Skip to content

[WIP] CycloneDX v2.0 Specification - #652

Draft
stevespringett wants to merge 451 commits into
masterfrom
2.0-dev
Draft

[WIP] CycloneDX v2.0 Specification#652
stevespringett wants to merge 451 commits into
masterfrom
2.0-dev

Conversation

@stevespringett

@stevespringett stevespringett commented Jun 15, 2025 •
edited by jkowalleck
Loading

Copy link
Copy Markdown
Member

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2

BREAKING Changes

  • Drop schema for XML.
    To be explained further.
  • Drop schema for Protocol Buffers
    Reasoning: Downstream spec users may build ontop of JSON schema.
    To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...

@stevespringett stevespringett added this to the 2.0 milestone Jun 15, 2025
@stevespringett stevespringett self-assigned this Jun 15, 2025
@stevespringett stevespringett added the CDX 2.0 related to release v2.0 label Jun 15, 2025
@stevespringett stevespringett linked an issue Jun 15, 2025 that may be closed by this pull request
CycloneDX 2.0 #631
Open
@jkowalleck jkowalleck changed the title CycloneDX v2.0 Specification [WIP] CycloneDX v2.0 Specification Jun 16, 2025
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 11, 2025
View reviewed changes
Comment thread .github/workflows/bundle-schema.yml Fixed
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 11, 2025
View reviewed changes
Comment thread ...json/venv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js Fixed
Comment thread ...json/venv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js Fixed
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 11, 2025
View reviewed changes
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 12, 2025
View reviewed changes
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 12, 2025
View reviewed changes
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 29, 2025
View reviewed changes
Comment thread tools/src/main/js/linter/checks/description-full-stop.check.js
// Pattern for markdown links at the end
const markdownLinkPattern = /\]\([^)]+\)$/;

return urlPattern.test(text) || markdownLinkPattern.test(text);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'http://' and with many repetitions of 'http://'.
Comment thread tools/src/main/js/linter/checks/description-full-stop.check.js
// Pattern for markdown links at the end
const markdownLinkPattern = /\]\([^)]+\)$/;

return urlPattern.test(text) || markdownLinkPattern.test(text);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '](' and with many repetitions of ']('.
github-advanced-security[bot]
github-advanced-security AI found potential problems Nov 29, 2025
View reviewed changes
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
Comment thread tools/src/main/js/bundler/bundle-schemas.js Fixed
@stevespringett
stevespringett force-pushed the 2.0-dev branch 4 times, most recently from f63bd4a to 9a09935 Compare December 1, 2025 19:39
This was referenced Apr 13, 2026
Open
Open
stevespringett and others added 11 commits July 22, 2026 16:13
@stevespringett
Added missing quantity for device and material components
5c83b68 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Added additional test cases for quantity.
9312c82 
Signed-off-by: Steve Springett <steve@springett.us>
@jkowalleck
chore: mark generated
62dee9e 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
chore: mark generated
2a86067 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
fix: prevent refType/refLinkType from being a Bom-Link
2c43df6 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
feat: common elementLink
97eec28 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
refactor: use elementLink
85c554d 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
fix: use elementLink according to description
4cdefa6 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
docs
72384fd 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
refactor
17bc865 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck
fix: linked elemenets
34f1df7 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
stevespringett and others added 30 commits October 13, 2026 18:06
@stevespringett
Reverting defect fix
baa6e81 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Fixing mediatype defect in regex pattern
81359be 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Fixing mediatype defect in regex pattern (#1158)
f43b077
@github-actions
chore: update bundled schemas [skip ci]
7fa1f29
@stevespringett
Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-threatmode…
d58a2ae 
…ling-library-parity
@stevespringett
Merge branch '2.0-dev' into 2.0-dev-epss
d2b4c04
@stevespringett
Merge branch '2.0-dev' into 2.0-dev-safety
31126b7
@jkowalleck @github-actions
[2.0] bundler rewrite (#1146)
4339678 
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@jkowalleck
Merge branch '2.0-dev' into 2.0-dev-product-inventory
104bb4a
@stevespringett
Fixing unit tests and putting back item that was omitted during prior…
8709e87 
… merge.

Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Inventory refactor and definitions registry (#1075)
8b1fa66
@github-actions
chore: update bundled schemas
e880981 
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@stevespringett
Merge branch '2.0-dev' into 2.0-dev_revisit-workflows
c055eaf
@stevespringett
formulation environmentVars as system-independent key-value (#1088)
4c68902
@github-actions
chore: update bundled schemas
f8fcbee 
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@stevespringett
Merge branch '2.0-dev' into 2.0-dev-threatmodeling-library-parity
e259a95
@stevespringett
feat: Add OWASP Threat Model Library parity (#1034)
d3a045d
@github-actions
chore: update bundled schemas
ae0d684 
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@stevespringett
Merge remote-tracking branch 'origin/2.0-dev-epss' into 2.0-dev-epss
f16cfef
@stevespringett @jkowalleck
Apply suggestion from @jkowalleck
754cb59 
Co-authored-by: Jan Kowalleck <jan.kowalleck@owasp.org>
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Minor corrections
5c34d1a 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Merge remote-tracking branch 'origin/2.0-dev-epss' into 2.0-dev-epss
c862476
@stevespringett
Merge branch '2.0-dev' into 2.0-dev-epss
7cafa43
@stevespringett
Add EPSS and other scoring systems that leverage measurements rather …
e8869cf 
…than scores. (#1117)
@github-actions
chore: update bundled schemas
6bdc06a 
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@stevespringett
Merge branch '2.0-dev' into 2.0-dev-safety
b6fd250
@stevespringett
Merge remote-tracking branch 'origin/2.0-dev-safety' into 2.0-dev-safety
6e01384
@stevespringett
Aligned test cases to match recent changes in main.
fd6ea25 
Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
Added RDX risk alignment. Add safety. Minor refactor (#1120)
7272b6c
@github-actions
chore: update bundled schemas
b316d3c 
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkowalleck jkowalleck jkowalleck left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@stevespringett stevespringett

Labels

breaking-changes CDX 2.0 related to release v2.0

Projects

None yet

Milestone

2.0

Development

Successfully merging this pull request may close these issues.

CycloneDX 2.0

5 participants

@stevespringett @jkowalleck @github-advanced-security @bhess @petra-dv