3.0.1

Fixed

• fixed a possible JSON schema validation issue regarding "version" property (via #352)

---

Full Changelog: v3.0.0...v3.0.1

3.0.0

BREAKING

• Interface \CycloneDX\Core\Spec\Spec was removed from public API (#344 via #345)
  This is only a breaking change if you used this interface downstream; internal usage is non-breaking.
  This change was necessary, so that implementing more spec-features cause no breaking changes.

Style

• Applied latest PHP Coding Standards (via #341)

---

Full Changelog: v2.3.0...v3.0.0

2.3.0

Added support for CycloneDX Specification-1.5.

• Changed
  • Method \CycloneDX\Core\Spec\SpecFactory::makeForVersion() supports CycloneDX Specification-1.5 now (#193 via #255)
  • Classes \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\* support CycloneDX Specification-1.5 now (#193 via #255)
  • Classes \CycloneDX\Core\Validation\Validators\* support CycloneDX Specification-1.5 now (#193 via #255)
• Added
  • Namespace \CycloneDX\Core\Enums
    • Enum ComponentType got new cases (#193 via #255)
      New: Data, DeviceDriver, MachineLearningModel, Platform
    • Enum ExternalReferenceType got new cases (#193 via #255)
      New: AdversaryModel, Attestation, CertificationReport, CodifiedInfrastructure, ComponentAnalysisReport, Configuration, DistributionIntake, DynamicAnalysisReport, Evidence, ExploitabilityStatement, Formulation, Log, MaturityReport, ModelCard, POAM, PentestReport, QualityMetrics, RiskAssessment, RuntimeAnalysisReport, SecurityContact, StaticAnalysisReport, ThreatModel, VulnerabilityAssertion
  • Namespace \CycloneDX\Core\Spec
    • New method SpecFactory::make1dot5() to reflect CycloneDX Specification-1.5 (#193 via #255)
    • Enum Version got new case v1dot5 to reflect CycloneDX Specification-1.5 (#193 via #255)
• Misc
  • Added functional and integration tests for CycloneDX Specification-1.5 (#193 via #255)
  • Fetched latest stable schema definition files for offline usage (via #255)

---

Full Changelog: v2.2.0...v2.3.0

2.2.0

Changed

• Class \CycloneDX\Core\Serialization\JsonSerializer
  • Property normalizerFactory became protected readonly, was private readonly (#305 via #306)
  • Property jsonEncodeFlags became protected readonly, was private readonly (#305 via #306)
• Class \CycloneDX\Core\Serialization\XmlSerializer
  • Property normalizerFactory became protected readonly, was private readonly (#305 via #306)
  • Property xmlVersion became protected readonly, was private readonly (#305 via #306)
  • Property xmlEncoding became protected readonly, was private readonly (#305 via #306)

Style

• Applied latest PHP Coding Standards (via #302)
  Some parameters allow nullables implicitly, was explicitly.
• Wrote some class properties with constructor promotion (via #309)

---

Full Changelog: v2.1.2...v2.2.0

2.1.2

Fixed

• \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\LicenseRepositoryNormalizer::normalize() now omits invalid license combinations (#285 via #290)
  If there is any LicenseExpression, then this is the only license normalized; otherwise all licenses are normalized.

Docs

• Fixed link to CycloneDX-specification in README (via #288)

---

Full Changelog: v2.1.1...v2.1.2

2.1.1

Docs

• Announce and annotate the generator for BOM's SerialNumber (#277 via #282)

---

Full Changelog: v2.1.0...v2.1.1

2.1.0

Fixed

• "Bom.serialNumber" data model can have values following the alternative format allowed in CycloneDX XML specification (#277 via #278)
• \CycloneDX\Core\Serialization\{DOM,JSON}\Normalizers\BomNormalizer::normalize() now omits invalid/unsupported values for serialNumber (#277 via #278)

Changed

• \CycloneDX\Core\Models\Bom::setSerialNumber() no longer throws \DomainException when the value is of an unsupported format (#277 via #278)
  This is considered a non-breaking behavior change, because the corresponding normalizers assure valid data results.

Added

• Published generator for BOM's SerialNumber: \CycloneDX\Core\Utils\BomUtility::randomSerialNumber() (#277 via #278)
  The code was donated from cyclonedx-php-composer.

---

Full Changelog: v2.0.0...v2.1.0

2.0.0

Added CycloneDX spec v1.4 support,
Streamlined API & data models for easy use,
Internal rework, modernization, refactoring.

Breaking changes

• Removed support for PHP v7.3 ([#6] via [#125])
• Removed support for PHP v7.4 ([#114] via [#125])
• Removed support for PHP v8.0 (via [#204])
• Changed models' aggregation properties to be no longer optional ([#66] via [#131])
• Changed models to be less restrictive ([#247] via [#249])
• Streamlined repository data structures to follow a common method naming scheme (via [#131])
• Enumeration-like classes were converted to native PHP Enumerations ([#140], [#256] via [#204], [#257])

Added

• Support for CycloneDX schema/spec v1.4 ([#57] via [#65], [#118], [#123])
• Support for properties ([#228] via [#165], [#229], [#231])

Misc

• All class properties now enforce the correct types ([#6], [#114] via [#125])
  This is considered a non-breaking change, because the types were already correctly annotated.
• Migrated internals to PHP8 language features ([#114] via [#125])

API change log & Migration instructions

See the change list and migration details

---

Full Changelog: v1.6.2...v2.0.0

2.0.0-RC1

v2 - Release Candidate 1

Changelog:

see https://github.com/CycloneDX/cyclonedx-php-library/blob/v2.0.0-RC1/HISTORY.md#200---unreleased

Install

composer require cyclonedx/cyclonedx-library:2.0.0-RC1

---

Full Changelog: v1.6.2...v2.0.0-RC1

1.6.3

Maintenance Release.

Legal:

• Transferred copyright to OWASP Foundation. (via #121)