2.0

Issues

• wrong proto3 schema default values for enums

  breaking-changesdefectformat: ProtoBuf
  CycloneDX/specification#391 · Filter by author jkowalleck opened on Mar 2, 2024 · 2.0
  2

• revisit environmentVar definitions

  breaking-changescap: formulationrequest for commentRFC notice sent
  CycloneDX/specification#249 · Filter by author jkowalleck opened on Jun 16, 2023 · 2.0
  1

  

• environmentVar could use a "unique" constraints

  breaking-changescap: formulation
  CycloneDX/specification#247 · Filter by author jkowalleck opened on Jun 16, 2023 · 2.0
  1

  

• revisit the inputs and outputs.

  cap: formulation
  CycloneDX/specification#246 · Filter by author jkowalleck opened on Jun 16, 2023 · 2.0
  2

  

• All required properties should have "minLength": 1

  breaking-changesdefect
  CycloneDX/specification#461 · Filter by author Brcrwilliams opened on May 8, 2024 · 2.0
  3

  

• CycloneDX 2.0

  breaking-changesCDX 2.0proposed core enhancement
  CycloneDX/specification#631 · Filter by author stevespringett opened on May 3, 2025 · 2.0
  5

• CycloneDX 2.0 - Modularize the specification into multiple schemas

  breaking-changesproposed core enhancement
  Enhancement

  CycloneDX/specification#636 · Filter by author stevespringett opened on May 6, 2025 · 2.0
  

• CycloneDX 2.0 - Constrain Properties to Applicable Types

  defect
  Bug

  CycloneDX/specification#638 · Filter by author stevespringett opened on May 6, 2025 · 2.0
  1

  

• CycloneDX 2.0 - Auto-Generate .proto Schema from JSON Schema in 2.0

  breaking-changesformat: ProtoBufproposed core enhancement
  Enhancement

  CycloneDX/specification#640 · Filter by author stevespringett opened on May 6, 2025 · 2.0

• CycloneDX 2.0 - SPIKE: Investigate .xsd auto generation from JSON Schema

  format: XMLhelp wanted
  Task

  CycloneDX/specification#641 · Filter by author stevespringett opened on May 6, 2025 · 2.0

• Description of metadata.supplier is confusing

  CycloneDX/specification#345 · Filter by author nscuro opened on Nov 27, 2023 · 2.0
  9

  

• [WIP] CycloneDX v2.0 Specification

  breaking-changesCDX 2.0
  Unread
  CycloneDX/specification#652·stevespringett opened Jun 15, 2025 · Updated Oct 2, 2026·Draft
  30

  

• Expand upon ML explainability

  cap: ai/mlhelp wanted
  CycloneDX/specification#206 · Filter by author stevespringett opened on Apr 5, 2023 · 2.0
  2

• [FEATURE]: Standard grouping (CBOM related)

  cap: cryptographyproposed core enhancement
  Enhancement

  CycloneDX/specification#669 · Filter by author stevespringett opened on Aug 7, 2025 · 2.0
  4

• Tie ML inputs/outputs to CDX objects

  proposed core enhancement
  CycloneDX/specification#207 · Filter by author stevespringett opened on Apr 5, 2023 · 2.0

• Add schema reference to "externalReference" object

  proposed core enhancement
  CycloneDX/specification#185 · Filter by author mrutkows opened on Feb 8, 2023 · 2.0
  7

  

• Support evidence for services

  proposed core enhancement
  CycloneDX/specification#280 · Filter by author prabhu opened on Aug 25, 2023 · 2.0
  11

• modelCard Input/output descriptions

  cap: ai/mlproposed core enhancement
  CycloneDX/specification#343 · Filter by author bardenstein opened on Nov 17, 2023 · 2.0
  1

  

• Enhance metadata with richer description of custom code

  help wantedproposed core enhancement
  CycloneDX/specification#173 · Filter by author planetlevel opened on Jan 4, 2023 · 2.0
  1

• Consider changing bom-ref to bom-id in 2.0

  breaking-changesCDX 2.0proposed core enhancementrequest for commentRFC notice sent
  Enhancement

  CycloneDX/specification#673 · Filter by author stevespringett opened on Aug 15, 2025 · 2.0
  2

  

• [FEATURE]: EPSS Score on Vulnerability model

  proposed core enhancementrequest for commentRFC notice sent
  Enhancement

  CycloneDX/specification#481 · Filter by author mcombuechen opened on Jun 12, 2024 · 2.0
  11

  

• Should cryptoProperties only be specified for components of type cryptographic-asset?

  proposed core enhancement
  Enhancement

  CycloneDX/specification#522 · Filter by author stevespringett opened on Sep 11, 2024 · 2.0

• Change component type so that it's not required or add a new type of unassigned

  proposed core enhancement
  Enhancement

  CycloneDX/specification#466 · Filter by author pjdowner opened on May 14, 2024 · 2.0
  7

• [FEATURE]: Validity period for attestations

  proposed core enhancement
  CycloneDX/specification#483 · Filter by author tixu opened on Jun 14, 2024 · 2.0
  1

• Grammar and style check

  CDX 2.0defectdocumentationhelp wanted
  CycloneDX/specification#492 · Filter by author stevespringett opened on Jul 11, 2024 · 2.0
  4