + "RHeCos-1.1": "Red Hat eCos Public License v1.1", + "RPL-1.1": "Reciprocal Public License 1.1", + "RPL-1.5": "Reciprocal Public License 1.5", + "RPSL-1.0": "RealNetworks Public Source License v1.0", + "RSA-MD": "RSA Message-Digest License", + "RSCPL": "Ricoh Source Code Public License", + "Ruby": "Ruby License", + "Ruby-pty": "Ruby pty extension license", + "SAX-PD": "Sax Public Domain Notice", + "SAX-PD-2.0": "Sax Public Domain Notice 2.0", + "Saxpath": "Saxpath License", + "SCEA": "SCEA Shared Source License", + "SchemeReport": "Scheme Language Report License", + "Sendmail": "Sendmail License", + "Sendmail-8.23": "Sendmail License 8.23", + "Sendmail-Open-Source-1.1": "Sendmail Open Source License v1.1", + "SGI-B-1.0": "SGI Free Software License B v1.0", + "SGI-B-1.1": "SGI Free Software License B v1.1", + "SGI-B-2.0": "SGI Free Software License B v2.0", + "SGI-OpenGL": "SGI OpenGL License", + "SGMLUG-PM": "SGMLUG Parser Materials License", + "SGP4": "SGP4 Permission Notice", + "SHL-0.5": "Solderpad Hardware License v0.5", + "SHL-0.51": "Solderpad Hardware License, Version 0.51", + "SimPL-2.0": "Simple Public License 2.0", + "SISSL": "Sun Industry Standards Source License v1.1", + "SISSL-1.2": "Sun Industry Standards Source License v1.2", + "SL": "SL License", + "Sleepycat": "Sleepycat License", + "SMAIL-GPL": "SMAIL General Public License", + "SMLNJ": "Standard ML of New Jersey License", + "SMPPL": "Secure Messaging Protocol Public License", + "SNIA": "SNIA Public License 1.1", + "snprintf": "snprintf License", + "SOFA": "SOFA Software License", + "softSurfer": "softSurfer License", + "Soundex": "Soundex License", + "Spencer-86": "Spencer License 86", + "Spencer-94": "Spencer License 94", + "Spencer-99": "Spencer License 99", + "SPL-1.0": "Sun Public License v1.0", + "ssh-keyscan": "ssh-keyscan License", + "SSH-OpenSSH": "SSH OpenSSH license", + "SSH-short": "SSH short notice", + "SSLeay-standalone": "SSLeay License - standalone", + "SSPL-1.0": "Server Side Public License, v 1", + "StandardML-NJ": "Standard ML of New Jersey License", + "SugarCRM-1.1.3": "SugarCRM Public License v1.1.3", + "SUL-1.0": "Sustainable Use License v1.0", + "Sun-PPP": "Sun PPP License", + "Sun-PPP-2000": "Sun PPP License (2000)", + "SunPro": "SunPro License", + "SWL": "Scheme Widget Library (SWL) Software License Agreement", + "swrule": "swrule License", + "Symlinks": "Symlinks License", + "TAPR-OHL-1.0": "TAPR Open Hardware License v1.0", + "TCL": "TCL\/TK License", + "TCP-wrappers": "TCP Wrappers License", + "TekHVC": "TekHVC License", + "TermReadKey": "TermReadKey License", + "TGPPL-1.0": "Transitive Grace Period Public Licence 1.0", + "ThirdEye": "ThirdEye License", + "threeparttable": "threeparttable License", + "TMate": "TMate Open Source License", + "TORQUE-1.1": "TORQUE v2.5+ Software License v1.1", + "TOSL": "Trusster Open Source License", + "TPDL": "Time::ParseDate License", + "TPL-1.0": "THOR Public License 1.0", + "TrustedQSL": "TrustedQSL License", + "TTWL": "Text-Tabs+Wrap License", + "TTYP0": "TTYP0 License", + "TU-Berlin-1.0": "Technische Universitaet Berlin License 1.0", + "TU-Berlin-2.0": "Technische Universitaet Berlin License 2.0", + "Ubuntu-font-1.0": "Ubuntu Font Licence v1.0", + "UCAR": "UCAR License", + "UCL-1.0": "Upstream Compatibility License v1.0", + "ulem": "ulem License", + "UMich-Merit": "Michigan\/Merit Networks License", + "Unicode-3.0": "Unicode License v3", + "Unicode-DFS-2015": "Unicode License Agreement - Data Files and Software (2015)", + "Unicode-DFS-2016": "Unicode License Agreement - Data Files and Software (2016)", + "Unicode-TOU": "Unicode Terms of Use", + "UnixCrypt": "UnixCrypt License", + "Unlicense": "The Unlicense", + "Unlicense-libtelnet": "Unlicense - libtelnet variant", + "Unlicense-libwhirlpool": "Unlicense - libwhirlpool variant", + "UnRAR": "UnRAR License", + "UPL-1.0": "Universal Permissive License v1.0", + "URT-RLE": "Utah Raster Toolkit Run Length Encoded License", + "Vim": "Vim License", + "Vixie-Cron": "Vixie Cron License", + "VOSTROM": "VOSTROM Public License for Open Source", + "VSL-1.0": "Vovida Software License v1.0", + "W3C": "W3C Software Notice and License (2002-12-31)", + "W3C-19980720": "W3C Software Notice and License (1998-07-20)", + "W3C-20150513": "W3C Software Notice and Document License (2015-05-13)", + "w3m": "w3m License", + "Watcom-1.0": "Sybase Open Watcom Public License 1.0", + "Widget-Workshop": "Widget Workshop License", + "WordNet": "WordNet License", + "Wsuipa": "Wsuipa License", + "WTFNMFPL": "Do What The F*ck You Want To But It's Not My Fault Public License", + "WTFPL": "Do What The F*ck You Want To Public License", + "wwl": "WWL License", + "wxWindows": "wxWindows Library License", + "X11": "X11 License", + "X11-distribute-modifications-variant": "X11 License Distribution Modification Variant", + "X11-no-permit-persons": "X11 no permit persons clause", + "X11-swapped": "X11 swapped final paragraphs", + "Xdebug-1.03": "Xdebug License v 1.03", + "Xerox": "Xerox License", + "Xfig": "Xfig License", + "XFree86-1.1": "XFree86 License 1.1", + "xinetd": "xinetd License", + "xkeyboard-config-Zinoviev": "xkeyboard-config Zinoviev License", + "xlock": "xlock License", + "Xnet": "X.Net License", + "xpp": "XPP License", + "XSkat": "XSkat License", + "xzoom": "xzoom License", + "YPL-1.0": "Yahoo! Public License v1.0", + "YPL-1.1": "Yahoo! Public License v1.1", + "Zed": "Zed License", + "Zeeff": "Zeeff License", + "Zend-2.0": "Zend License v2.0", + "Zimbra-1.3": "Zimbra Public License v1.3", + "Zimbra-1.4": "Zimbra Public License v1.4", + "Zlib": "zlib License", + "zlib-acknowledgement": "zlib\/libpng License with Acknowledgement", + "ZPL-1.1": "Zope Public License 1.1", + "ZPL-2.0": "Zope Public License 2.0", + "ZPL-2.1": "Zope Public License 2.1", + "389-exception": "389 Directory Server Exception", + "Asterisk-exception": "Asterisk exception", + "Asterisk-linking-protocols-exception": "Asterisk linking protocols exception", + "Autoconf-exception-2.0": "Autoconf exception 2.0", + "Autoconf-exception-3.0": "Autoconf exception 3.0", + "Autoconf-exception-generic": "Autoconf generic exception", + "Autoconf-exception-generic-3.0": "Autoconf generic exception for GPL-3.0", + "Autoconf-exception-macro": "Autoconf macro exception", + "Bison-exception-1.24": "Bison exception 1.24", + "Bison-exception-2.2": "Bison exception 2.2", + "Bootloader-exception": "Bootloader Distribution Exception", + "CGAL-linking-exception": "CGAL Linking Exception", + "Classpath-exception-2.0": "Classpath exception 2.0", + "Classpath-exception-2.0-short": "Classpath exception 2.0 - short", + "CLISP-exception-2.0": "CLISP exception 2.0", + "cryptsetup-OpenSSL-exception": "cryptsetup OpenSSL exception", + "Digia-Qt-LGPL-exception-1.1": "Digia Qt LGPL Exception version 1.1", + "DigiRule-FOSS-exception": "DigiRule FOSS License Exception", + "eCos-exception-2.0": "eCos exception 2.0", + "erlang-otp-linking-exception": "Erlang\/OTP Linking Exception", + "Fawkes-Runtime-exception": "Fawkes Runtime Exception", + "FLTK-exception": "FLTK exception", + "fmt-exception": "fmt exception", + "Font-exception-2.0": "Font exception 2.0", + "freertos-exception-2.0": "FreeRTOS Exception 2.0", + "GCC-exception-2.0": "GCC Runtime Library exception 2.0", + "GCC-exception-2.0-note": "GCC Runtime Library exception 2.0 - note variant", + "GCC-exception-3.1": "GCC Runtime Library exception 3.1", + "Gmsh-exception": "Gmsh exception", + "GNAT-exception": "GNAT exception", + "GNOME-examples-exception": "GNOME examples exception", + "GNU-compiler-exception": "GNU Compiler Exception", + "gnu-javamail-exception": "GNU JavaMail exception", + "GPL-3.0-389-ds-base-exception": "GPL-3.0 389 DS Base Exception", + "GPL-3.0-interface-exception": "GPL-3.0 Interface Exception", + "GPL-3.0-linking-exception": "GPL-3.0 Linking Exception", + "GPL-3.0-linking-source-exception": "GPL-3.0 Linking Exception (with Corresponding Source)", + "GPL-CC-1.0": "GPL Cooperation Commitment 1.0", + "GStreamer-exception-2005": "GStreamer Exception (2005)", + "GStreamer-exception-2008": "GStreamer Exception (2008)", + "harbour-exception": "harbour exception", + "i2p-gpl-java-exception": "i2p GPL+Java Exception", + "Independent-modules-exception": "Independent Module Linking exception", + "KiCad-libraries-exception": "KiCad Libraries Exception", + "kvirc-openssl-exception": "kvirc OpenSSL Exception", + "LGPL-3.0-linking-exception": "LGPL-3.0 Linking Exception", + "libpri-OpenH323-exception": "libpri OpenH323 exception", + "Libtool-exception": "Libtool Exception", + "Linux-syscall-note": "Linux Syscall Note", + "LLGPL": "LLGPL Preamble", + "LLVM-exception": "LLVM Exception", + "LZMA-exception": "LZMA exception", + "mif-exception": "Macros and Inline Functions Exception", + "mxml-exception": "mxml Exception", + "Nokia-Qt-exception-1.1": "Nokia Qt LGPL exception 1.1", + "OCaml-LGPL-linking-exception": "OCaml LGPL Linking Exception", + "OCCT-exception-1.0": "Open CASCADE Exception 1.0", + "OpenJDK-assembly-exception-1.0": "OpenJDK Assembly exception 1.0", + "openvpn-openssl-exception": "OpenVPN OpenSSL Exception", + "PCRE2-exception": "PCRE2 exception", + "polyparse-exception": "Polyparse Exception", + "PS-or-PDF-font-exception-20170817": "PS\/PDF font exception (2017-08-17)", + "QPL-1.0-INRIA-2004-exception": "INRIA QPL 1.0 2004 variant exception", + "Qt-GPL-exception-1.0": "Qt GPL exception 1.0", + "Qt-LGPL-exception-1.1": "Qt LGPL exception 1.1", + "Qwt-exception-1.0": "Qwt exception 1.0", + "romic-exception": "Romic Exception", + "RRDtool-FLOSS-exception-2.0": "RRDtool FLOSS exception 2.0", + "rsync-linking-exception": "rsync Linking Exception", + "SANE-exception": "SANE Exception", + "SHL-2.0": "Solderpad Hardware License v2.0", + "SHL-2.1": "Solderpad Hardware License v2.1", + "Simple-Library-Usage-exception": "Simple Library Usage Exception", + "sqlitestudio-OpenSSL-exception": "sqlitestudio OpenSSL exception", + "stunnel-exception": "stunnel Exception", + "SWI-exception": "SWI exception", + "Swift-exception": "Swift Exception", + "Texinfo-exception": "Texinfo exception", + "u-boot-exception-2.0": "U-Boot exception 2.0", + "UBDL-exception": "Unmodified Binary Distribution exception", + "Universal-FOSS-exception-1.0": "Universal FOSS Exception, Version 1.0", + "vsftpd-openssl-exception": "vsftpd OpenSSL exception", + "WxWindows-exception-3.1": "WxWindows Library Exception 3.1", + "x11vnc-openssl-exception": "x11vnc OpenSSL Exception" + } } diff --git a/tools/src/main/java/org/cyclonedx/tools/SpdxXsdGenerator.java b/tools/src/main/java/org/cyclonedx/tools/SpdxXsdGenerator.java index 1b11ee8da..26fd6e3a5 100644 --- a/tools/src/main/java/org/cyclonedx/tools/SpdxXsdGenerator.java +++ b/tools/src/main/java/org/cyclonedx/tools/SpdxXsdGenerator.java @@ -91,7 +91,7 @@ private void createXmlSchema(Map licenses, Map e .append("").append("\n\n") + .append(indent(11)).append("version=\"1.0-" + StringEscapeUtils.escapeXml10(stripLeadingV(tagName)) + "\">").append("\n\n") .append(indent(4)).append("").append("\n") .append(indent(8)).append("").append("\n"); @@ -117,17 +117,22 @@ private void createJsonSchema(Map licenses, Map .append("{").append("\n") .append(indent(2)).append("\"$schema\": \"http://json-schema.org/draft-07/schema#\",").append("\n") .append(indent(2)).append("\"$id\": \"http://cyclonedx.org/schema/spdx.schema.json\",").append("\n") - .append(indent(2)).append("\"$comment\": \"v1.0-" + stripLeadingV(tagName) + "\",").append("\n") + .append(indent(2)).append("\"$comment\": \"v1.1-" + StringEscapeUtils.escapeJson(stripLeadingV(tagName)) + "\",").append("\n") .append(indent(2)).append("\"type\": \"string\",").append("\n") .append(indent(2)).append("\"enum\": ["); addLicenseAsJson(sb, licenses.entrySet()); sb.append(","); addLicenseAsJson(sb, exceptions.entrySet()); + sb.append("\n").append(indent(2)).append("],").append("\n"); - sb - .append("\n").append(indent(2)).append("]").append("\n") - .append("}").append("\n"); + sb.append(indent(2)).append("\"meta:enum\": {"); + addLicenseAsJsonLabel(sb, licenses.entrySet()); + sb.append(","); + addLicenseAsJsonLabel(sb, exceptions.entrySet()); + sb.append("\n").append(indent(2)).append("}").append("\n"); + + sb.append("}").append("\n"); String filePath = System.getProperty("cdx.schema.dir") + "/spdx.schema.json"; System.out.println("Write SPDX json schema to: " + filePath); @@ -137,7 +142,7 @@ private void createJsonSchema(Map licenses, Map private static void addLicenseAsXml(StringBuilder sb, Set> set) { for (Map.Entry license : set) { - sb.append(indent(12)).append("").append("\n"); + sb.append(indent(12)).append("").append("\n"); sb.append(indent(16)).append("").append("\n"); sb.append(indent(20)).append("").append(StringEscapeUtils.escapeXml10(license.getValue())).append("").append("\n"); sb.append(indent(16)).append("").append("\n"); @@ -149,7 +154,19 @@ private static void addLicenseAsJson(StringBuilder sb, Set license : set) { sb.append("\n"); - sb.append(indent(4)).append("\"").append(license.getKey()).append("\""); + sb.append(indent(4)).append("\"").append(StringEscapeUtils.escapeJson(license.getKey())).append("\""); + if (i < set.size()-1) { + sb.append(","); + } + i++; + } + } + + private static void addLicenseAsJsonLabel(StringBuilder sb, Set> set) { + int i = 0; + for (Map.Entry license : set) { + sb.append("\n"); + sb.append(indent(4)).append("\"").append(StringEscapeUtils.escapeJson(license.getKey())).append("\": \"").append(StringEscapeUtils.escapeJson(license.getValue())).append("\""); if (i < set.size()-1) { sb.append(","); } From 62ab8e6a288ce9354fca016058fa17217091381e Mon Sep 17 00:00:00 2001 From: Basil Hess Date: Tue, 24 Feb 2026 17:05:49 +0100 Subject: [PATCH 11/67] Update crypto definitions Signed-off-by: Basil Hess --- schema/cryptography-defs.json | 65 +++++++++++++++++++++-------------- 1 file changed, 40 insertions(+), 25 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index d56153896..8f839326c 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1,6 +1,6 @@ { "$schema": "http://cyclonedx.org/schema/cryptography-defs.schema.json", - "lastUpdated": "2025-03-22T00:00:00Z", + "lastUpdated": "2026-02-24T00:00:00Z", "algorithms": [ { "family": "RSASSA-PKCS1", @@ -16,7 +16,7 @@ ], "variant": [ { - "pattern": "RSA-PKCS1-1.5[-{digestAlgorithm}][-{keyLength}]", + "pattern": "RSA-PKCS1-1.5[-{hashAlgorithm}][-{keyLength}]", "primitive": "signature" } ] @@ -35,7 +35,7 @@ ], "variant": [ { - "pattern": "RSA-PSS[-{digestAlgorithm}][-{saltLength}][-{keyLength}]", + "pattern": "RSA-PSS[-{hashAlgorithm}][-{maskGenAlgorithm}][-{saltLength}][-{keyLength}]", "primitive": "signature" } ] @@ -99,7 +99,7 @@ ], "variant": [ { - "pattern": "ECDSA[-{ellipticCurve}][-{hash}]", + "pattern": "ECDSA[-{ellipticCurve}][-{hashAlgorithm}]", "primitive": "signature" } ] @@ -186,7 +186,7 @@ ], "variant": [ { - "pattern": "DSA[-{length}][-{hash}]", + "pattern": "DSA[-{length}][-{hashAlgorithm}]", "primitive": "signature" } ] @@ -251,11 +251,11 @@ ], "variant": [ { - "pattern": "SRP-3[-{hashFunction}][-{namedGroup}]", + "pattern": "SRP-3[-{hashAlgorithm}][-{namedGroup}]", "primitive": "key-agree" }, { - "pattern": "SRP-6[-{hashFunction}][-{namedGroup}]", + "pattern": "SRP-6[-{hashAlgorithm}][-{namedGroup}]", "primitive": "key-agree" } ] @@ -465,7 +465,7 @@ ], "variant": [ { - "pattern": "HKDF[-{hashFunction}]", + "pattern": "HKDF[-{hashAlgorithm}]", "primitive": "kdf" } ] @@ -484,7 +484,7 @@ ], "variant": [ { - "pattern": "HMAC[-{hashFunction}][-{tagLength}]", + "pattern": "HMAC[-{hashAlgorithm}][-{tagLength}]", "primitive": "mac" } ] @@ -733,7 +733,7 @@ "primitive": "signature" }, { - "pattern": "HashML-DSA-(44|65|87)[-{hashFunction}]", + "pattern": "HashML-DSA-(44|65|87)[-{hashAlgorithm}]", "primitive": "signature" } ] @@ -752,7 +752,7 @@ "primitive": "signature" }, { - "pattern": "HashSLH-DSA-(SHA2|SHAKE)-(128s|128f|192s|192f|256s|256f)[-{hashFunction}]", + "pattern": "HashSLH-DSA-(SHA2|SHAKE)-(128s|128f|192s|192f|256s|256f)[-{hashAlgorithm}]", "primitive": "signature" } ] @@ -798,7 +798,7 @@ ], "variant": [ { - "pattern": "LMS[_{hashFunction}][_M{bytesPerNode}][_H{treeHeight}]", + "pattern": "LMS[_{hashAlgorithm}][_M{bytesPerNode}][_H{treeHeight}]", "primitive": "signature" }, { @@ -1006,7 +1006,7 @@ "primitive": "block-cipher" }, { - "pattern": "SEED-128[-{mode}][-{padding}]-HMAC[-{hashFunction}][-{tagLength}]", + "pattern": "SEED-128[-{mode}][-{padding}]-HMAC[-{hashAlgorithm}][-{tagLength}]", "primitive": "ae" }, { @@ -1165,7 +1165,7 @@ ], "variant": [ { - "pattern": "X3DH[-{hashFunction}]", + "pattern": "X3DH[-{hashAlgorithm}]", "primitive": "key-agree" } ] @@ -1199,7 +1199,7 @@ ], "variant": [ { - "pattern": "OPAQUE-3DH[-{group}][-{hashFunction}][-{ksf}][-{kdf}][-{mac}]", + "pattern": "OPAQUE-3DH[-{group}][-{hashAlgorithm}][-{ksf}][-{kdf}][-{mac}]", "primitive": "key-agree" } ] @@ -1233,7 +1233,7 @@ ], "variant": [ { - "pattern": "SPAKE2[-{group}][-{hashFunction}][-{kdf}][-{mac}]", + "pattern": "SPAKE2[-{group}][-{hashAlgorithm}][-{kdf}][-{mac}]", "primitive": "key-agree" } ] @@ -1248,7 +1248,7 @@ ], "variant": [ { - "pattern": "SPAKE2+[-{group}][-{hashFunction}][-{kdf}][-{mac}]", + "pattern": "SPAKE2+[-{group}][-{hashAlgorithm}][-{kdf}][-{mac}]", "primitive": "key-agree" } ] @@ -1588,7 +1588,7 @@ ], "variant": [ { - "pattern": "PBKDF1[-{hashFunction}][-{iterations}][-{dkLen}]", + "pattern": "PBKDF1[-{hashAlgorithm}][-{iterations}][-{dkLen}]", "primitive": "kdf" } ] @@ -1607,7 +1607,7 @@ ], "variant": [ { - "pattern": "PBKDF2[-{hashFunction}][-{iterations}][-{dkLen}]", + "pattern": "PBKDF2[-{hashAlgorithm}][-{iterations}][-{dkLen}]", "primitive": "kdf" } ] @@ -1652,7 +1652,7 @@ ], "variant": [ { - "pattern": "PBMAC1[-{macAlgorithm}][-{hashFunction}][-{iterations}][-{dkLen}]", + "pattern": "PBMAC1[-{macAlgorithm}][-{hashAlgorithm}][-{iterations}][-{dkLen}]", "primitive": "mac" } ] @@ -1687,6 +1687,21 @@ } ] }, + { + "family": "yescrypt", + "standard": [ + { + "name": "yescrypt - scalable KDF and password hashing scheme", + "url": "https://www.openwall.com/yescrypt/" + } + ], + "variant": [ + { + "pattern": "[(gost-|sm3-)]yescrypt[-{N_log2}][-{r}][-{p}][-{t}]", + "primitive": "hash" + } + ] + }, { "family": "A5/1", "variant": [ @@ -1716,7 +1731,7 @@ "standard": [ { "name": "TIA TR45.0.A", - "url": "" + "url": "https://patents.google.com/patent/US5159634" } ], "variant": [ @@ -1736,7 +1751,7 @@ ], "variant": [ { - "pattern": "Fortuna[-{blockCipher}][-{hashFunction}]", + "pattern": "Fortuna[-{blockCipher}][-{hashAlgorithm}]", "primitive": "drbg" } ] @@ -1751,7 +1766,7 @@ ], "variant": [ { - "pattern": "Yarrow[-{blockCipher}][-{hashFunction}]", + "pattern": "Yarrow[-{blockCipher}][-{hashAlgorithm}]", "primitive": "drbg" } ] @@ -1781,7 +1796,7 @@ ], "variant": [ { - "pattern": "Hash_DRBG[-{hashFunction}]", + "pattern": "Hash_DRBG[-{hashAlgorithm}]", "primitive": "drbg" } ] @@ -1796,7 +1811,7 @@ ], "variant": [ { - "pattern": "HMAC_DRBG[-{hashFunction}]", + "pattern": "HMAC_DRBG[-{hashAlgorithm}]", "primitive": "drbg" } ] From 117e2e48816fe46010e1ba504c56ca333a1088d6 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Tue, 24 Feb 2026 21:53:12 +0330 Subject: [PATCH 12/67] fix(crypto-registry): normalize RFC/FIPS standard name formatting Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index d56153896..b474e6f35 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -418,7 +418,7 @@ { "standard": [ { - "name": "RFC 5297", + "name": "RFC5297", "url": "https://doi.org/10.17487/RFC5297" } ], @@ -723,7 +723,7 @@ "family": "ML-DSA", "standard": [ { - "name": "FIPS 204", + "name": "FIPS204", "url": "https://doi.org/10.6028/NIST.FIPS.204" } ], @@ -742,7 +742,7 @@ "family": "SLH-DSA", "standard": [ { - "name": "FIPS 205", + "name": "FIPS205", "url": "https://doi.org/10.6028/NIST.FIPS.205" } ], @@ -811,7 +811,7 @@ "family": "ML-KEM", "standard": [ { - "name": "FIPS 203", + "name": "FIPS203", "url": "https://doi.org/10.6028/NIST.FIPS.203" } ], From 0bd48c88d1b1877c7a3536252e06893850763190 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Wed, 25 Feb 2026 10:12:12 +0330 Subject: [PATCH 13/67] fix(schema): correct typos in content-type text and refType comment Signed-off-by: Mehrn0ush --- schema/bom-1.6.schema.json | 4 ++-- schema/bom-1.6.xsd | 2 +- schema/bom-1.7.schema.json | 4 ++-- schema/bom-1.7.xsd | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index ced928cfb..b6c096a99 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -536,7 +536,7 @@ "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", "type": "string", "minLength": 1, - "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'" + "$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'" }, "refLinkType": { "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.", @@ -1161,7 +1161,7 @@ "contentType": { "type": "string", "title": "Content-Type", - "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).", + "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).", "default": "text/plain", "examples": [ "text/plain", diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index f4d6eb37c..898132170 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -973,7 +973,7 @@ limitations under the License. Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` - for JSON data and `text/plain` for plan text documents. + for JSON data and `text/plain` for plain text documents. RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the IANA media types registry at https://www.iana.org/assignments/media-types/media-types.xhtml. diff --git a/schema/bom-1.7.schema.json b/schema/bom-1.7.schema.json index 4d509e996..1ca17a2e3 100644 --- a/schema/bom-1.7.schema.json +++ b/schema/bom-1.7.schema.json @@ -555,7 +555,7 @@ "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", "type": "string", "minLength": 1, - "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'" + "$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'" }, "refLinkType": { "title": "BOM Reference", @@ -1248,7 +1248,7 @@ "contentType": { "type": "string", "title": "Content-Type", - "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).", + "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).", "default": "text/plain", "examples": [ "text/plain", diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index 4549d6fd0..c2c725efa 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -1204,7 +1204,7 @@ limitations under the License. Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` - for JSON data and `text/plain` for plan text documents. + for JSON data and `text/plain` for plain text documents. RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the IANA media types registry at https://www.iana.org/assignments/media-types/media-types.xhtml. From 3c92ef0ec714a229a9f47919e4e12f136a4727bd Mon Sep 17 00:00:00 2001 From: Basil Hess Date: Thu, 26 Feb 2026 14:48:49 +0100 Subject: [PATCH 14/67] Remove duplicate KDF, merge with kdf with SP800-108r1 Signed-off-by: Basil Hess --- schema/cryptography-defs.json | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 8f839326c..19fa3b860 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -504,21 +504,6 @@ } ] }, - { - "family": "KMAC", - "standard": [ - { - "name": "SP800-108r1", - "url": "https://doi.org/10.6028/NIST.SP.800-108r1-upd1" - } - ], - "variant": [ - { - "pattern": "KMAC[-(128|256)]", - "primitive": "mac" - } - ] - }, { "family": "UMAC", "standard": [ @@ -1108,7 +1093,7 @@ ], "variant": [ { - "pattern": "SP800_108_(CounterKDF|FeedbackKDF|DoublePipelineKDF)[-{prfFunction}][-{dkmLength}]", + "pattern": "SP800_108_(CounterKDF|FeedbackKDF|DoublePipelineKDF|KMAC)[-{prfFunction}][-{dkmLength}]", "primitive": "key-derive" } ] From 60cbf7af64fd38ded3cf1825547883dbee743829 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 26 Feb 2026 14:12:39 +0000 Subject: [PATCH 15/67] chore: update algorithm families [skip ci] --- schema/cryptography-defs.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/cryptography-defs.schema.json b/schema/cryptography-defs.schema.json index 235c3bd5e..43a06741f 100644 --- a/schema/cryptography-defs.schema.json +++ b/schema/cryptography-defs.schema.json @@ -1,7 +1,7 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "$id": "http://cyclonedx.org/schema/cryptography-defs.schema.json", - "$comment": "2026-02-19T23:43:11Z", + "$comment": "2026-02-26T14:12:39Z", "title": "Cryptographic Algorithm Family Definitions", "description": "Enumerates cryptographic algorithm families and their specific metadata.", "type": "object", From ecd4f22117cde25bc2a258daaf91120e5cb2d492 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Mon, 2 Mar 2026 12:50:26 +0100 Subject: [PATCH 16/67] chore: harden schema validators Signed-off-by: Jan Kowalleck --- tools/src/test/js/json-schema-functional-tests.js | 1 + tools/src/test/js/json-schema-lint-tests.js | 1 + 2 files changed, 2 insertions(+) diff --git a/tools/src/test/js/json-schema-functional-tests.js b/tools/src/test/js/json-schema-functional-tests.js index 9dc1625c8..dcf9bbbf7 100644 --- a/tools/src/test/js/json-schema-functional-tests.js +++ b/tools/src/test/js/json-schema-functional-tests.js @@ -56,6 +56,7 @@ const ajv = new Ajv({ strict: false, validateFormats: true, addUsedSchema: false, + loadSchema: (uri) => { throw new Error(`Remote schemas are disabled: ${uri}`) }, schemas: { 'http://cyclonedx.org/schema/spdx.schema.json': spdxSchema, 'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema, diff --git a/tools/src/test/js/json-schema-lint-tests.js b/tools/src/test/js/json-schema-lint-tests.js index b8411fcd9..1a959c2d1 100644 --- a/tools/src/test/js/json-schema-lint-tests.js +++ b/tools/src/test/js/json-schema-lint-tests.js @@ -52,6 +52,7 @@ function getAjv(strict) { addUsedSchema: false, allowUnionTypes: false, keywords: ["meta:enum"], + loadSchema: (uri) => { throw new Error(`Remote schemas are disabled: ${uri}`) }, schemas: { 'http://cyclonedx.org/schema/spdx.schema.json': spdxSchema, 'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema, From 605735ca86b7af43fd9f518b6177e2d2e6d55923 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Mon, 2 Mar 2026 11:12:16 -0600 Subject: [PATCH 17/67] Added missing scarf to docs. Signed-off-by: Steve Springett --- docgen/json/templates/cyclonedx/base.html | 1 + docgen/proto/templates/html.tmpl | 1 + docgen/xml/xs3p.xsl | 1 + 3 files changed, 3 insertions(+) diff --git a/docgen/json/templates/cyclonedx/base.html b/docgen/json/templates/cyclonedx/base.html index fd480909b..8b7dfb689 100644 --- a/docgen/json/templates/cyclonedx/base.html +++ b/docgen/json/templates/cyclonedx/base.html @@ -95,5 +95,6 @@

{{ title }}

--> + diff --git a/docgen/proto/templates/html.tmpl b/docgen/proto/templates/html.tmpl index 0e11b9066..3e679969d 100644 --- a/docgen/proto/templates/html.tmpl +++ b/docgen/proto/templates/html.tmpl @@ -569,5 +569,6 @@ https://github.com/pseudomuto/protoc-gen-doc/blob/master/resources/html.tmpl + diff --git a/docgen/xml/xs3p.xsl b/docgen/xml/xs3p.xsl index a85e3c4d6..626ddd110 100644 --- a/docgen/xml/xs3p.xsl +++ b/docgen/xml/xs3p.xsl @@ -491,6 +491,7 @@ }); + From ca4d2f62984f89ea632efc42f948947a50b383e1 Mon Sep 17 00:00:00 2001 From: Basil Hess Date: Thu, 5 Mar 2026 14:13:17 +0100 Subject: [PATCH 18/67] Consistent use of kdf for password-based key derivation algorithms, add hashAlgorithm prefix for yescrypt Signed-off-by: Basil Hess --- schema/cryptography-defs.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 19fa3b860..6ef81847d 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1653,7 +1653,7 @@ "variant": [ { "pattern": "bcrypt[-{cost}]", - "primitive": "hash" + "primitive": "kdf" } ] }, @@ -1668,7 +1668,7 @@ "variant": [ { "pattern": "scrypt[-{N}][-{r}][-{p}][-{dkLen}]", - "primitive": "hash" + "primitive": "kdf" } ] }, @@ -1682,8 +1682,8 @@ ], "variant": [ { - "pattern": "[(gost-|sm3-)]yescrypt[-{N_log2}][-{r}][-{p}][-{t}]", - "primitive": "hash" + "pattern": "[{hashAlgorithm}-]yescrypt[-{N_log2}][-{r}][-{p}][-{t}]", + "primitive": "kdf" } ] }, From f9ab2ad441dc79b1f2ea3518f6460413304bec65 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 5 Mar 2026 14:27:50 +0000 Subject: [PATCH 19/67] chore: update algorithm families [skip ci] --- schema/cryptography-defs.schema.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/cryptography-defs.schema.json b/schema/cryptography-defs.schema.json index 43a06741f..e17815057 100644 --- a/schema/cryptography-defs.schema.json +++ b/schema/cryptography-defs.schema.json @@ -1,7 +1,7 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "$id": "http://cyclonedx.org/schema/cryptography-defs.schema.json", - "$comment": "2026-02-26T14:12:39Z", + "$comment": "2026-03-05T14:27:50Z", "title": "Cryptographic Algorithm Family Definitions", "description": "Enumerates cryptographic algorithm families and their specific metadata.", "type": "object", @@ -281,7 +281,6 @@ "IDEA", "IKE-PRF", "J-PAKE", - "KMAC", "LMS", "MD2", "MD4", @@ -334,7 +333,8 @@ "Yarrow", "ZUC", "bcrypt", - "scrypt" + "scrypt", + "yescrypt" ] }, "ellipticCurvesEnum": { From 58441e3e93fdb1e87ab31e50c8addcc19d19815e Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Mon, 9 Mar 2026 20:03:31 -0500 Subject: [PATCH 20/67] Updated documentation generation Signed-off-by: Steve Springett --- docgen/json/gen.sh | 5 + docgen/json/templates/cyclonedx/base.html | 58 +- docgen/json/templates/cyclonedx/content.html | 10 +- .../json/templates/cyclonedx/schema_doc.css | 56 +- docgen/json/templates/cyclonedx/schema_doc.js | 68 +- .../templates/cyclonedx/schema_doc.min.js | 10 +- .../templates/cyclonedx/section_array.html | 4 +- .../section_conditional_subschema.html | 6 +- .../cyclonedx/section_description.html | 2 +- .../templates/cyclonedx/section_examples.html | 2 +- .../cyclonedx/section_properties.html | 20 +- .../templates/cyclonedx/tabbed_section.html | 2 +- docgen/proto/gen.sh | 5 + docgen/proto/templates/html.tmpl | 847 ++++++++++-------- docgen/xml/gen.sh | 5 + docgen/xml/xs3p.xsl | 267 +++--- 16 files changed, 744 insertions(+), 623 deletions(-) diff --git a/docgen/json/gen.sh b/docgen/json/gen.sh index 4eb653264..881693799 100755 --- a/docgen/json/gen.sh +++ b/docgen/json/gen.sh @@ -25,6 +25,9 @@ SCHEMA_PATH="$(realpath "$THIS_PATH/../../schema")" DOCS_PATH="$THIS_PATH/docs" TEMPLATES_PATH="$THIS_PATH/templates" +# Centralized header injection +source "$THIS_PATH/../static/inject-header.sh" + # -- @@ -71,6 +74,8 @@ generate () { sed -i -e "s/\${quotedTitle}/\"$title\"/g" "$OUT_FILE" sed -i -e "s/\${title}/$title/g" "$OUT_FILE" sed -i -e "s/\${version}/$version/g" "$OUT_FILE" + + inject_header "$OUT_FILE" "$version" "json" } diff --git a/docgen/json/templates/cyclonedx/base.html b/docgen/json/templates/cyclonedx/base.html index 8b7dfb689..00f172874 100644 --- a/docgen/json/templates/cyclonedx/base.html +++ b/docgen/json/templates/cyclonedx/base.html @@ -18,54 +18,15 @@ - - + + - - - + - + - +
@@ -75,9 +36,9 @@

${title}

{{ title }}

{%- endif -%} {%- if config.expand_buttons -%} -
- - +
+ +
{%- endif -%} @@ -95,6 +56,7 @@

{{ title }}

--> - + + diff --git a/docgen/json/templates/cyclonedx/content.html b/docgen/json/templates/cyclonedx/content.html index 53bc8f7f1..ecfc23627 100644 --- a/docgen/json/templates/cyclonedx/content.html +++ b/docgen/json/templates/cyclonedx/content.html @@ -17,17 +17,17 @@ {# Display type #} {%- if not schema is combining -%} - Type: {{ type_name }} + Type: {{ type_name }} {%- endif -%} {%- if schema.format -%} - Format: {{ schema.format }} + Format: {{ schema.format }} {%- endif -%} {# Display default #} {%- set default_value = schema.default_value -%} {%- if default_value -%} - {{ " " }}Default: {{ default_value }} + {{ " " }}Default: {{ default_value }} {%- endif -%}
@@ -42,7 +42,7 @@ {{ content(schema.refers_to_merged, True) }} {%- else -%} {%- if schema.explicit_no_additional_properties -%} - {{ " " }}No Additional Properties + {{ " " }}No Additional Properties {%- endif -%} {# Combining: allOf, anyOf, oneOf, not #} @@ -64,7 +64,7 @@

Must be one of:

- + diff --git a/docgen/json/templates/cyclonedx/schema_doc.css b/docgen/json/templates/cyclonedx/schema_doc.css index ecf2b5d29..cb73114fd 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.css +++ b/docgen/json/templates/cyclonedx/schema_doc.css @@ -5,19 +5,22 @@ body { padding: 0; } .navbar { - height: 90px; + min-height: 90px; padding: 0; } -.navbar-inverse .navbar-nav>.open>a, -.navbar-inverse .navbar-nav>.open>a:focus, -.navbar-inverse .navbar-nav>.open>a:hover, -.navbar-inverse { +.navbar-toggler-icon { + background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.75%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e") !important; +} +.navbar-dark .navbar-nav>.open>a, +.navbar-dark .navbar-nav>.open>a:focus, +.navbar-dark .navbar-nav>.open>a:hover, +.navbar-dark { background-image: linear-gradient(269.12deg, rgba(232, 52, 82, 1) 0%, rgba(136, 38, 125, 1) 51.26%, rgba(52, 57, 175, 1) 100%); } -.navbar-brand, .navbar-fixed-top { +.navbar-brand, .fixed-top { padding: 0 30px 0 30px; } -.navbar-inverse .navbar-nav>li>a { +.navbar-dark .navbar-nav>li>a { color: #ffffff; } .site-header__logo img { @@ -26,8 +29,9 @@ body { .version-selector { font-size: 1.2rem } -.table .thead-dark th { +.table .table-dark th { background-color: #323550; + color: #ffffff; } .container { margin-right: auto; @@ -73,15 +77,24 @@ ul .dropdown-menu li { } .card { border-radius: 0; + --bs-card-border-color: rgba(0, 0, 0, 0.125); +} +.accordion + .accordion .card { + margin-top: -1px; } .card-header { padding: 0; } -.card-header .fa { +.card-header .btn .bi { + display: inline-block; transition: .3s transform ease-in-out; + -webkit-text-stroke: 2px; +} +.card-header .btn[aria-expanded="true"] .bi { transform: rotate(90deg); } -.card-header .collapsed .fa { +.card-header .btn[aria-expanded="false"] .bi, +.card-header .btn.collapsed .bi { transform: rotate(0deg); } .btn.btn-link { @@ -136,7 +149,7 @@ ul .dropdown-menu li { content: '- Read Less'; } .badge { - color: #222222; + color: #222222 !important; padding: .1em .4em .2em; margin-right: .2em; font-weight: normal; @@ -144,44 +157,47 @@ ul .dropdown-menu li { border-radius: 0; } .badge.required-property { - background-color: rgba(255,137,29,0.3); + background-color: rgba(255,137,29,0.3) !important; border: 1px solid #FF7F0B; } .badge.value-type { - background-color: rgba(174,206,229,0.3); + background-color: rgba(174,206,229,0.3) !important; border: 1px solid #5C9CCB; } .badge.default-value { - background-color: rgba(175,228,191,0.3); + background-color: rgba(175,228,191,0.3) !important; border: 1px solid #73D08F; } .badge.example { - background-color: rgba(235,202,255,0.3); + background-color: rgba(235,202,255,0.3) !important; border: 1px solid #DA9FFF; } .badge.deprecated-property { - background-color: rgba(255,95,95,0.3); + background-color: rgba(255,95,95,0.3) !important; border: 1px solid #FF3333; } .badge.no-additional { - background-color: rgba(255,82,174,0.3); + background-color: rgba(255,82,174,0.3) !important; border: 1px solid #FF33A0; } .badge.pattern-property { - background-color: rgba(235,229,168,0.3); + background-color: rgba(235,229,168,0.3) !important; border: 1px solid #FFEA1C; } .accordion div.card:only-child { border-bottom: 1px solid rgba(0, 0, 0, 0.125); } .examples { - padding: 1rem !important; + padding: 0 !important; + margin-top: 0.5rem; + margin-bottom: 0.5rem; } .examples pre { margin-bottom: 0; + padding: 1rem 1.5rem; } .highlight.jumbotron { - padding: 1rem !important; + padding: 1rem 1.5rem !important; } .generated-by-footer { margin-top: 1em; diff --git a/docgen/json/templates/cyclonedx/schema_doc.js b/docgen/json/templates/cyclonedx/schema_doc.js index e03ce9464..93f1669e6 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.js +++ b/docgen/json/templates/cyclonedx/schema_doc.js @@ -1,15 +1,19 @@ -$(document).on('click', 'a[href^="#"]', function(event) { - event.preventDefault(); - history.pushState({}, '', this.href); +document.addEventListener('click', function(event) { + var anchor = event.target.closest('a[href^="#"]'); + if (anchor) { + event.preventDefault(); + history.pushState({}, '', anchor.href); + } }); function flashElement(elementId) { - // $( "#" + elementId ).fadeOut(100).fadeIn(200).fadeOut(100).fadeIn(500); - myElement = document.getElementById(elementId); - myElement.classList.add("jsfh-animated-property"); - setTimeout(function() { - myElement.classList.remove("jsfh-animated-property"); - }, 1000); + var myElement = document.getElementById(elementId); + if (myElement) { + myElement.classList.add("jsfh-animated-property"); + setTimeout(function() { + myElement.classList.remove("jsfh-animated-property"); + }, 1000); + } } function setAnchor(anchorLinkDestination) { @@ -19,7 +23,7 @@ function setAnchor(anchorLinkDestination) { function anchorOnLoad() { // Added to onload on body, checks if there is an anchor link and if so, expand - let linkTarget = decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]); + var linkTarget = decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]); if (linkTarget[0] === "#") { linkTarget = linkTarget.substr(1); } @@ -30,31 +34,35 @@ function anchorOnLoad() { } function anchorLink(linkTarget) { - const target = $( "#" + linkTarget ); - // Find the targeted element to expand and all its parents that can be expanded - target.parents().addBack().filter(".collapse:not(.show), .tab-pane, [role='tab']").each( - function(index) { - if($( this ).hasClass("collapse")) { - $( this ).collapse("show"); - } else if ($( this ).hasClass("tab-pane")) { - // We have the pane and not the tab itself, find the tab - const tabToShow = $( "a[href='#" + $( this ).attr("id") + "']" ); - if (tabToShow) { - tabToShow.tab("show"); - } - } else if ($( this ).attr("role") === "tab") { - // The tab is not a parent of underlying elements, the tab pane is - // However, it can still be linked directly - $( this ).tab("show"); + var target = document.getElementById(linkTarget); + if (!target) return; + + // Find the targeted element and all its parents that can be expanded + var element = target; + while (element) { + // Expand collapsed sections + if (element.classList.contains("collapse") && !element.classList.contains("show")) { + var bsCollapse = new bootstrap.Collapse(element, { toggle: true }); + } + // Activate tab panes + if (element.classList.contains("tab-pane")) { + var tabTrigger = document.querySelector('a[href="#' + element.id + '"]'); + if (tabTrigger) { + var bsTab = new bootstrap.Tab(tabTrigger); + bsTab.show(); } } - ); + // Handle direct tab links + if (element.getAttribute("role") === "tab") { + var bsTab = new bootstrap.Tab(element); + bsTab.show(); + } + element = element.parentElement; + } // Wait a little so the user has time to see the page scroll - // Or maybe it is to be sure everything is expanded before scrolling and I was not able to bind to the bootstrap - // events in a way that works all the time, we may never know setTimeout(function() { - let targetElement = document.getElementById(linkTarget); + var targetElement = document.getElementById(linkTarget); if (targetElement) { targetElement.scrollIntoView({ block: "center", behavior:"smooth" }); // Flash the element so that the user notices where the link points to diff --git a/docgen/json/templates/cyclonedx/schema_doc.min.js b/docgen/json/templates/cyclonedx/schema_doc.min.js index 0c58a70ef..a8756dcb1 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.min.js +++ b/docgen/json/templates/cyclonedx/schema_doc.min.js @@ -1 +1,9 @@ -function flashElement(t){(myElement=document.getElementById(t)).classList.add("jsfh-animated-property"),setTimeout(function(){myElement.classList.remove("jsfh-animated-property")},1e3)}function setAnchor(t){history.pushState({},"",t)}function anchorOnLoad(){let t=decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]);"#"===t[0]&&(t=t.substr(1)),t.length>0&&anchorLink(t)}function anchorLink(t){let e=$("#"+t);e.parents().addBack().filter(".collapse:not(.show), .tab-pane, [role='tab']").each(function(t){if($(this).hasClass("collapse"))$(this).collapse("show");else if($(this).hasClass("tab-pane")){let e=$("a[href='#"+$(this).attr("id")+"']");e&&e.tab("show")}else"tab"===$(this).attr("role")&&$(this).tab("show")}),setTimeout(function(){let e=document.getElementById(t);e&&(e.scrollIntoView({block:"center",behavior:"smooth"}),setTimeout(function(){flashElement(t)},500))},1e3)}$(document).on("click",'a[href^="#"]',function(t){t.preventDefault(),history.pushState({},"",this.href)}); \ No newline at end of file +document.addEventListener('click',function(event){var anchor=event.target.closest('a[href^="#"]');if(anchor){event.preventDefault();history.pushState({},'',anchor.href);}});function flashElement(elementId){var myElement=document.getElementById(elementId);if(myElement){myElement.classList.add("jsfh-animated-property");setTimeout(function(){myElement.classList.remove("jsfh-animated-property");},1000);}} +function setAnchor(anchorLinkDestination){history.pushState({},'',anchorLinkDestination);} +function anchorOnLoad(){var linkTarget=decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]);if(linkTarget[0]==="#"){linkTarget=linkTarget.substr(1);} +if(linkTarget.length>0){anchorLink(linkTarget);}} +function anchorLink(linkTarget){var target=document.getElementById(linkTarget);if(!target)return;var element=target;while(element){if(element.classList.contains("collapse")&&!element.classList.contains("show")){var bsCollapse=new bootstrap.Collapse(element,{toggle:true});} +if(element.classList.contains("tab-pane")){var tabTrigger=document.querySelector('a[href="#'+element.id+'"]');if(tabTrigger){var bsTab=new bootstrap.Tab(tabTrigger);bsTab.show();}} +if(element.getAttribute("role")==="tab"){var bsTab=new bootstrap.Tab(element);bsTab.show();} +element=element.parentElement;} +setTimeout(function(){var targetElement=document.getElementById(linkTarget);if(targetElement){targetElement.scrollIntoView({block:"center",behavior:"smooth"});setTimeout(function(){flashElement(linkTarget);},500);}},1000);} \ No newline at end of file diff --git a/docgen/json/templates/cyclonedx/section_array.html b/docgen/json/templates/cyclonedx/section_array.html index 15489a4b7..14a7fb4a6 100644 --- a/docgen/json/templates/cyclonedx/section_array.html +++ b/docgen/json/templates/cyclonedx/section_array.html @@ -8,7 +8,7 @@ {{ restriction("All items must be unique", "unique-items", schema.kw_unique_items.html_id) }} {%- endif -%} {%- if not schema.array_additional_items -%} - {{ " " }}No Additional Items + {{ " " }}No Additional Items {%- endif -%} {%- if schema.array_items_def -%}

Each item of this array must be:

@@ -24,7 +24,7 @@

Tuple Validation

Item at {{ loop.index }} must be:
- + {{ content(item) }}
diff --git a/docgen/json/templates/cyclonedx/section_conditional_subschema.html b/docgen/json/templates/cyclonedx/section_conditional_subschema.html index e543669d9..01ba04d58 100644 --- a/docgen/json/templates/cyclonedx/section_conditional_subschema.html +++ b/docgen/json/templates/cyclonedx/section_conditional_subschema.html @@ -7,7 +7,7 @@

{% set tab_id = schema.kw_if.html_id %}
  • If
    • @@ -16,7 +16,7 @@

    {% set tab_id = schema.kw_then.html_id %}
  • Then
    • @@ -26,7 +26,7 @@

    {%- set tab_id = schema.kw_else.html_id -%}
  • Else
    • diff --git a/docgen/json/templates/cyclonedx/section_description.html b/docgen/json/templates/cyclonedx/section_description.html index e0cc3fab5..e5ecc5f34 100644 --- a/docgen/json/templates/cyclonedx/section_description.html +++ b/docgen/json/templates/cyclonedx/section_description.html @@ -8,7 +8,7 @@ {{ description }}
    -
    diff --git a/docgen/json/templates/cyclonedx/section_examples.html b/docgen/json/templates/cyclonedx/section_examples.html index 06f485e93..b21809102 100644 --- a/docgen/json/templates/cyclonedx/section_examples.html +++ b/docgen/json/templates/cyclonedx/section_examples.html @@ -6,7 +6,7 @@ {%- set example_id = schema.html_id ~ "_ex" ~ loop.index -%} {%- set example_is_long = example is not description_short -%} {%- if example_is_long -%} - + {%- endif -%}
    {%- if not examples_as_yaml -%} diff --git a/docgen/json/templates/cyclonedx/section_properties.html b/docgen/json/templates/cyclonedx/section_properties.html index 222fd8b61..e07c9a445 100644 --- a/docgen/json/templates/cyclonedx/section_properties.html +++ b/docgen/json/templates/cyclonedx/section_properties.html @@ -3,10 +3,10 @@

    -

    @@ -29,13 +29,13 @@

    -
    + data-bs-parent="#accordion{{ html_id }}"> +
    {%- if sub_property.is_pattern_property -%}

    -

    All property whose name matches the following regular expression must respect the following conditions

    +

    All properties whose name matches the following regular expression must respect the following conditions

    Property name regular expression: {{ sub_property.property_name | escape }}
    {%- endif -%} @@ -52,4 +52,4 @@

    -

    +
    \ No newline at end of file diff --git a/docgen/json/templates/cyclonedx/tabbed_section.html b/docgen/json/templates/cyclonedx/tabbed_section.html index 81ea390bf..ce3b2dfaa 100644 --- a/docgen/json/templates/cyclonedx/tabbed_section.html +++ b/docgen/json/templates/cyclonedx/tabbed_section.html @@ -9,7 +9,7 @@

    {%- for node in current_node.array_items -%}
  • {{ node.definition_name or tab_label ~ " " ~ loop.index }} {%- if node is deprecated -%} diff --git a/docgen/proto/gen.sh b/docgen/proto/gen.sh index 871220fca..38b4f38e2 100755 --- a/docgen/proto/gen.sh +++ b/docgen/proto/gen.sh @@ -24,6 +24,9 @@ SCHEMA_PATH="$(realpath "$THIS_PATH/../../schema")" DOCS_PATH="$THIS_PATH/docs" TEMPLATES_PATH="$THIS_PATH/templates" +# Centralized header injection +source "$THIS_PATH/../static/inject-header.sh" + PROTOC_GEN_DOC_VERSION='1.5.1' @@ -63,6 +66,8 @@ generate () { sed -i -e "s/\${quotedTitle}/\"$title\"/g" "$OUT_DIR/$OUT_FILE" sed -i -e "s/\${title}/$title/g" "$OUT_DIR/$OUT_FILE" sed -i -e "s/\${version}/$version/g" "$OUT_DIR/$OUT_FILE" + + inject_header "$OUT_DIR/$OUT_FILE" "$version" "proto" } diff --git a/docgen/proto/templates/html.tmpl b/docgen/proto/templates/html.tmpl index 3e679969d..246852908 100644 --- a/docgen/proto/templates/html.tmpl +++ b/docgen/proto/templates/html.tmpl @@ -22,33 +22,13 @@ https://github.com/pseudomuto/protoc-gen-doc/blob/master/resources/html.tmpl - - - - - + + + - +

    ${title}

    -

    Table of Contents

    - -
    - -
    - {{range .Files}} {{$file_name := .Name}} {{$file_package := .Package}} -
    -

    Package: {{.Package}}

    Top -
    - {{p .Description}} {{range .Messages}} -

    {{.LongName}}

    - {{p .Description}} - - {{if .HasFields}} -

    • Name Description
    - - - - - {{range .Fields}} - - - - - - - {{end}} - -
    FieldTypeLabelDescription
    {{.Name}}{{.LongType}}{{.Label}}

    {{if (index .Options "deprecated"|default false)}}Deprecated. {{end}}{{.Description}} {{if .DefaultValue}}Default: {{.DefaultValue}}{{end}}

    - - {{$message := .}} - {{- range .FieldOptions}} - {{$option := .}} - {{if eq . "validator.field" "validate.rules" }} -

    Validated Fields

    - - - - - - - - - {{range $message.FieldsWithOption .}} - - - - - {{end}} - -
    FieldValidations
    {{.Name}} -
      - {{range (.Option $option).Rules}} -
    • {{.Name}}: {{.Value}}
      • - {{end}} -
    -
    - {{else}} -

    Fields with {{.}} option

    - - - - - - - - - {{range $message.FieldsWithOption .}} - - - - - {{end}} - -
    NameOption
    {{.Name}}

    {{ printf "%+v" (.Option $option)}}

    - {{end}} - {{end -}} - {{end}} - - {{if .HasExtensions}} -
    - - - - - - {{range .Extensions}} - - - - - - - - {{end}} - -
    ExtensionTypeBaseNumberDescription
    {{.Name}}{{.LongType}}{{.ContainingLongType}}{{.Number}}

    {{.Description}}{{if .DefaultValue}} Default: {{.DefaultValue}}{{end}}

    - {{end}} +
    +
    +
    +

    + +

    +
    +
    +
    + {{p .Description}} + + {{if .HasFields}} + + + + + + {{range .Fields}} + + + + + + + {{end}} + +
    FieldTypeLabelDescription
    {{.Name}}{{.LongType}}{{.Label}}

    {{if (index .Options "deprecated"|default false)}}Deprecated. {{end}}{{.Description}} {{if .DefaultValue}}Default: {{.DefaultValue}}{{end}}

    + + {{$message := .}} + {{- range .FieldOptions}} + {{$option := .}} + {{if eq . "validator.field" "validate.rules" }} +

    Validated Fields

    + + + + + + + + + {{range $message.FieldsWithOption .}} + + + + + {{end}} + +
    FieldValidations
    {{.Name}} +
      + {{range (.Option $option).Rules}} +
    • {{.Name}}: {{.Value}}
      • + {{end}} +
    +
    + {{else}} +

    Fields with {{.}} option

    + + + + + + + + + {{range $message.FieldsWithOption .}} + + + + + {{end}} + +
    NameOption
    {{.Name}}

    {{ printf "%+v" (.Option $option)}}

    + {{end}} + {{end -}} + {{end}} + + {{if .HasExtensions}} +
    + + + + + + {{range .Extensions}} + + + + + + + + {{end}} + +
    ExtensionTypeBaseNumberDescription
    {{.Name}}{{.LongType}}{{.ContainingLongType}}{{.Number}}

    {{.Description}}{{if .DefaultValue}} Default: {{.DefaultValue}}{{end}}

    + {{end}} +
    +
    +
    +
    {{end}} {{range .Enums}} -

    {{.LongName}}

    - {{p .Description}} - - - - - - {{range .Values}} - - - - - - {{end}} - -
    NameNumberDescription
    {{.Name}}{{.Number}}

    {{.Description}}

    +
    +
    +
    +

    + +

    +
    +
    +
    + {{p .Description}} + + + + + + {{range .Values}} + + + + + + {{end}} + +
    NameNumberDescription
    {{.Name}}{{.Number}}

    {{.Description}}

    +
    +
    +
    +
    {{end}} {{if .HasExtensions}} -

    File-level Extensions

    - - - - - - {{range .Extensions}} - - - - - - - - {{end}} - -
    ExtensionTypeBaseNumberDescription
    {{.Name}}{{.LongType}}{{.ContainingLongType}}{{.Number}}

    {{.Description}}{{if .DefaultValue}} Default: {{.DefaultValue}}{{end}}

    +
    +
    +
    +

    + +

    +
    +
    +
    + + + + + + {{range .Extensions}} + + + + + + + + {{end}} + +
    ExtensionTypeBaseNumberDescription
    {{.Name}}{{.LongType}}{{.ContainingLongType}}{{.Number}}

    {{.Description}}{{if .DefaultValue}} Default: {{.DefaultValue}}{{end}}

    +
    +
    +
    +
    {{end}} {{range .Services}} -

    {{.Name}}

    - {{p .Description}} - - - - - - {{range .Methods}} - - - - - - - {{end}} - -
    Method NameRequest TypeResponse TypeDescription
    {{.Name}}{{.RequestLongType}}{{if .RequestStreaming}} stream{{end}}{{.ResponseLongType}}{{if .ResponseStreaming}} stream{{end}}

    {{.Description}}

    - - {{$service := .}} - {{- range .MethodOptions}} - {{$option := .}} - {{if eq . "google.api.http"}} -

    Methods with HTTP bindings

    - - - - - - - - - - - {{range $service.MethodsWithOption .}} - {{$name := .Name}} - {{range (.Option $option).Rules}} - - - - - - - {{end}} - {{end}} - -
    Method NameMethodPatternBody
    {{$name}}{{.Method}}{{.Pattern}}{{.Body}}
    - {{else}} -

    Methods with {{.}} option

    - - - - - - - - - {{range $service.MethodsWithOption .}} - - - - - {{end}} - -
    Method NameOption
    {{.Name}}

    {{ printf "%+v" (.Option $option)}}

    - {{end}} - {{end -}} +
    +
    +
    +

    + +

    +
    +
    +
    + {{p .Description}} + + + + + + {{range .Methods}} + + + + + + + {{end}} + +
    Method NameRequest TypeResponse TypeDescription
    {{.Name}}{{.RequestLongType}}{{if .RequestStreaming}} stream{{end}}{{.ResponseLongType}}{{if .ResponseStreaming}} stream{{end}}

    {{.Description}}

    + + {{$service := .}} + {{- range .MethodOptions}} + {{$option := .}} + {{if eq . "google.api.http"}} +

    Methods with HTTP bindings

    + + + + + + + + + + + {{range $service.MethodsWithOption .}} + {{$name := .Name}} + {{range (.Option $option).Rules}} + + + + + + + {{end}} + {{end}} + +
    Method NameMethodPatternBody
    {{$name}}{{.Method}}{{.Pattern}}{{.Body}}
    + {{else}} +

    Methods with {{.}} option

    + + + + + + + + + {{range $service.MethodsWithOption .}} + + + + + {{end}} + +
    Method NameOption
    {{.Name}}

    {{ printf "%+v" (.Option $option)}}

    + {{end}} + {{end -}} +
    +
    +
    +
    {{end}} {{end}} -

    Scalar Value Types

    - - - - - - {{range .Scalars}} - - - - - - - - - - - - {{end}} - -
    .proto TypeNotesC++JavaPythonGoC#PHPRuby
    {{.ProtoType}}{{.Notes}}{{.CppType}}{{.JavaType}}{{.PythonType}}{{.GoType}}{{.CSharp}}{{.PhpType}}{{.RubyType}}
    +
    +
    +
    +

    + +

    +
    +
    +
    + + + + + + {{range .Scalars}} + + + + + + + + + + + + {{end}} + +
    .proto TypeNotesC++JavaPythonGoC#PHPRuby
    {{.ProtoType}}{{.Notes}}{{.CppType}}{{.JavaType}}{{.PythonType}}{{.GoType}}{{.CSharp}}{{.PhpType}}{{.RubyType}}
    +
    +
    +
    +
    - + + diff --git a/docgen/xml/gen.sh b/docgen/xml/gen.sh index 1718a0f4a..3aa498b03 100755 --- a/docgen/xml/gen.sh +++ b/docgen/xml/gen.sh @@ -26,6 +26,9 @@ THIS_PATH="$(realpath "$(dirname "$0")")" SCHEMA_PATH="$(realpath "$THIS_PATH/../../schema")" DOCS_PATH="$THIS_PATH/docs" +# Centralized header injection +source "$THIS_PATH/../static/inject-header.sh" + SAXON_VERSION='10.9' @@ -59,6 +62,8 @@ generate () { -o:"$OUT_FILE" \ cycloneDxVersion="$version" \ title="$title" + + inject_header "$OUT_FILE" "$version" "xml" } diff --git a/docgen/xml/xs3p.xsl b/docgen/xml/xs3p.xsl index 626ddd110..aec625c53 100644 --- a/docgen/xml/xs3p.xsl +++ b/docgen/xml/xs3p.xsl @@ -158,13 +158,10 @@ specific CSS, not the Bootstrap CSS. --> - - https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js - - https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.4.1 + /js/bootstrap.bundle.min.js must exist.--> + https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist 0.0 @@ -299,7 +296,8 @@ - + + + + + + + +
    + + diff --git a/docgen/static/inject-header.sh b/docgen/static/inject-header.sh new file mode 100755 index 000000000..608b0d865 --- /dev/null +++ b/docgen/static/inject-header.sh @@ -0,0 +1,120 @@ +#!/bin/bash +# ═══════════════════════════════════════════════════════════ +# inject-header.sh — Inject centralized mega menu header +# ═══════════════════════════════════════════════════════════ +# +# Source this file from any gen.sh, then call: +# +# inject_header +# +# Arguments: +# output_file — Path to the generated HTML file +# version — Spec version, e.g. "2.0" or "1.7" +# format — Serialization format: "json", "xml", or "proto" +# +# The output file must contain the placeholder: +# +# +# This function: +# 1. Runs generate-menu.py to build mega menu HTML from releases.json +# 2. Inserts the generated content into header.html (at ${MEGA_MENU_PANELS}) +# 3. Replaces version/format tokens +# 4. Injects the result at the placeholder location in the output file +# ═══════════════════════════════════════════════════════════ + +inject_header() { + local output_file="$1" + local version="$2" + local format="$3" + + # Resolve path to the static directory (relative to this script) + local HEADER_DIR + HEADER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + + if [ ! -f "$HEADER_DIR/header.html" ]; then + echo "ERROR: header.html not found in $HEADER_DIR" >&2 + return 1 + fi + if [ ! -f "$HEADER_DIR/releases.json" ]; then + echo "ERROR: releases.json not found in $HEADER_DIR" >&2 + return 1 + fi + if [ ! -f "$HEADER_DIR/generate-menu.py" ]; then + echo "ERROR: generate-menu.py not found in $HEADER_DIR" >&2 + return 1 + fi + + # ── Compute display labels ── + + local formatLabel + case "$format" in + json) formatLabel="JSON" ;; + xml) formatLabel="XML" ;; + proto) formatLabel="Protobuf" ;; + *) + echo "ERROR: Unknown format '$format' (expected json, xml, or proto)" >&2 + return 1 + ;; + esac + + # Nav label: "CycloneDX 2.0" for modern, "CycloneDX 1.7 (JSON)" for classic + local navLabel + if [[ "$version" == 1.* ]]; then + navLabel="CycloneDX ${version} (${formatLabel})" + else + navLabel="CycloneDX ${version}" + fi + + # ── Generate mega menu panels from releases.json ── + + local tmppanels + tmppanels=$(mktemp) + if ! python3 "$HEADER_DIR/generate-menu.py" "$HEADER_DIR/releases.json" > "$tmppanels"; then + echo "ERROR: generate-menu.py failed" >&2 + rm -f "$tmppanels" + return 1 + fi + + # ── Build the complete header: insert panels into header.html, then replace tokens ── + + local tmpheader + tmpheader=$(mktemp) + + # First: insert generated panels at ${MEGA_MENU_PANELS} placeholder + sed \ + -e '/\${MEGA_MENU_PANELS}/r '"$tmppanels" \ + -e '/\${MEGA_MENU_PANELS}/d' \ + "$HEADER_DIR/header.html" > "$tmpheader" + + rm -f "$tmppanels" + + # Second: replace version/format tokens + local tmpheader2 + tmpheader2=$(mktemp) + sed \ + -e 's|\${navLabel}|'"$navLabel"'|g' \ + -e 's|\${version}|'"$version"'|g' \ + -e 's|\${format}|'"$format"'|g' \ + -e 's|\${formatLabel}|'"$formatLabel"'|g' \ + "$tmpheader" > "$tmpheader2" + + rm -f "$tmpheader" + + # ── Inject into output file at placeholder ── + + if ! grep -q '' "$output_file"; then + echo "WARNING: Placeholder '' not found in $output_file" >&2 + rm -f "$tmpheader2" + return 1 + fi + + local tmpout + tmpout=$(mktemp) + sed \ + -e '//r '"$tmpheader2" \ + -e '//d' \ + "$output_file" > "$tmpout" && mv "$tmpout" "$output_file" + + rm -f "$tmpheader2" + echo " Injected header: v$version ($formatLabel)" +} diff --git a/docgen/static/releases.json b/docgen/static/releases.json new file mode 100644 index 000000000..878c8438f --- /dev/null +++ b/docgen/static/releases.json @@ -0,0 +1,72 @@ +{ + "groups": [ + { + "id": "panel-tel", + "section": "Future", + "label": "Transparency Exchange Language", + "desc": "v2.0", + "skip": false, + "note": "The CycloneDX Transparency Exchange Language is a superset of CycloneDX BOM. Everything you know and love, reimagined and expanded.", + "releases": [ + { + "version": "2.0", + "date": "Coming in 2026", + "featured": true, + "description": "A modular file format and API specification that unifies Bill of Materials with complete supply chain transparency including architectural blueprints, threat, behavioral, and risk modeling, AI and agentic capabilities, compliance attestations, and post-quantum cryptography readiness." + } + ] + }, + { + "id": "panel-bom", + "section": "Stable", + "label": "Bill of Materials", + "desc": "v1.0 – v1.7", + "releases": [ + { + "version": "1.7", + "date": "October 2025", + "featured": true, + "description": "The international standard for inventorying software, hardware, services, cryptographic assets, and AI models with dependency graphs, vulnerability disclosures, licensing, build formulation, and assembly completeness.", + "ecma": "ECMA-424, 2nd Edition", + "formats": ["json", "xml", "proto"] + }, + { + "version": "1.6", + "date": "April 2024", + "ecma": "ECMA-424, 1st Edition", + "formats": ["json", "xml", "proto"] + }, + { + "version": "1.5", + "date": "June 2023", + "formats": ["json", "xml", "proto"] + }, + { + "version": "1.4", + "date": "January 2022", + "formats": ["json", "xml", "proto"] + }, + { + "version": "1.3", + "date": "May 2021", + "formats": ["json", "xml", "proto"] + }, + { + "version": "1.2", + "date": "May 2020", + "formats": ["json", "xml"] + }, + { + "version": "1.1", + "date": "March 2019", + "formats": ["xml"] + }, + { + "version": "1.0", + "date": "March 2018", + "formats": ["xml"] + } + ] + } + ] +} From 18c651a1e940bbb31864f4668a4219dda7e66941 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Mon, 9 Mar 2026 20:29:21 -0500 Subject: [PATCH 22/67] Fixed potential security issue Signed-off-by: Steve Springett --- docgen/static/generate-menu.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docgen/static/generate-menu.py b/docgen/static/generate-menu.py index ed07296a1..82058d225 100644 --- a/docgen/static/generate-menu.py +++ b/docgen/static/generate-menu.py @@ -18,9 +18,22 @@ """ import json +import os import sys import html +# This script's directory is the only allowed location for input files +SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) + + +def validate_input_path(path): + """Ensure the input file resolves to within the script's directory.""" + resolved = os.path.realpath(path) + if not resolved.startswith(SCRIPT_DIR + os.sep) and resolved != SCRIPT_DIR: + print(f"ERROR: Input file must reside in {SCRIPT_DIR}", file=sys.stderr) + sys.exit(1) + return resolved + def fmt_label(fmt): """Format code to display label.""" @@ -115,7 +128,8 @@ def main(): print("Usage: generate-menu.py ", file=sys.stderr) sys.exit(1) - with open(sys.argv[1], "r") as f: + input_path = validate_input_path(sys.argv[1]) + with open(input_path, "r") as f: data = json.load(f) groups = [g for g in data["groups"] if not g.get("skip")] From 1badf6bb513a1cdb882737ec4e84a390ba606dc2 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Mon, 9 Mar 2026 20:33:37 -0500 Subject: [PATCH 23/67] Fixed potential security issue Signed-off-by: Steve Springett --- docgen/static/generate-menu.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docgen/static/generate-menu.py b/docgen/static/generate-menu.py index 82058d225..bf063c932 100644 --- a/docgen/static/generate-menu.py +++ b/docgen/static/generate-menu.py @@ -29,7 +29,11 @@ def validate_input_path(path): """Ensure the input file resolves to within the script's directory.""" resolved = os.path.realpath(path) - if not resolved.startswith(SCRIPT_DIR + os.sep) and resolved != SCRIPT_DIR: + try: + common = os.path.commonpath([resolved, SCRIPT_DIR]) + except ValueError: + common = None + if common != SCRIPT_DIR: print(f"ERROR: Input file must reside in {SCRIPT_DIR}", file=sys.stderr) sys.exit(1) return resolved From 5aef9ae2de0be190aade6c4e5c0d3208fd41d52d Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Mon, 9 Mar 2026 20:38:11 -0500 Subject: [PATCH 24/67] Potential fix for code scanning alert no. 39: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Steve Springett --- docgen/static/generate-menu.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docgen/static/generate-menu.py b/docgen/static/generate-menu.py index bf063c932..a8d2216f3 100644 --- a/docgen/static/generate-menu.py +++ b/docgen/static/generate-menu.py @@ -28,12 +28,14 @@ def validate_input_path(path): """Ensure the input file resolves to within the script's directory.""" + # Resolve symlinks and remove any ".." components to get a canonical path resolved = os.path.realpath(path) try: common = os.path.commonpath([resolved, SCRIPT_DIR]) except ValueError: common = None - if common != SCRIPT_DIR: + # Require the resolved path to be strictly inside SCRIPT_DIR (not equal to it) + if common != SCRIPT_DIR or resolved == SCRIPT_DIR: print(f"ERROR: Input file must reside in {SCRIPT_DIR}", file=sys.stderr) sys.exit(1) return resolved From 526a2db615ffb512af5f884ea5465b3f728522a9 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Tue, 10 Mar 2026 12:57:08 -0500 Subject: [PATCH 25/67] major changes to json template doc generation - reducing filesize from over 30MB to 8.6MB, while preserving SEO. Signed-off-by: Steve Springett --- docgen/json/gen.sh | 2 +- .../json/templates/cyclonedx/schema_doc.css | 17 +- docgen/json/templates/cyclonedx/schema_doc.js | 347 +++++++++++++++++- .../templates/cyclonedx/schema_doc.min.js | 10 +- 4 files changed, 364 insertions(+), 12 deletions(-) diff --git a/docgen/json/gen.sh b/docgen/json/gen.sh index 881693799..7bd526a6b 100755 --- a/docgen/json/gen.sh +++ b/docgen/json/gen.sh @@ -61,7 +61,7 @@ generate () { mkdir -p "$OUT_DIR" generate-schema-doc \ - --config no_link_to_reused_ref \ + --config link_to_reused_ref \ --config no_show_breadcrumbs \ --config no_collapse_long_descriptions \ --deprecated-from-description \ diff --git a/docgen/json/templates/cyclonedx/schema_doc.css b/docgen/json/templates/cyclonedx/schema_doc.css index cb73114fd..1367c320a 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.css +++ b/docgen/json/templates/cyclonedx/schema_doc.css @@ -277,4 +277,19 @@ ul .dropdown-menu li { .highlight .vg { color: #bb60d5 } /* Name.Variable.Global */ .highlight .vi { color: #bb60d5 } /* Name.Variable.Instance */ .highlight .vm { color: #bb60d5 } /* Name.Variable.Magic */ -.highlight .il { color: #40a070 } /* Literal.Number.Integer.Long */ \ No newline at end of file +.highlight .il { color: #40a070 } /* Literal.Number.Integer.Long */ + +/* ═══════════════════════════════════════════════════════════ + Inline expansion for reused definitions (ref-links) + ═══════════════════════════════════════════════════════════ */ + +/* Hide the "Same definition as..." link text; content is + cloned inline automatically when the parent row expands. */ +.ref-link[data-ref-expanded="true"] { + display: none; +} + +/* Container for the cloned definition content */ +.ref-expand-content { + margin-top: 0.25rem; +} \ No newline at end of file diff --git a/docgen/json/templates/cyclonedx/schema_doc.js b/docgen/json/templates/cyclonedx/schema_doc.js index 93f1669e6..fa9faf5be 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.js +++ b/docgen/json/templates/cyclonedx/schema_doc.js @@ -1,6 +1,13 @@ document.addEventListener('click', function(event) { var anchor = event.target.closest('a[href^="#"]'); if (anchor) { + // Skip ref-links; they are replaced by inline expansions + if (anchor.classList.contains('ref-link')) { + event.preventDefault(); + return; + } + // Don't interfere with Bootstrap tabs or collapse toggles + if (anchor.getAttribute('data-bs-toggle')) return; event.preventDefault(); history.pushState({}, '', anchor.href); } @@ -71,4 +78,342 @@ function anchorLink(linkTarget) { }, 500); } }, 1000); -} \ No newline at end of file +} + + +// ═══════════════════════════════════════════════════════════ +// Fix duplicate IDs produced by link_to_reused_ref +// ═══════════════════════════════════════════════════════════ +// +// The schema doc generator reuses the same IDs when inlining +// a $ref definition at multiple schema paths. Duplicate IDs +// break Bootstrap tabs/collapses because getElementById +// always returns the first match. This pass finds duplicates +// and rewrites subsequent occurrences so every ID is unique. +// ═══════════════════════════════════════════════════════════ + +(function() { + function fixDuplicateIds() { + var seen = {}; // id -> true for first occurrence + var dupCount = 0; + + // Pass 1: rename duplicate IDs. First occurrence keeps + // its id; subsequent occurrences get a unique suffix. + var allWithId = document.querySelectorAll('[id]'); + allWithId.forEach(function(el) { + var id = el.id; + if (!id) return; + if (seen[id]) { + dupCount++; + el.setAttribute('data-orig-id', id); + el.id = id + '__d' + dupCount; + } else { + seen[id] = true; + } + }); + + if (dupCount === 0) return; + + // Build lookup: origId -> [el, el, ...] for fast scoping + var renamed = {}; + document.querySelectorAll('[data-orig-id]').forEach(function(el) { + var origId = el.getAttribute('data-orig-id'); + if (!renamed[origId]) renamed[origId] = []; + renamed[origId].push(el); + }); + + // Build full candidate list: origId -> [el, ...] including + // both the original (first-occurrence) element and all renamed + // duplicates so that scoping works for every occurrence. + var allTargets = {}; + Object.keys(renamed).forEach(function(origId) { + var orig = document.getElementById(origId); + allTargets[origId] = orig ? [orig].concat(renamed[origId]) : renamed[origId]; + }); + + // Find the target element (original or renamed) that shares + // the closest common ancestor with the referrer. + function findLocalTarget(referrer, origId) { + var candidates = allTargets[origId]; + if (!candidates) return origId; + var scope = referrer.parentElement; + while (scope) { + for (var i = 0; i < candidates.length; i++) { + if (scope.contains(candidates[i])) return candidates[i].id; + } + scope = scope.parentElement; + } + return origId; + } + + // Pass 2: fix references that point to renamed IDs. + function fixHashAttr(el, attr) { + var val = el.getAttribute(attr); + if (!val || val.charAt(0) !== '#') return; + var refId = val.substring(1); + if (!renamed[refId]) return; + var localId = findLocalTarget(el, refId); + if (localId !== refId) el.setAttribute(attr, '#' + localId); + } + + function fixPlainAttr(el, attr) { + var val = el.getAttribute(attr); + if (!val || !renamed[val]) return; + var localId = findLocalTarget(el, val); + if (localId !== val) el.setAttribute(attr, localId); + } + + document.querySelectorAll('a[href^="#"]').forEach(function(el) { + fixHashAttr(el, 'href'); + }); + document.querySelectorAll('[data-bs-target^="#"]').forEach(function(el) { + fixHashAttr(el, 'data-bs-target'); + }); + document.querySelectorAll('[data-bs-parent^="#"]').forEach(function(el) { + fixHashAttr(el, 'data-bs-parent'); + }); + document.querySelectorAll('[aria-controls]').forEach(function(el) { + fixPlainAttr(el, 'aria-controls'); + }); + document.querySelectorAll('[aria-labelledby]').forEach(function(el) { + fixPlainAttr(el, 'aria-labelledby'); + }); + document.querySelectorAll('[onclick]').forEach(function(el) { + var onclick = el.getAttribute('onclick'); + if (!onclick) return; + var changed = false; + var updated = onclick.replace( + /anchorLink\('([^']+)'\)/g, + function(match, id) { + if (!renamed[id]) return match; + var localId = findLocalTarget(el, id); + if (localId !== id) { changed = true; return "anchorLink('" + localId + "')"; } + return match; + } + ).replace( + /setAnchor\('#([^']+)'\)/g, + function(match, id) { + if (!renamed[id]) return match; + var localId = findLocalTarget(el, id); + if (localId !== id) { changed = true; return "setAnchor('#" + localId + "')"; } + return match; + } + ); + if (changed) el.setAttribute('onclick', updated); + }); + } + + if (document.readyState === 'loading') { + document.addEventListener('DOMContentLoaded', fixDuplicateIds); + } else { + fixDuplicateIds(); + } +})(); + + +// ═══════════════════════════════════════════════════════════ +// Automatic inline expansion for reused definitions +// ═══════════════════════════════════════════════════════════ +// +// When link_to_reused_ref is enabled, repeated definitions +// render as "Same definition as X" links pointing to the +// original. This enhancement hides those links and clones +// the original definition inline automatically when the +// parent property row is expanded. No user click required. +// The full HTML stays in the DOM for SEO crawlability. +// ═══════════════════════════════════════════════════════════ + +(function() { + var expandCounter = 0; + + /** + * Rewrite IDs inside a cloned subtree so they don't collide + * with the originals. Also updates internal href="#...", + * data-bs-target, data-bs-parent, and aria attributes. + */ + function deduplicateIds(container, suffix) { + var elements = container.querySelectorAll('[id]'); + var idMap = {}; + elements.forEach(function(el) { + var oldId = el.id; + var newId = oldId + suffix; + idMap[oldId] = newId; + el.id = newId; + }); + + container.querySelectorAll('[href]').forEach(function(el) { + var href = el.getAttribute('href'); + if (href && href.charAt(0) === '#') { + var refId = href.substring(1); + if (idMap[refId]) { + el.setAttribute('href', '#' + idMap[refId]); + } + } + }); + container.querySelectorAll('[data-bs-target]').forEach(function(el) { + var val = el.getAttribute('data-bs-target'); + if (val && val.charAt(0) === '#') { + var refId = val.substring(1); + if (idMap[refId]) { + el.setAttribute('data-bs-target', '#' + idMap[refId]); + } + } + }); + container.querySelectorAll('[data-bs-parent]').forEach(function(el) { + var val = el.getAttribute('data-bs-parent'); + if (val && val.charAt(0) === '#') { + var refId = val.substring(1); + if (idMap[refId]) { + el.setAttribute('data-bs-parent', '#' + idMap[refId]); + } + } + }); + container.querySelectorAll('[aria-controls]').forEach(function(el) { + var val = el.getAttribute('aria-controls'); + if (val && idMap[val]) { + el.setAttribute('aria-controls', idMap[val]); + } + }); + container.querySelectorAll('[aria-labelledby]').forEach(function(el) { + var val = el.getAttribute('aria-labelledby'); + if (val && idMap[val]) { + el.setAttribute('aria-labelledby', idMap[val]); + } + }); + + container.querySelectorAll('[onclick]').forEach(function(el) { + var onclick = el.getAttribute('onclick'); + if (onclick) { + var updated = onclick.replace( + /anchorLink\('([^']+)'\)/g, + function(match, id) { + return idMap[id] ? "anchorLink('" + idMap[id] + "')" : match; + } + ).replace( + /setAnchor\('#([^']+)'\)/g, + function(match, id) { + return idMap[id] ? "setAnchor('#" + idMap[id] + "')" : match; + } + ); + el.setAttribute('onclick', updated); + } + }); + } + + /** + * Check whether a node is "leading metadata" that already + * appears in the ref-link's container: the type badge + * (span.badge.value-type), a
    , a description span, + * or whitespace text nodes between them. + */ + function isLeadingMeta(node) { + if (node.nodeType === 3) { + // Text node: skip if whitespace-only + return node.textContent.trim() === ''; + } + if (node.nodeType !== 1) return false; + var el = node; + // Type badge, e.g. + if (el.tagName === 'SPAN' && el.classList.contains('value-type')) return true; + //
    element right after the type badge + if (el.tagName === 'BR') return true; + // Description span + if (el.tagName === 'SPAN' && el.classList.contains('description')) return true; + return false; + } + + /** + * Clone a source definition into the container that holds + * the ref-link. The ref-link itself is hidden via CSS. + * Leading type badge,
    , and description are skipped + * because the container already shows them. + */ + function expandRefLink(link) { + // Skip if already expanded + if (link.getAttribute('data-ref-expanded') === 'true') return; + link.setAttribute('data-ref-expanded', 'true'); + + var targetId = link.getAttribute('href').substring(1); + var source = document.getElementById(targetId); + if (!source) return; + + expandCounter++; + var suffix = '__exp' + expandCounter; + + var content = document.createElement('div'); + content.className = 'ref-expand-content'; + + // Clone child nodes, skipping leading metadata that + // duplicates what the container already displays. + var nodes = source.childNodes; + var pastLeading = false; + for (var i = 0; i < nodes.length; i++) { + if (!pastLeading && isLeadingMeta(nodes[i])) continue; + pastLeading = true; + content.appendChild(nodes[i].cloneNode(true)); + } + + deduplicateIds(content, suffix); + + // Insert the cloned content after the ref-link + link.parentNode.insertBefore(content, link.nextSibling); + } + + /** + * Check whether a ref-link is directly visible within the + * panel that was just shown. Returns false if the link sits + * inside a nested collapse that is still hidden. + */ + function isVisibleInPanel(link, panel) { + var el = link.parentElement; + while (el && el !== panel) { + if (el.classList.contains('collapse') && !el.classList.contains('show')) { + return false; + } + el = el.parentElement; + } + return true; + } + + /** + * When a collapse panel is shown, expand only the ref-links + * that are directly visible (not buried in nested collapses). + */ + function onCollapseShown(e) { + var panel = e.target; + var refLinks = panel.querySelectorAll('.ref-link'); + refLinks.forEach(function(link) { + if (isVisibleInPanel(link, panel)) { + expandRefLink(link); + } + }); + } + + /** + * Initialize: hide ref-link text, listen for collapse events. + */ + function initRefLinks() { + var refLinks = document.querySelectorAll('.ref-link'); + refLinks.forEach(function(link) { + // Remove the original onclick + link.removeAttribute('onclick'); + + // Expand ref-links that are already visible on load + // (not inside any collapsed panel) + var parentCollapse = link.closest('.collapse'); + if (!parentCollapse || parentCollapse.classList.contains('show')) { + expandRefLink(link); + } + }); + + // Listen for Bootstrap collapse show events + document.addEventListener('shown.bs.collapse', onCollapseShown); + } + + // Run on DOM ready + if (document.readyState === 'loading') { + document.addEventListener('DOMContentLoaded', initRefLinks); + } else { + initRefLinks(); + } +})(); diff --git a/docgen/json/templates/cyclonedx/schema_doc.min.js b/docgen/json/templates/cyclonedx/schema_doc.min.js index a8756dcb1..a3934ac7c 100644 --- a/docgen/json/templates/cyclonedx/schema_doc.min.js +++ b/docgen/json/templates/cyclonedx/schema_doc.min.js @@ -1,9 +1 @@ -document.addEventListener('click',function(event){var anchor=event.target.closest('a[href^="#"]');if(anchor){event.preventDefault();history.pushState({},'',anchor.href);}});function flashElement(elementId){var myElement=document.getElementById(elementId);if(myElement){myElement.classList.add("jsfh-animated-property");setTimeout(function(){myElement.classList.remove("jsfh-animated-property");},1000);}} -function setAnchor(anchorLinkDestination){history.pushState({},'',anchorLinkDestination);} -function anchorOnLoad(){var linkTarget=decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]);if(linkTarget[0]==="#"){linkTarget=linkTarget.substr(1);} -if(linkTarget.length>0){anchorLink(linkTarget);}} -function anchorLink(linkTarget){var target=document.getElementById(linkTarget);if(!target)return;var element=target;while(element){if(element.classList.contains("collapse")&&!element.classList.contains("show")){var bsCollapse=new bootstrap.Collapse(element,{toggle:true});} -if(element.classList.contains("tab-pane")){var tabTrigger=document.querySelector('a[href="#'+element.id+'"]');if(tabTrigger){var bsTab=new bootstrap.Tab(tabTrigger);bsTab.show();}} -if(element.getAttribute("role")==="tab"){var bsTab=new bootstrap.Tab(element);bsTab.show();} -element=element.parentElement;} -setTimeout(function(){var targetElement=document.getElementById(linkTarget);if(targetElement){targetElement.scrollIntoView({block:"center",behavior:"smooth"});setTimeout(function(){flashElement(linkTarget);},500);}},1000);} \ No newline at end of file +function flashElement(t){var e=document.getElementById(t);e&&(e.classList.add("jsfh-animated-property"),setTimeout(function(){e.classList.remove("jsfh-animated-property")},1e3))}function setAnchor(t){history.pushState({},"",t)}function anchorOnLoad(){var t=decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]);"#"===t[0]&&(t=t.substr(1)),t.length>0&&anchorLink(t)}function anchorLink(t){var e=document.getElementById(t);if(e){for(var r=e;r;){if(r.classList.contains("collapse")&&!r.classList.contains("show"))new bootstrap.Collapse(r,{toggle:!0});if(r.classList.contains("tab-pane")){var n=document.querySelector('a[href="#'+r.id+'"]');if(n)new bootstrap.Tab(n).show()}if("tab"===r.getAttribute("role"))new bootstrap.Tab(r).show();r=r.parentElement}setTimeout(function(){var e=document.getElementById(t);e&&(e.scrollIntoView({block:"center",behavior:"smooth"}),setTimeout(function(){flashElement(t)},500))},1e3)}}document.addEventListener("click",function(t){var e=t.target.closest('a[href^="#"]');if(e){if(e.classList.contains("ref-link"))return void t.preventDefault();if(e.getAttribute("data-bs-toggle"))return;t.preventDefault(),history.pushState({},"",e.href)}}),function(){function t(){var t={},e=0;if(document.querySelectorAll("[id]").forEach(function(r){var n=r.id;n&&(t[n]?(e++,r.setAttribute("data-orig-id",n),r.id=n+"__d"+e):t[n]=!0)}),0!==e){var r={};document.querySelectorAll("[data-orig-id]").forEach(function(t){var e=t.getAttribute("data-orig-id");r[e]||(r[e]=[]),r[e].push(t)});var n={};Object.keys(r).forEach(function(t){var e=document.getElementById(t);n[t]=e?[e].concat(r[t]):r[t]}),document.querySelectorAll('a[href^="#"]').forEach(function(t){o(t,"href")}),document.querySelectorAll('[data-bs-target^="#"]').forEach(function(t){o(t,"data-bs-target")}),document.querySelectorAll('[data-bs-parent^="#"]').forEach(function(t){o(t,"data-bs-parent")}),document.querySelectorAll("[aria-controls]").forEach(function(t){i(t,"aria-controls")}),document.querySelectorAll("[aria-labelledby]").forEach(function(t){i(t,"aria-labelledby")}),document.querySelectorAll("[onclick]").forEach(function(t){var e=t.getAttribute("onclick");if(e){var n=!1,o=e.replace(/anchorLink\('([^']+)'\)/g,function(e,o){if(!r[o])return e;var i=a(t,o);return i!==o?(n=!0,"anchorLink('"+i+"')"):e}).replace(/setAnchor\('#([^']+)'\)/g,function(e,o){if(!r[o])return e;var i=a(t,o);return i!==o?(n=!0,"setAnchor('#"+i+"')"):e});n&&t.setAttribute("onclick",o)}})}function a(t,e){var r=n[e];if(!r)return e;for(var a=t.parentElement;a;){for(var o=0;o Date: Wed, 11 Mar 2026 13:56:05 -0700 Subject: [PATCH 26/67] Add RSA-X931 Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..b86b60fc2 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -40,6 +40,16 @@ } ] }, + { + "family": "RSA-X931", + "standard": [], + "variant": [ + { + "pattern": "RSA-X9.31[-{hashAlgorithm}][-{keyLength}]", + "primitive": "signature" + } + ] + }, { "family": "RSAES-PKCS1", "standard": [ From 9772d16e9352a83eb5316afbab586ae6ef062741 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 14:24:29 -0700 Subject: [PATCH 27/67] Separate out AES KW / KWP Also add some missing standards to AES Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..0fd04dc71 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -368,9 +368,13 @@ "url": "https://doi.org/10.6028/NIST.FIPS.197-upd1" }, { - "name": "SP800-38{A-G}", + "name": "SP800-38A", "url": "https://doi.org/10.6028/NIST.SP.800-38A" }, + { + "name": "SP800-38E", + "url": "https://doi.org/10.6028/NIST.SP.800-38E" + }, { "name": "RFC5116", "url": "https://doi.org/10.17487/RFC5116" @@ -383,6 +387,10 @@ }, { "standard": [ + { + "name": "SP800-38C", + "url": "https://doi.org/10.6028/NIST.SP.800-38C" + }, { "name": "SP800-38D", "url": "https://doi.org/10.6028/NIST.SP.800-38D" @@ -425,6 +433,16 @@ "pattern": "AES[-(128|192|256)]-SIV", "primitive": "ae" }, + { + "standard": [ + { + "name": "SP800-38F", + "url": "https://doi.org/10.6028/NIST.SP.800-38F" + } + ], + "pattern": "AES[-(128|192|256)][-(KW|KWP)]", + "primitive": "key-wrap" + }, { "standard": [ { @@ -432,10 +450,20 @@ "url": "https://doi.org/10.17487/RFC5649" } ], - "pattern": "AES[-(128|192|256)]-Wrap[-(PAD|KWP|PKCS7)]", + "pattern": "AES[-(128|192|256)]-Wrap[-PKCS7]", "primitive": "key-wrap" }, { + "standard": [ + { + "name": "SP800-38B", + "url": "https://doi.org/10.6028/NIST.SP.800-38B" + }, + { + "name": "SP800-38D", + "url": "https://doi.org/10.6028/NIST.SP.800-38D" + } + ], "pattern": "AES[-(128|192|256)][-(GMAC|CMAC)]", "primitive": "mac" }, From 3302c7d9c3dc57ebd6237df52eef20c46d07cd95 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 15:26:08 -0700 Subject: [PATCH 28/67] Remove dash from EdDSA According to RFC8032, the names are Ed25519ph, Ed25519ctx, and Ed448ph. There is no dash. Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..0f065ba33 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -80,7 +80,7 @@ ], "variant": [ { - "pattern": "Ed(25519|448)[-(ph|ctx)]", + "pattern": "Ed(25519|448)[(ph|ctx)]", "primitive": "signature" } ] From 0a5d2813543fbd6b4f85a12f93eaf2c4e977c6d6 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 15:44:22 -0700 Subject: [PATCH 29/67] Remove dash from SHA-3 hash algorithms The official name of the hash algorithms does not contain the dash. Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..dbdbbe34f 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -323,7 +323,7 @@ ], "variant": [ { - "pattern": "SHA-3-(224|256|384|512)", + "pattern": "SHA3-(224|256|384|512)", "primitive": "hash" }, { From 7c03de546e1c368fb978d8e57fa2da7eaecae834 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 16:02:26 -0700 Subject: [PATCH 30/67] Add hashAlgorithm to IKE-PRF fixes #872 Also changes primitive to "kdf" since this is a KDF, not a key agreement function. Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..343044f69 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -821,16 +821,16 @@ ], "variant": [ { - "pattern": "IKE_PRF_DERIVE", - "primitive": "key-agree" + "pattern": "IKE_PRF_DERIVE[-{hashAlgorithm}]", + "primitive": "kdf" }, { - "pattern": "IKE1_(PRF|Extended)_DERIVE", - "primitive": "key-agree" + "pattern": "IKE1_(PRF|Extended)_DERIVE[-{hashAlgorithm}]", + "primitive": "kdf" }, { - "pattern": "IKE2_PRF_PLUS_DERIVE", - "primitive": "key-agree" + "pattern": "IKE2_PRF_PLUS_DERIVE[-{hashAlgorithm}]", + "primitive": "kdf" } ] }, From 6277ecfea7eb26a2b4e0803793f01b13ff3a49b4 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 17:52:23 -0700 Subject: [PATCH 31/67] Add TLS-PRF family Fixes #874 The additional distinction for RFC7627 is to distinguish between usage of the extended master secret and not. Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..74f47bce8 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -834,6 +834,41 @@ } ] }, + { + "family": "TLS-PRF", + "standard": [ + { + "name": "RFC2246", + "url": "https://doi.org/10.17487/RFC2246" + }, + { + "name": "RFC5246", + "url": "https://doi.org/10.17487/RFC5246" + }, + { + "name": "RFC7627", + "url": "https://doi.org/10.17487/RFC7627" + }, + { + "name": "RFC8446", + "url": "https://doi.org/10.17487/RFC8446" + } + ], + "variant": [ + { + "pattern": "TLS1-PRF[-RFC7627]", + "primitive": "kdf" + }, + { + "pattern": "TLS12-PRF[-RFC7627][-{hashAlgorithm}]", + "primitive": "kdf" + }, + { + "pattern": "TLS13-PRF[-{hashAlgorithm}]", + "primitive": "kdf" + } + ] + }, { "family": "GOST", "variant": [ From 2927c1f72be96e9970f811618712c5d4c46d051d Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 18:13:21 -0700 Subject: [PATCH 32/67] Add SP800-56C family Fixes #876 Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..a302063c4 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1098,6 +1098,21 @@ } ] }, + { + "family": "SP800-56C", + "standard": [ + { + "name": "SP800-56C", + "url": "https://doi.org/10.6028/NIST.SP.800-56Cr2" + } + ], + "variant": [ + { + "pattern": "SP800_56C_(OneStep|TwoStep)[-{auxFunction}][-{dkmLength}]", + "primitive": "key-derive" + } + ] + }, { "family": "BLAKE2", "standard": [ From 29740a0cd5e2c162e9a21a971398b340faa823a3 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Thu, 12 Mar 2026 12:41:05 +0330 Subject: [PATCH 33/67] Deduplicate MD4 and MD5 entries in cryptography registry Fixes #878 Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 30 ------------------------------ 1 file changed, 30 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..20254b3f0 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -591,36 +591,6 @@ } ] }, - { - "family": "MD5", - "standard": [ - { - "name": "RFC1321", - "url": "https://doi.org/10.17487/RFC1321" - } - ], - "variant": [ - { - "pattern": "MD5", - "primitive": "hash" - } - ] - }, - { - "family": "MD4", - "standard": [ - { - "name": "RFC1320", - "url": "https://doi.org/10.17487/RFC1320" - } - ], - "variant": [ - { - "pattern": "MD4", - "primitive": "hash" - } - ] - }, { "family": "RC4", "standard": [ From 8c484e9bb4fb6b9400b446522769714b6392c19a Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Thu, 12 Mar 2026 11:57:56 +0100 Subject: [PATCH 34/67] remove buf comments Signed-off-by: Jan Kowalleck --- docgen/proto/gen.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docgen/proto/gen.sh b/docgen/proto/gen.sh index 38b4f38e2..93d8ec6f4 100755 --- a/docgen/proto/gen.sh +++ b/docgen/proto/gen.sh @@ -67,6 +67,9 @@ generate () { sed -i -e "s/\${title}/$title/g" "$OUT_DIR/$OUT_FILE" sed -i -e "s/\${version}/$version/g" "$OUT_DIR/$OUT_FILE" + sed -i -E -e "s#(

    )buf:.+

    ##g" "$OUT_DIR/$OUT_FILE" + sed -i -E -e "s#^buf:[^<\n]+##g" "$OUT_DIR/$OUT_FILE" + inject_header "$OUT_DIR/$OUT_FILE" "$version" "proto" } From 6f6b79b82a407b3bb834526344c6f685247ca4b5 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Wed, 11 Mar 2026 20:24:00 -0500 Subject: [PATCH 35/67] Add two variants instead of one Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index a302063c4..e6cdca6a9 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1108,7 +1108,11 @@ ], "variant": [ { - "pattern": "SP800_56C_(OneStep|TwoStep)[-{auxFunction}][-{dkmLength}]", + "pattern": "SP800_56C_OneStep[-{auxFunction}][-{dkmLength}]", + "primitive": "key-derive" + } + { + "pattern": "SP800_56C_TwoStep_(CounterKDF|FeedbackKDF|DoublePipelineKDF)[-{auxFunction}][-{dkmLength}]", "primitive": "key-derive" } ] From 8c9e8260cd027213a5db0bba0cf3a83544602347 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Thu, 12 Mar 2026 10:31:49 -0500 Subject: [PATCH 36/67] Fix primitive Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index e6cdca6a9..4a6a8ca3c 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1094,7 +1094,7 @@ "variant": [ { "pattern": "SP800_108_(CounterKDF|FeedbackKDF|DoublePipelineKDF|KMAC)[-{prfFunction}][-{dkmLength}]", - "primitive": "key-derive" + "primitive": "kdf" } ] }, @@ -1109,11 +1109,11 @@ "variant": [ { "pattern": "SP800_56C_OneStep[-{auxFunction}][-{dkmLength}]", - "primitive": "key-derive" + "primitive": "kdf" } { "pattern": "SP800_56C_TwoStep_(CounterKDF|FeedbackKDF|DoublePipelineKDF)[-{auxFunction}][-{dkmLength}]", - "primitive": "key-derive" + "primitive": "kdf" } ] }, From ce0b592ae0eecb4cba9fdc161cc870090bb9b345 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Thu, 12 Mar 2026 09:47:05 -0700 Subject: [PATCH 37/67] Add ANSI KDFs Fixes #856 Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..66f1fa803 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -834,6 +834,29 @@ } ] }, + { + "family": "ANSI-KDF", + "standard": [ + { + "name": "X9.42", + "url": "https://webstore.ansi.org/standards/ASCX9/ansix9422003r2013" + }, + { + "name": "X9.63", + "url": "https://webstore.ansi.org/standards/ASCX9/ansix9632011r2017" + } + ], + "variant": [ + { + "pattern": "ANSI-KDF-X9.42[-{hashAlgorithm}]", + "primitive": "kdf" + }, + { + "pattern": "ANSI-KDF-X9.63[-{hashAlgorithm}]", + "primitive": "kdf" + } + ] + }, { "family": "GOST", "variant": [ From 5ca781b21d98470263775609a696ce799940cbe1 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Thu, 12 Mar 2026 20:50:38 +0330 Subject: [PATCH 38/67] Fix SipHash primitive classification in cryptography registry Fixes #882 Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..c4e135598 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1538,13 +1538,13 @@ "standard": [ { "name": "SipHash Spec", - "url": "https://131002.net/siphash/" + "url": "https://doi.org/10.1007/978-3-642-34931-7_28" } ], "variant": [ { "pattern": "SipHash[-{compressionRounds}-{finalizationRounds}]", - "primitive": "hash" + "primitive": "mac" } ] }, From 20f78d863e0c7689ebf751ef91d8568f2d9fa92f Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Thu, 12 Mar 2026 22:07:34 +0330 Subject: [PATCH 39/67] Add AES-OCB to cryptography registry Fixes #884 Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 2d1a7f19f..c42232733 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -405,6 +405,16 @@ "pattern": "AES[-(128|192|256)]-GCM-SIV[-{tagLength}][-{ivLength}]", "primitive": "ae" }, + { + "standard": [ + { + "name": "RFC7253", + "url": "https://doi.org/10.17487/RFC7253" + } + ], + "pattern": "AES[-(128|192|256)]-OCB[-{tagLength}]", + "primitive": "ae" + }, { "standard": [ { From ee545103609c10acbe117ac44218c8deffa54a3e Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Fri, 13 Mar 2026 15:13:30 +0100 Subject: [PATCH 40/67] fix scroll-padding-top for XML Signed-off-by: Jan Kowalleck --- docgen/xml/xs3p.xsl | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/docgen/xml/xs3p.xsl b/docgen/xml/xs3p.xsl index aec625c53..7b246c0b4 100644 --- a/docgen/xml/xs3p.xsl +++ b/docgen/xml/xs3p.xsl @@ -715,6 +715,10 @@ /* XS3P specific CSS */ +html { + scroll-padding-top: 110px; +} + body { font: 16px/1.5em "Helvetica Neue",Helvetica,Arial,sans-serif; color: #222; @@ -808,19 +812,11 @@ code { a { color: #2157c4; } -a.name { - padding-top: 110px; -} h3.xs3p-subsection-heading { margin-bottom: 30px; } -section, #top { - margin-top: -110px; - padding-top: 110px; -} - pre { padding: 5px; } From 7e5501c688ecbcfbe61101825ae65850b0019b4b Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Thu, 26 Mar 2026 13:33:04 -0500 Subject: [PATCH 41/67] Fixed JSON issue Signed-off-by: Steve Springett --- schema/cryptography-defs.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index c811afe59..e70549abc 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1176,7 +1176,7 @@ { "pattern": "SP800_56C_OneStep[-{auxFunction}][-{dkmLength}]", "primitive": "kdf" - } + }, { "pattern": "SP800_56C_TwoStep_(CounterKDF|FeedbackKDF|DoublePipelineKDF)[-{auxFunction}][-{dkmLength}]", "primitive": "kdf" From 46e4878d2c41d4a9563dc67215caf7b5eb6c5bc1 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Fri, 27 Mar 2026 09:58:12 -0700 Subject: [PATCH 42/67] Add SSH-KDF Signed-off-by: Joachim Vandersmissen --- schema/cryptography-defs.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index e70549abc..6c0e9bc86 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -865,6 +865,21 @@ } ] }, + { + "family": "SSH-KDF", + "standard": [ + { + "name": "RFC4253", + "url": "https://doi.org/10.17487/RFC4253" + } + ], + "variant": [ + { + "pattern": "SSH-KDF[-{hashAlgorithm}]", + "primitive": "kdf" + } + ] + }, { "family": "TLS-PRF", "standard": [ From 054e479286b5ca05ac92768e9c03719dd4a3c7b1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 09:46:49 +0000 Subject: [PATCH 43/67] Initial plan From 98f25e7a3acb786f9601be8c6cdb68530bb17541 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 09:54:50 +0000 Subject: [PATCH 44/67] chore: pin GitHub Actions to immutable commit SHAs Agent-Logs-Url: https://github.com/CycloneDX/specification/sessions/0e454f4f-9adc-4521-b5b7-c3685851a0dc Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com> --- .github/workflows/build_docs.yml | 16 ++++++++-------- .github/workflows/bundle_2.0_schemas.yml | 4 ++-- .../workflows/generate_algorithm_families.yml | 4 ++-- .github/workflows/test_java.yml | 4 ++-- .github/workflows/test_js.yml | 4 ++-- .github/workflows/test_php.yml | 4 ++-- .github/workflows/test_proto.yml | 2 +- .github/workflows/update_spdx_licenses.yml | 10 +++++----- 8 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index 2b862b92e..70d1fbcc4 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -21,10 +21,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: '21' distribution: 'zulu' @@ -33,7 +33,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: XML-Schema-documentation path: docgen/xml/docs @@ -46,10 +46,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Python Environment # see https://github.com/actions/setup-python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ env.PYTHON_VERSION_DEFAULT }} architecture: 'x64' @@ -57,7 +57,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: JSON-Schema-documentation path: docgen/json/docs @@ -70,12 +70,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Generate Schema documentation run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: PROTO-Schema-documentation path: docgen/proto/docs diff --git a/.github/workflows/bundle_2.0_schemas.yml b/.github/workflows/bundle_2.0_schemas.yml index fe800cafc..adff66f96 100644 --- a/.github/workflows/bundle_2.0_schemas.yml +++ b/.github/workflows/bundle_2.0_schemas.yml @@ -19,12 +19,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: '20' diff --git a/.github/workflows/generate_algorithm_families.yml b/.github/workflows/generate_algorithm_families.yml index d349edcf9..ec03cb24d 100644 --- a/.github/workflows/generate_algorithm_families.yml +++ b/.github/workflows/generate_algorithm_families.yml @@ -17,13 +17,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.x' diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml index 226e1d797..8c0cbabba 100644 --- a/.github/workflows/test_java.yml +++ b/.github/workflows/test_java.yml @@ -23,10 +23,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: '8' distribution: 'zulu' diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml index f2029ba40..f983c0c28 100644 --- a/.github/workflows/test_js.yml +++ b/.github/workflows/test_js.yml @@ -26,10 +26,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: '24.x' package-manager-cache: false diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index 3d044081b..6fbcaf288 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -26,10 +26,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup PHP # see https://github.com/shivammathur/setup-php - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 with: php-version: "8.4" tools: composer:v2 diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml index 7758e146e..4d8b68b48 100644 --- a/.github/workflows/test_proto.yml +++ b/.github/workflows/test_proto.yml @@ -26,6 +26,6 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Run test run: ./test.sh diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index d751798b0..4ca160018 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -23,12 +23,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: ref: ${{ github.ref_name }} - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: '21' distribution: 'zulu' @@ -54,7 +54,7 @@ jobs: - name: Artifact changes if: ${{ steps.diff.outputs.changed == 'true' }} # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: retention-days: 1 name: schema-spdx @@ -74,7 +74,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: ref: ${{ github.ref_name }} - name: Switch branch @@ -93,7 +93,7 @@ jobs: fi - name: Fetch changes # https://github.com/actions/download-artifact - uses: actions/download-artifact@v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 with: name: schema-spdx path: schema From 86e4b9714b759a20684a25e2a669c616699b4035 Mon Sep 17 00:00:00 2001 From: Joachim Vandersmissen Date: Thu, 16 Apr 2026 08:15:42 -0500 Subject: [PATCH 45/67] Add standard --- schema/cryptography-defs.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index b86b60fc2..fa9d73599 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -42,7 +42,12 @@ }, { "family": "RSA-X931", - "standard": [], + "standard": [ + { + "name": "X9.31", + "url": "https://standards.globalspec.com/std/1955293/ansi-x9-31" + } + ], "variant": [ { "pattern": "RSA-X9.31[-{hashAlgorithm}][-{keyLength}]", From b95785ff29d3b7d9fde2e9d0ac80732994959661 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Sat, 2 May 2026 17:32:23 +0330 Subject: [PATCH 46/67] fix: correct GOST 28147 algorithm names Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 872c1448b..44b23a85d 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -970,7 +970,7 @@ "url": "https://doi.org/10.17487/RFC4357" } ], - "pattern": "GOST38147[-{mode}][-{padding}]", + "pattern": "GOST28147[-{mode}][-{padding}]", "primitive": "block-cipher" }, { @@ -980,7 +980,7 @@ "url": "https://doi.org/10.17487/RFC4357" } ], - "pattern": "GOST38147_MAC", + "pattern": "GOST28147_MAC", "primitive": "mac" } ] From c222dd9fbfb87e6785aae93fffbf7eece80fc168 Mon Sep 17 00:00:00 2001 From: Mehrn0ush Date: Sat, 2 May 2026 19:03:01 +0330 Subject: [PATCH 47/67] fix: correct BLS12 algorithm pattern Signed-off-by: Mehrn0ush --- schema/cryptography-defs.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json index 872c1448b..b76dcb412 100644 --- a/schema/cryptography-defs.json +++ b/schema/cryptography-defs.json @@ -1280,7 +1280,7 @@ ], "variant": [ { - "pattern": "BLS(13-381|13-377|BN254)", + "pattern": "BLS(12-381|12-377|BN254)", "primitive": "signature" }, { From 3749afdc70e74ac1d24f39e4add9131f30235fcf Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Fri, 8 May 2026 22:48:16 +0200 Subject: [PATCH 48/67] chore(workflows): add zizmor security gate and harden Actions credential handling (#925) This PR adds a [zizmor](https://github.com/woodruffw/zizmor) security-scanning workflow and hardens the existing GitHub Actions workflows against credential-leakage risks. Changes include: - New `.github/workflows/zizmor.yml` that runs the zizmor static-analysis tool on every push and pull-request, and on `dependabot.yml` changes. - All `actions/checkout` steps now use `persist-credentials: false` to avoid leaving GitHub tokens in the workspace. - All third-party Actions are pinned to their full commit SHA (with a human-readable version comment) so supply-chain substitutions are detectable. - A cooldown configuration block added to `dependabot.yml` to reduce noise from automated updates. fixes #924 --------- Signed-off-by: Jan Kowalleck Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com> Co-authored-by: Jan Kowalleck Co-authored-by: Jan Kowalleck --- .github/dependabot.yml | 12 ++++++++ .github/workflows/build_docs.yml | 6 ++++ .github/workflows/bundle_2.0_schemas.yml | 8 ++++-- .github/workflows/test_java.yml | 2 ++ .github/workflows/test_js.yml | 4 ++- .github/workflows/test_php.yml | 2 ++ .github/workflows/test_proto.yml | 2 ++ .github/workflows/update_spdx_licenses.yml | 6 +++- .github/workflows/zizmor.yml | 33 ++++++++++++++++++++++ 9 files changed, 70 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 55172b321..0c2cf9336 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 @@ -16,6 +18,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 @@ -26,6 +30,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 @@ -36,6 +42,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 @@ -46,6 +54,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 @@ -56,6 +66,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index 70d1fbcc4..e1072e815 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -22,6 +22,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 @@ -47,6 +49,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Python Environment # see https://github.com/actions/setup-python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 @@ -71,6 +75,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Generate Schema documentation run: ./gen.sh - name: Archive Schema documentation diff --git a/.github/workflows/bundle_2.0_schemas.yml b/.github/workflows/bundle_2.0_schemas.yml index adff66f96..1fa6790fa 100644 --- a/.github/workflows/bundle_2.0_schemas.yml +++ b/.github/workflows/bundle_2.0_schemas.yml @@ -21,10 +21,10 @@ jobs: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: - token: ${{ secrets.GITHUB_TOKEN }} + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: '20' @@ -40,6 +40,8 @@ jobs: ../../../../schema/2.0/cyclonedx-2.0.schema.json - name: Check for changes and commit + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | BUNDLED_FILE="schema/2.0/cyclonedx-2.0-bundled.schema.json" @@ -54,5 +56,5 @@ jobs: git config --local user.email "github-actions[bot]@users.noreply.github.com" git config --local user.name "github-actions[bot]" git commit -m "chore: update bundled schema [skip ci]" - git push + git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" fi diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml index 8c0cbabba..5935a22c0 100644 --- a/.github/workflows/test_java.yml +++ b/.github/workflows/test_java.yml @@ -24,6 +24,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml index f983c0c28..ee3db0f0b 100644 --- a/.github/workflows/test_js.yml +++ b/.github/workflows/test_js.yml @@ -27,9 +27,11 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: '24.x' package-manager-cache: false diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index 6fbcaf288..e6259aa25 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -27,6 +27,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup PHP # see https://github.com/shivammathur/setup-php uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml index 4d8b68b48..65847affc 100644 --- a/.github/workflows/test_proto.yml +++ b/.github/workflows/test_proto.yml @@ -27,5 +27,7 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Run test run: ./test.sh diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index 4ca160018..7d4512a62 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -26,6 +26,7 @@ jobs: uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: ref: ${{ github.ref_name }} + persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 @@ -77,6 +78,7 @@ jobs: uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: ref: ${{ github.ref_name }} + persist-credentials: false - name: Switch branch id: branch run: | @@ -98,6 +100,8 @@ jobs: name: schema-spdx path: schema - name: Commit and push + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -eux if git diff --quiet -- 'schema/spdx.*' @@ -109,7 +113,7 @@ jobs: git config user.email 'spdx-license-bumper@bot.local' git add -A schema git commit -s -m "feat: bump SPDX licenses $SB_VERSION" - git push origin "$SB_BRANCH" + git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$SB_BRANCH" - name: Pull request if: ${{ steps.branch.outputs.existed == 'false' }} run: > diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..1e00042b8 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,33 @@ +name: Zizmor + +on: + pull_request: + paths: + - '.github/workflows/**' + - '.github/dependabot.yml' + push: + paths: + - '.github/workflows/**' + - '.github/dependabot.yml' + schedule: + - cron: '0 0 * * 6' + +permissions: + contents: read + +jobs: + zizmor: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Checkout + # see https://github.com/actions/checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - name: Run zizmor + # see https://github.com/zizmorcore/zizmor-action + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + with: + advanced-security: false + annotations: true From 774ad5074038ffa249fd8cb98aa2a0ddd58f1e17 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Mon, 18 May 2026 11:15:14 +0200 Subject: [PATCH 49/67] chore: bump schema versions for upcoming changes Signed-off-by: Jan Kowalleck --- schema/bom-1.5.proto | 2 +- schema/bom-1.5.xsd | 2 +- schema/bom-1.6.proto | 2 +- schema/bom-1.6.xsd | 2 +- schema/bom-1.7.proto | 2 +- schema/bom-1.7.xsd | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/schema/bom-1.5.proto b/schema/bom-1.5.proto index d99c1a9cc..f6b565f84 100644 --- a/schema/bom-1.5.proto +++ b/schema/bom-1.5.proto @@ -1,5 +1,5 @@ syntax = "proto3"; -package cyclonedx.v1_5; +package cyclonedx.v1_5; // 1.5.1 import "google/protobuf/timestamp.proto"; // Specifies attributes of the text diff --git a/schema/bom-1.5.xsd b/schema/bom-1.5.xsd index 0651bcddd..dd5fe9d30 100644 --- a/schema/bom-1.5.xsd +++ b/schema/bom-1.5.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.5" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.5.0"> + version="1.5.1"> diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index 208c59923..3c96195dd 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -1,5 +1,5 @@ syntax = "proto3"; -package cyclonedx.v1_6; // version 1.6.1 +package cyclonedx.v1_6; // version 1.6.2 import "google/protobuf/timestamp.proto"; // Specifies attributes of the text diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 898132170..ec5bb7180 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.6" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.6.1"> + version="1.6.2"> diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto index a618b9266..e288d618a 100644 --- a/schema/bom-1.7.proto +++ b/schema/bom-1.7.proto @@ -1,5 +1,5 @@ syntax = "proto3"; -package cyclonedx.v1_7; +package cyclonedx.v1_7; // 1.7.1 import "google/protobuf/timestamp.proto"; // Specifies attributes of the text diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index c2c725efa..a6d2804c1 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -22,7 +22,7 @@ limitations under the License. targetNamespace="http://cyclonedx.org/schema/bom/1.7" vc:minVersion="1.0" vc:maxVersion="1.1" - version="1.7.0"> + version="1.7.1"> From 87fbed825c1888209a844f344312cf35f6013102 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 23 May 2026 06:52:19 +0000 Subject: [PATCH 50/67] chore(deps): bump shivammathur/setup-php from 2.37.0 to 2.37.1 Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.0 to 2.37.1. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/accd6127cb78bee3e8082180cb391013d204ef9f...7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/test_php.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index e6259aa25..21dfa0424 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -31,7 +31,7 @@ jobs: persist-credentials: false - name: Setup PHP # see https://github.com/shivammathur/setup-php - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 + uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2 with: php-version: "8.4" tools: composer:v2 From d2a6935bb3d51ea405c9310cf41d9a4688930198 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 09:01:57 +0000 Subject: [PATCH 51/67] chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.3 to 0.5.6. - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...5f14fd08f7cf1cb1609c1e344975f152c7ee938d) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 1e00042b8..57ae263bb 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -27,7 +27,7 @@ jobs: persist-credentials: false - name: Run zizmor # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 with: advanced-security: false annotations: true From b09e2c5e1af98eadd4452632be9ec9c39e06bec3 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 14:32:08 +0200 Subject: [PATCH 52/67] ci: pinned action comments exact versions Signed-off-by: Jan Kowalleck --- .github/workflows/build_docs.yml | 16 ++++++++-------- .github/workflows/bundle_2.0_schemas.yml | 6 ++++-- .../workflows/generate_algorithm_families.yml | 6 ++++-- .github/workflows/test_java.yml | 4 ++-- .github/workflows/test_js.yml | 4 ++-- .github/workflows/test_php.yml | 4 ++-- .github/workflows/test_proto.yml | 2 +- .github/workflows/update_spdx_licenses.yml | 10 +++++----- .github/workflows/zizmor.yml | 2 +- 9 files changed, 29 insertions(+), 25 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index e1072e815..b919ba5b8 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: '21' distribution: 'zulu' @@ -35,7 +35,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: XML-Schema-documentation path: docgen/xml/docs @@ -48,12 +48,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Python Environment # see https://github.com/actions/setup-python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ env.PYTHON_VERSION_DEFAULT }} architecture: 'x64' @@ -61,7 +61,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: JSON-Schema-documentation path: docgen/json/docs @@ -74,14 +74,14 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Generate Schema documentation run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: PROTO-Schema-documentation path: docgen/proto/docs diff --git a/.github/workflows/bundle_2.0_schemas.yml b/.github/workflows/bundle_2.0_schemas.yml index 1fa6790fa..5808d63d8 100644 --- a/.github/workflows/bundle_2.0_schemas.yml +++ b/.github/workflows/bundle_2.0_schemas.yml @@ -19,12 +19,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + # see https://github.com/actions/checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + # see https://github.com/actions/setup-node + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' diff --git a/.github/workflows/generate_algorithm_families.yml b/.github/workflows/generate_algorithm_families.yml index ec03cb24d..ae5ee2c53 100644 --- a/.github/workflows/generate_algorithm_families.yml +++ b/.github/workflows/generate_algorithm_families.yml @@ -17,13 +17,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + # see https://github.com/actions/checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + # see https://github.com/actions/setup-python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.x' diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml index 5935a22c0..061300a84 100644 --- a/.github/workflows/test_java.yml +++ b/.github/workflows/test_java.yml @@ -23,12 +23,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: '8' distribution: 'zulu' diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml index ee3db0f0b..02e5dcdf2 100644 --- a/.github/workflows/test_js.yml +++ b/.github/workflows/test_js.yml @@ -26,12 +26,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js # see https://github.com/actions/setup-node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.x' package-manager-cache: false diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index 21dfa0424..b761bc7b3 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -26,12 +26,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup PHP # see https://github.com/shivammathur/setup-php - uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2 + uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1 with: php-version: "8.4" tools: composer:v2 diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml index 65847affc..30b9acda1 100644 --- a/.github/workflows/test_proto.yml +++ b/.github/workflows/test_proto.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Run test diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index 7d4512a62..fe95faa76 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -23,13 +23,13 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: ${{ github.ref_name }} persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: '21' distribution: 'zulu' @@ -55,7 +55,7 @@ jobs: - name: Artifact changes if: ${{ steps.diff.outputs.changed == 'true' }} # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: retention-days: 1 name: schema-spdx @@ -75,7 +75,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: ref: ${{ github.ref_name }} persist-credentials: false @@ -95,7 +95,7 @@ jobs: fi - name: Fetch changes # https://github.com/actions/download-artifact - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: name: schema-spdx path: schema diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 57ae263bb..514bb6bc8 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Run zizmor From 45ea3f85effb09152bbd791327270fab5489ef07 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 14:46:15 +0200 Subject: [PATCH 53/67] chore: adjust zizmor Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 514bb6bc8..5abf34f86 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -1,19 +1,14 @@ name: Zizmor on: - pull_request: - paths: - - '.github/workflows/**' - - '.github/dependabot.yml' push: - paths: - - '.github/workflows/**' - - '.github/dependabot.yml' + branches: ['master', 'main'] + pull_request: + branches: ['**'] schedule: - cron: '0 0 * * 6' -permissions: - contents: read +permissions: {} jobs: zizmor: From 731f7adb0a6a8cc54c8a16918de1d1fcce32e120 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 14:47:49 +0200 Subject: [PATCH 54/67] chore: adjust zizmor Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 5abf34f86..a6fdd5680 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -10,6 +10,10 @@ on: permissions: {} +concurrency: + group: '${{ github.workflow }}-${{ github.ref }}' + cancel-in-progress: true + jobs: zizmor: runs-on: ubuntu-latest From 18d6e15bf078d8d152a84afac86e0a29f0bf1a53 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 14:59:56 +0200 Subject: [PATCH 55/67] wip Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index a6fdd5680..087c28dd7 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -5,6 +5,7 @@ on: branches: ['master', 'main'] pull_request: branches: ['**'] + workflow_dispatch: schedule: - cron: '0 0 * * 6' From 9d83527492f76bf71c65f48a254dfd29987c323a Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 15:02:28 +0200 Subject: [PATCH 56/67] wip Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 087c28dd7..f446ae3a9 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -17,17 +17,26 @@ concurrency: jobs: zizmor: + name: Zizmor runs-on: ubuntu-latest timeout-minutes: 10 + permissions: + contents: read steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - - name: Run zizmor + - name: Run zizmor 🌈 # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 with: + # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than + # uploading a SARIF report to GitHub's Security tab. + # Uploading SARIF requires `security-events: write` and GitHub Advanced Security (GHAS), + # both of which are unnecessary here and would violate the least-privilege policy. + # The two modes are mutually exclusive: advanced-security must be false for + # annotations to take effect. advanced-security: false annotations: true From 88dbd0e54a7185931db5d14f2cf0ce7df53ec1d0 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 15:03:41 +0200 Subject: [PATCH 57/67] wip Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index f446ae3a9..6baa00d73 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Run zizmor 🌈 From e5069604da335924d60ab361b64e5881c66aa333 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Wed, 3 Jun 2026 15:07:41 +0200 Subject: [PATCH 58/67] wip Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 6baa00d73..03725cafc 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -30,7 +30,7 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 with: # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than # uploading a SARIF report to GitHub's Security tab. From db134d69c24b576bbafe75df3641ce24acd6abf6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 06:52:51 +0000 Subject: [PATCH 59/67] chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.6 to 0.5.7. - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 03725cafc..149927a9a 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -30,7 +30,7 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 with: # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than # uploading a SARIF report to GitHub's Security tab. From 40e0891832d5cfcb68a7f7128a3836aeeb97ea21 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:27:25 +0200 Subject: [PATCH 60/67] chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 (#994) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.7 to 0.6.1.
    Release notes

    Sourced from zizmorcore/zizmor-action's releases.

    v0.6.1

    zizmor 1.28.0 is now the default version used by the action.

    v0.6.0

    zizmor 1.27.0 is now the default version used by the action.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=zizmorcore/zizmor-action&package-manager=github_actions&previous-version=0.5.7&new-version=0.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 149927a9a..e9878b0a2 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -30,7 +30,7 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 + uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 with: # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than # uploading a SARIF report to GitHub's Security tab. From 71cfd9b3600ac8c4d5ccba78a98c48295cc10b56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:28:25 +0200 Subject: [PATCH 61/67] chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#983) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
    Release notes

    Sourced from actions/setup-node's releases.

    v7.0.0

    What's Changed

    Enhancements:

    Bug fixes:

    Documentation updates:

    Dependency update:

    New Contributors

    Full Changelog: https://github.com/actions/setup-node/compare/v6...v7.0.0

    v6.5.0

    What's Changed

    Full Changelog: https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0

    Commits
    • 8207627 Migrate to ESM and upgrade dependencies (#1574)
    • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
    • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
    • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
    • 30eb73b Resolve high-severity audit issues
    • 4e1a87a Update dist
    • 360237f Strict equality
    • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
    • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
    • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-node&package-manager=github_actions&previous-version=6.4.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/bundle_2.0_schemas.yml | 2 +- .github/workflows/test_js.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bundle_2.0_schemas.yml b/.github/workflows/bundle_2.0_schemas.yml index 5808d63d8..4c03cd371 100644 --- a/.github/workflows/bundle_2.0_schemas.yml +++ b/.github/workflows/bundle_2.0_schemas.yml @@ -26,7 +26,7 @@ jobs: - name: Setup Node.js # see https://github.com/actions/setup-node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml index 02e5dcdf2..8151c2c6d 100644 --- a/.github/workflows/test_js.yml +++ b/.github/workflows/test_js.yml @@ -31,7 +31,7 @@ jobs: persist-credentials: false - name: Setup Node.js # see https://github.com/actions/setup-node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.x' package-manager-cache: false From 4600c1b1c31773062cc5ed8b0a8d087d101862aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:29:08 +0200 Subject: [PATCH 62/67] chore(deps): bump actions/checkout from 5.0.1 to 7.0.1 (#987) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.1 to 7.0.1.
    Release notes

    Sourced from actions/checkout's releases.

    v7.0.1

    What's Changed

    Full Changelog: https://github.com/actions/checkout/compare/v7...v7.0.1

    v7.0.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0

    v6.1.0

    What's Changed

    https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

    Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0

    v6.0.3

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3

    v6.0.2

    What's Changed

    ... (truncated)

    Changelog

    Sourced from actions/checkout's changelog.

    Changelog

    v7.0.1

    v7.0.0

    v6.0.3

    v6.0.2

    v6.0.1

    v6.0.0

    v5.0.1

    v5.0.0

    v4.3.1

    v4.3.0

    v4.2.2

    v4.2.1

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5.0.1&new-version=7.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build_docs.yml | 6 +++--- .github/workflows/bundle_2.0_schemas.yml | 2 +- .github/workflows/generate_algorithm_families.yml | 2 +- .github/workflows/test_java.yml | 2 +- .github/workflows/test_js.yml | 2 +- .github/workflows/test_php.yml | 2 +- .github/workflows/test_proto.yml | 2 +- .github/workflows/update_spdx_licenses.yml | 4 ++-- .github/workflows/zizmor.yml | 2 +- 9 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index b919ba5b8..eb4bb52e7 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up JDK @@ -48,7 +48,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Python Environment @@ -74,7 +74,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Generate Schema documentation diff --git a/.github/workflows/bundle_2.0_schemas.yml b/.github/workflows/bundle_2.0_schemas.yml index 4c03cd371..8ff8e33a9 100644 --- a/.github/workflows/bundle_2.0_schemas.yml +++ b/.github/workflows/bundle_2.0_schemas.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/generate_algorithm_families.yml b/.github/workflows/generate_algorithm_families.yml index ae5ee2c53..67ff0fae1 100644 --- a/.github/workflows/generate_algorithm_families.yml +++ b/.github/workflows/generate_algorithm_families.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout repository # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml index 061300a84..0e4913988 100644 --- a/.github/workflows/test_java.yml +++ b/.github/workflows/test_java.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up JDK diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml index 8151c2c6d..dfc750a13 100644 --- a/.github/workflows/test_js.yml +++ b/.github/workflows/test_js.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index b761bc7b3..71eee1a07 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup PHP diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml index 30b9acda1..f005f25cf 100644 --- a/.github/workflows/test_proto.yml +++ b/.github/workflows/test_proto.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run test diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index fe95faa76..6a722bba0 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.ref_name }} persist-credentials: false @@ -75,7 +75,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.ref_name }} persist-credentials: false diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index e9878b0a2..7ed8a6b35 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run zizmor 🌈 From aa9f38b2d111ae5aeac0a82d9c6e7342e034258d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:29:44 +0200 Subject: [PATCH 63/67] chore(deps): bump actions/setup-java from 5.2.0 to 5.6.0 (#986) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.2.0 to 5.6.0.
    Release notes

    Sourced from actions/setup-java's releases.

    v5.6.0

    What's Changed

    Full Changelog: https://github.com/actions/setup-java/compare/v5...v5.6.0

    v5.5.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/setup-java/compare/v5...v5.5.0

    v5.4.0

    What's Changed

    ... (truncated)

    Commits
    • 03ad4de Backport #1097/#1098: cache Maven and Gradle wrapper distributions separately...
    • d229d2e Backport #1111: Preserve Maven toolchains across repeated setup-java runs (#1...
    • bbf0f69 dist: Cover Tencent Kona JDK 25 (#1110)
    • 513edc4 feat: expose cache-primary-key output (#597) [v5 backport] (#1089)
    • 62df799 Add Maven compiler problem matcher for javac diagnostics (#1087)
    • 176156a chore: bump version to 5.6.0 for v5 release line
    • bf7b8de build: rebuild dist for backported changes (#1079, #1083, #1084)
    • 0173e6d Infer distribution from asdf .tool-versions vendor prefix (#1084)
    • f45cd82 Rename jdkFile input to jdk-file with deprecated alias (#1083)
    • e2863ad Map Zulu x86 architecture to i686 for Azul Metadata API (#1079)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-java&package-manager=github_actions&previous-version=5.2.0&new-version=5.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build_docs.yml | 2 +- .github/workflows/test_java.yml | 2 +- .github/workflows/update_spdx_licenses.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index eb4bb52e7..62a04dea7 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: '21' distribution: 'zulu' diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml index 0e4913988..4e0d7b5ab 100644 --- a/.github/workflows/test_java.yml +++ b/.github/workflows/test_java.yml @@ -28,7 +28,7 @@ jobs: persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: '8' distribution: 'zulu' diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index 6a722bba0..9b4c9dd4b 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -29,7 +29,7 @@ jobs: persist-credentials: false - name: Set up JDK # see https://github.com/actions/setup-java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: '21' distribution: 'zulu' From 10298c6455f6abc419fb9d2d86aa5ab781aae71a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:30:49 +0200 Subject: [PATCH 64/67] chore(deps): bump actions/setup-python from 5.6.0 to 7.0.0 (#993) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 7.0.0.
    Release notes

    Sourced from actions/setup-python's releases.

    v7.0.0

    What's Changed

    Enhancements

    Bug Fix

    Dependency Upgrade

    New Contributors

    Full Changelog: https://github.com/actions/setup-python/compare/v6...v7.0.0

    v6.3.0

    What's Changed

    Enhancement

    Dependency update

    Documentation

    New Contributors

    Full Changelog: https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0

    v6.2.0

    What's Changed

    Dependency Upgrades

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=5.6.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build_docs.yml | 2 +- .github/workflows/generate_algorithm_families.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index 62a04dea7..04b1a8ac7 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -53,7 +53,7 @@ jobs: persist-credentials: false - name: Setup Python Environment # see https://github.com/actions/setup-python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION_DEFAULT }} architecture: 'x64' diff --git a/.github/workflows/generate_algorithm_families.yml b/.github/workflows/generate_algorithm_families.yml index 67ff0fae1..a1fc3c797 100644 --- a/.github/workflows/generate_algorithm_families.yml +++ b/.github/workflows/generate_algorithm_families.yml @@ -25,7 +25,7 @@ jobs: - name: Set up Python # see https://github.com/actions/setup-python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.x' From d3ce653f82f1d2d4b2beb8d7c146d648b19e546e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:31:36 +0200 Subject: [PATCH 65/67] chore(deps): bump shivammathur/setup-php from 2.37.1 to 2.37.2 (#958) Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.1 to 2.37.2.
    Release notes

    Sourced from shivammathur/setup-php's releases.

    2.37.2

    Changelog

    • Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

    • Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

    • Improved looking up environment variables.

    • Tightened security in internal GitHub action workflows.

    • Updated Node.js dependencies.

    For the complete list of changes, please refer to the Full Changelog

    Commits

    > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/test_php.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml index 71eee1a07..00a41b949 100644 --- a/.github/workflows/test_php.yml +++ b/.github/workflows/test_php.yml @@ -31,7 +31,7 @@ jobs: persist-credentials: false - name: Setup PHP # see https://github.com/shivammathur/setup-php - uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: "8.4" tools: composer:v2 From daf2ca17d61d13f12f6d06ce2d437337ac65ec1b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:37:59 +0200 Subject: [PATCH 66/67] chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 (#911) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1.
    Release notes

    Sourced from actions/upload-artifact's releases.

    v7.0.1

    What's Changed

    Full Changelog: https://github.com/actions/upload-artifact/compare/v7...v7.0.1

    v7.0.0

    v7 What's new

    Direct Uploads

    Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

    ESM

    To support new versions of the @actions/* packages, we've upgraded the package to ESM.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/upload-artifact/compare/v6...v7.0.0

    v6.0.0

    v6 - What's new

    [!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

    Node.js 24

    This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

    What's Changed

    Full Changelog: https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0

    v5.0.0

    What's Changed

    ... (truncated)

    Commits
    • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
    • 634250c Include changes in typespec/ts-http-runtime 0.3.5
    • e454baa Readme: bump all the example versions to v7 (#796)
    • 74fad66 Update the readme with direct upload details (#795)
    • bbbca2d Support direct file uploads (#764)
    • 589182c Upgrade the module to ESM and bump dependencies (#762)
    • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
    • 02a8460 Add proxy integration test
    • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
    • e516bc8 docs: correct description of Node.js 24 support in README
    • Additional commits viewable in compare view

    > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build_docs.yml | 6 +++--- .github/workflows/update_spdx_licenses.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index 04b1a8ac7..3c4377c86 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -35,7 +35,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: XML-Schema-documentation path: docgen/xml/docs @@ -61,7 +61,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: JSON-Schema-documentation path: docgen/json/docs @@ -81,7 +81,7 @@ jobs: run: ./gen.sh - name: Archive Schema documentation # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: PROTO-Schema-documentation path: docgen/proto/docs diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index 9b4c9dd4b..5f2de82f9 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -55,7 +55,7 @@ jobs: - name: Artifact changes if: ${{ steps.diff.outputs.changed == 'true' }} # https://github.com/actions/upload-artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: retention-days: 1 name: schema-spdx From 4c845153c5aaf193fa4d8b84b2f0442ba7a9d28c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:38:43 +0200 Subject: [PATCH 67/67] chore(deps): bump actions/download-artifact from 5.0.0 to 8.0.1 (#926) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5.0.0 to 8.0.1.
    Release notes

    Sourced from actions/download-artifact's releases.

    v8.0.1

    What's Changed

    Full Changelog: https://github.com/actions/download-artifact/compare/v8...v8.0.1

    v8.0.0

    v8 - What's new

    [!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

    [!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

    Direct downloads

    To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

    Enforced checks (breaking)

    A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

    ESM

    To support new versions of the @actions/* packages, we've upgraded the package to ESM.

    What's Changed

    Full Changelog: https://github.com/actions/download-artifact/compare/v7...v8.0.0

    v7.0.0

    v7 - What's new

    [!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

    Node.js 24

    This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

    What's Changed

    ... (truncated)

    Commits
    • 3e5f45b Add regression tests for CJK characters (#471)
    • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
    • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
    • f258da9 Add change docs
    • ccc058e Fix linting issues
    • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
    • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
    • 15999bf Add note about package bumps
    • 974686e Bump the version to v8 and add release notes
    • fbe48b1 Update test names to make it clearer what they do
    • Additional commits viewable in compare view

    > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/update_spdx_licenses.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update_spdx_licenses.yml b/.github/workflows/update_spdx_licenses.yml index 5f2de82f9..c93fd4dd1 100644 --- a/.github/workflows/update_spdx_licenses.yml +++ b/.github/workflows/update_spdx_licenses.yml @@ -95,7 +95,7 @@ jobs: fi - name: Fetch changes # https://github.com/actions/download-artifact - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: schema-spdx path: schema