This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git
The following commit(s) were added to refs/heads/main by this push:
new 56cb43d bump cyclonedx-core-java dependency, make CycloneDX 1.7 the
new default
56cb43d is described below
commit 56cb43d86c25b26fd4b67ed236f77c5ff3ecebbd
Author: Stefan Bodewig <[email protected]>
AuthorDate: Thu Jul 16 19:51:50 2026 +0200
bump cyclonedx-core-java dependency, make CycloneDX 1.7 the new default
---
build.xml | 4 ++--
changes.xml | 7 +++++++
docs/archivebom.html | 4 ++--
docs/component.html | 6 ++----
docs/componentbom.html | 4 ++--
ivy.xml | 2 +-
src/main/org/apache/ant/cyclonedx/Component.java | 11 ++++++-----
src/main/org/apache/ant/cyclonedx/ComponentBomTask.java | 2 +-
src/main/org/apache/ant/cyclonedx/ExternalReference.java | 2 +-
src/main/org/apache/ant/cyclonedx/SpecVersion.java | 6 +++---
src/main/org/apache/ant/cyclonedx/antlib.xml | 2 +-
src/tests/antunit/componentbom-test.xml | 8 ++++----
12 files changed, 32 insertions(+), 26 deletions(-)
diff --git a/build.xml b/build.xml
index 0660878..91e9b0d 100644
--- a/build.xml
+++ b/build.xml
@@ -99,10 +99,10 @@ under the License.
publisher="OWASP Foundation"
group="org.cyclonedx"
name="cyclonedx-core-java"
- version="12.2.0"
+ version="13.0.0"
description="The CycloneDX core module provides a model
representation of the BOM along with utilities to assist in creating, parsing,
and validating BOMs."
id="cyclonedx-core">
- <file file="${lib.dir.compile}/cyclonedx-core-java-12.2.0.jar"/>
+ <file file="${lib.dir.compile}/cyclonedx-core-java-13.0.0.jar"/>
<license refid="apache-2"/>
<externalReference
type="website"
diff --git a/changes.xml b/changes.xml
index e24fdfc..4ced467 100644
--- a/changes.xml
+++ b/changes.xml
@@ -77,6 +77,13 @@
the serial number of the generated SBOM to be set to a fixed
value for reproducible builds.
</action>
+ <action type="update">
+ Updated cyclonedx-java-core library dependency to 13.0.0.
+ </action>
+ <action type="update">
+ The default SBOM version now is 1.7 and the isExternal attribute
+ of component now also sets the attribute in the generated SBOM.
+ </action>
</release>
<release version="0.1" date="2026-06-03" description="initial release">
diff --git a/docs/archivebom.html b/docs/archivebom.html
index 478d1db..8f45656 100644
--- a/docs/archivebom.html
+++ b/docs/archivebom.html
@@ -62,13 +62,13 @@ <h3>Attributes</h3>
<tr>
<td>specVersion</td>
<td>Version of the CycloneDX specification for the generated
- SBOM. This can be specified as number (like "1.6") or one of
+ SBOM. This can be specified as number (like "1.7") or one of
the enum constants of the <code>org.cyclonedx.Version</code>
type (i.e. like "VERSION_16").<br/>
The supported values depend on the CycloneDX Core (Java)
library version used.
</td>
- <td>No, defaults to "1.6" in the current version of the Ant
+ <td>No, defaults to "1.7" in the current version of the Ant
library but this may change in future versions.</td>
</tr>
<tr>
diff --git a/docs/component.html b/docs/component.html
index e93e8fb..6aa3f9c 100644
--- a/docs/component.html
+++ b/docs/component.html
@@ -97,9 +97,7 @@ <h3>Attributes</h3>
<cite>An external component is one that is not part of an
assembly, but is expected to be provided by the
environment, regardless of the component's
- scope.</cite><br/>
- This attribute doesn't have any effect as long as CycloneDX
- Core doesn't support version 1.7 of the specification.
+ scope.</cite>
</td>
<td>No, <code>isExternal</code> must not be <code>true</code>
for the main component of the SBOM.</td>
@@ -400,7 +398,7 @@ <h3>Examples</h3>
<license refid="apache-2"/>
<externalReferenceSet refid="antlib-ext-refs"/>
<dependency componentRef="ant"/>
- <dependency
bomRef="pkg:maven/org.cyclonedx/[email protected]?type=jar"/>
+ <dependency
bomRef="pkg:maven/org.cyclonedx/[email protected]?type=jar"/>
</cdx:component>
</pre>
</body>
diff --git a/docs/componentbom.html b/docs/componentbom.html
index e35ab26..0170590 100644
--- a/docs/componentbom.html
+++ b/docs/componentbom.html
@@ -54,13 +54,13 @@ <h3>Attributes</h3>
<tr>
<td>specVersion</td>
<td>Version of the CycloneDX specification for the generated
- SBOM. This can be specified as number (like "1.6") or one of
+ SBOM. This can be specified as number (like "1.7") or one of
the enum constants of the <code>org.cyclonedx.Version</code>
type (i.e. like "VERSION_16").<br/>
The supported values depend on the CycloneDX Core (Java)
library version used.
</td>
- <td>No, defaults to "1.6" in the current version of the Ant
+ <td>No, defaults to "1.7" in the current version of the Ant
library but this may change in future versions.</td>
</tr>
<tr>
diff --git a/ivy.xml b/ivy.xml
index df30f0c..50243c5 100644
--- a/ivy.xml
+++ b/ivy.xml
@@ -58,7 +58,7 @@
<artifact name="${artifact.name}" type="cyclonedx.json.asc"
ext="cdx.json.asc"/>
</publications>
<dependencies>
- <dependency org="org.cyclonedx" name="cyclonedx-core-java" rev="12.2.0"
conf="default"/>
+ <dependency org="org.cyclonedx" name="cyclonedx-core-java" rev="13.0.0"
conf="default"/>
<dependency org="org.apache.ant" name="ant" rev="1.10.17"
conf="provided->default"/>
<dependency org="org.apache.ant" name="ant-launcher" rev="1.10.17"
conf="provided->default"/>
<dependency org="org.apache.ant" name="ant-antunit" rev="1.5.0"
conf="test->default"/>
diff --git a/src/main/org/apache/ant/cyclonedx/Component.java
b/src/main/org/apache/ant/cyclonedx/Component.java
index 764e227..9eef8c1 100644
--- a/src/main/org/apache/ant/cyclonedx/Component.java
+++ b/src/main/org/apache/ant/cyclonedx/Component.java
@@ -332,9 +332,6 @@ public class Component extends DataType {
* <p>Must not be set to {@code true} for the main component of
* the SBOM.</p>
*
- * <p>Right now this attribute has no effect until the CycloneDX
- * core library supports the specification version 1.7.</p>
- *
* @param isExternal whether the component is external
*/
public void setIsExternal(boolean isExternal) {
@@ -601,7 +598,9 @@ public class Component extends DataType {
if (scope != null) {
component.setScope(scope);
}
- // add isExternal once VERSION_17 is supported by cyclonedx-java-core
+ if (isExternal) {
+ component.setIsExternal(true);
+ }
return component;
}
@@ -739,7 +738,9 @@ public class Component extends DataType {
if (scope == null && real.getScope() != null) {
setScope(ComponentScope.from(real.getScope()));
}
- // copy isExternal once CycloneDX Core supports it
+ if (!isExternal) {
+ setIsExternal(Boolean.TRUE.equals(real.getIsExternal()));
+ }
if (description == null) {
setDescription(real.getDescription());
}
diff --git a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
index ec076d4..eb7cd00 100644
--- a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
+++ b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
@@ -67,7 +67,7 @@ public class ComponentBomTask extends Task {
/**
* Specifies the CycloneDX version to use.
*
- * <p>Defaults to 1.6.</p>
+ * <p>Defaults to 1.7.</p>
*
* @param specVersion specification version
*/
diff --git a/src/main/org/apache/ant/cyclonedx/ExternalReference.java
b/src/main/org/apache/ant/cyclonedx/ExternalReference.java
index ed4cbd8..6bbf15c 100644
--- a/src/main/org/apache/ant/cyclonedx/ExternalReference.java
+++ b/src/main/org/apache/ant/cyclonedx/ExternalReference.java
@@ -37,7 +37,7 @@ public class ExternalReference {
* <p>Types defined by the specification or the enum names of <a
href="https://github.com/CycloneDX/cyclonedx-core-java";>CycloneDX
Core (Java)</a>'s <a
-
href="https://javadoc.io/static/org.cyclonedx/cyclonedx-core-java/12.2.0/org/cyclonedx/model/ExternalReference.Type.html";>type
+
href="https://javadoc.io/static/org.cyclonedx/cyclonedx-core-java/13.0.0/org/cyclonedx/model/ExternalReference.Type.html";>type
enum</a> are accepted.</p>
*
* @param type reference's type
diff --git a/src/main/org/apache/ant/cyclonedx/SpecVersion.java
b/src/main/org/apache/ant/cyclonedx/SpecVersion.java
index b3695ee..9d22a76 100644
--- a/src/main/org/apache/ant/cyclonedx/SpecVersion.java
+++ b/src/main/org/apache/ant/cyclonedx/SpecVersion.java
@@ -10,8 +10,8 @@ import org.cyclonedx.Version;
/**
* CycloneDX specification version to use for the SBOM.
*
- * <p>Accepts the enum constants like {@code VERSION_16} as well as
- * the human readable version {@code 1.6}. The values are directly
+ * <p>Accepts the enum constants like {@code VERSION_17} as well as
+ * the human readable version {@code 1.7}. The values are directly
* provided by CycloneDX Core's enum.</p>
*/
public class SpecVersion extends EnumeratedAttribute {
@@ -23,7 +23,7 @@ public class SpecVersion extends EnumeratedAttribute {
static {
DEFAULT = new SpecVersion();
- DEFAULT.setValue(Version.VERSION_16.name());
+ DEFAULT.setValue(Version.VERSION_17.name());
}
@Override
diff --git a/src/main/org/apache/ant/cyclonedx/antlib.xml
b/src/main/org/apache/ant/cyclonedx/antlib.xml
index 70e235d..d773e30 100644
--- a/src/main/org/apache/ant/cyclonedx/antlib.xml
+++ b/src/main/org/apache/ant/cyclonedx/antlib.xml
@@ -36,7 +36,7 @@ under the License.
<!-- extracted after writing very similar macros for antlibs, Ivy
and Ant itself -->
<macrodef name="archivebom" backtrace="false">
- <attribute name="specVersion" default="1.6"/>
+ <attribute name="specVersion" default="1.7"/>
<attribute name="format" default="json"/>
<attribute name="serialNumber" default="random"/>
<attribute name="bomName" default="bom"/>
diff --git a/src/tests/antunit/componentbom-test.xml
b/src/tests/antunit/componentbom-test.xml
index d121ad6..02c551d 100644
--- a/src/tests/antunit/componentbom-test.xml
+++ b/src/tests/antunit/componentbom-test.xml
@@ -357,28 +357,28 @@
<cdx:componentbom
outputdirectory="${output}"
format="json"
- specVersion="1.6"
+ specVersion="1.7"
xmlns:cdx="antlib:org.apache.ant.cyclonedx">
<component name="testname"/>
</cdx:componentbom>
<au:assertResourceContains
xmlns:au="antlib:org.apache.ant.antunit"
resource="${output}/bom.json"
- value='"specVersion" : "1.6"'/>
+ value='"specVersion" : "1.7"'/>
</target>
<target name="testSpecVersionAsEnumValue">
<cdx:componentbom
outputdirectory="${output}"
format="json"
- specVersion="VERSION_16"
+ specVersion="VERSION_17"
xmlns:cdx="antlib:org.apache.ant.cyclonedx">
<component name="testname"/>
</cdx:componentbom>
<au:assertResourceContains
xmlns:au="antlib:org.apache.ant.antunit"
resource="${output}/bom.json"
- value='"specVersion" : "1.6"'/>
+ value='"specVersion" : "1.7"'/>
</target>
<target name="testDependencies">
