[WIP] CycloneDX v2.0 Specification - #652

Draft

stevespringett wants to merge 379 commits into

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 27, 2026

Merge remote-tracking branch 'origin/2.0-dev-threatmodeling' into 2.0-dev-threatmodeling
stevespringett
committed
1343aca
correted json syntax
stevespringett
committed
935364b
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
27282d3

Commits on Mar 31, 2026

Removed unnecessary token usage
stevespringett
committed
8e680d8
Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev
stevespringett
committed
522d5b7
chore: GH workflow default permissions for bundle_2.0_schemas.yml
jkowalleck
authored
be4e875

Commits on Apr 2, 2026

Adds custom fingerprints
bhess
committed
ebcf4c2

Commits on May 4, 2026

Commits on May 7, 2026

Added mockups
stevespringett
committed
54d16af

Commits on May 12, 2026

Added support for conditional components and associated unit tests.
stevespringett
committed
47319f5

Commits on May 14, 2026

Initial commit of the party model and test cases.
stevespringett
committed
41baec2

Commits on May 21, 2026

Add title/description to hash in common schema
bhess
committed
d54f9a0

Commits on May 22, 2026

Added new component identity model with updated test cases.
stevespringett
committed
10b343a

Commits on May 27, 2026

Major updates to threatmodeling and bluepring schemas and their related schemas. Supersedes and closes #777.
stevespringett
committed
21ca15a

Commits on Jun 1, 2026

Commits on Jun 3, 2026

feat(cryptography): add cryptographic agility plane to CBOM
bhess
committed
92a0604

Commits on Jun 4, 2026

CBOM: add custom fingerprints (#903)
stevespringett
authored
dd06849
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
96d485a

Commits on Jun 5, 2026

Move agility to component level, unify rotation and renewal object
bhess
committed
92c9827
WIP 2.0 threat-modeling schema set
stevespringett
committed
8a14716

Commits on Jun 6, 2026

Commits on Jun 7, 2026

Commits on Jun 8, 2026

Commits on Jun 11, 2026

Added control as first-class citizen and expanded use of controls to related areas in the spec.
stevespringett
committed
6ec41a6

Commits on Jun 12, 2026

Address review comments
bhess
committed
48a218c
feat: add origin region for hardware provenance
taleodor
committed
4bd160d

Commits on Jun 16, 2026

Added test cases, comment to schema, and corrected space issue with behavior schema.
stevespringett
committed
72407e7

Commits on Jun 18, 2026

Changed risk type to align with the kind of risk assessment performed - and updated it to be an array. Added cadence (previously was risk assessment type) to be a noun representing temporal data. U…
stevespringett
committed
10d7dd2

Commits on Jun 22, 2026

Removed name from being required. Updated test cases to address comments from Jan
stevespringett
committed
af32aca

Commits on Jun 28, 2026

Commits on Jul 12, 2026

Commits on Jul 20, 2026

unified evidence model addressing #278, #333 and other concerns.
stevespringett
committed
22b0d13

Commits on Jul 22, 2026

Commits on Jul 29, 2026

chore: mark generated
jkowalleck
committed
62dee9e
chore: mark generated
jkowalleck
committed
2a86067

Commits on Aug 3, 2026

fix: prevent refType/refLinkType from being a Bom-Link
jkowalleck
committed
2c43df6
feat: common `elementLink`
jkowalleck
committed
97eec28
refactor: use `elementLink`
jkowalleck
committed
85c554d
fix: use `elementLink` according to description
jkowalleck
committed
4cdefa6
docs
jkowalleck
committed
72384fd
refactor
jkowalleck
committed
17bc865
fix: linked elemenets
jkowalleck
committed
34f1df7
fix: linked elemenets
jkowalleck
committed
1606d88
[2.0] Tests: split schema 1.x 2.x (#999)
jkowalleck
authored
e1c91b7

Commits on Aug 4, 2026

Commits on Aug 5, 2026

chore: group tests by version
jkowalleck
committed
854a91f
tests: meta:enum tests
jkowalleck
committed
1bd21ad
tests: meta:enum tests (#1004)
jkowalleck
authored
bb2800a
tests: fix errorneous file output
jkowalleck
committed
372efe6
chore: tools private and gitignore
jkowalleck
committed
8159643
have schema paths
jkowalleck
committed
8a32e0c
feat: rewire excluded $ref
jkowalleck
committed
94566fa
tidy
jkowalleck
committed
eb17a0b
tidy
jkowalleck
committed
915eaca
schema fixes
jkowalleck
committed
7bdca03
tidy
jkowalleck
committed
0aa32c3
2.0 dev bundler externals rewrite (#1006)
jkowalleck
authored
3c2d065
tests: validate bundled schema only on mainline
jkowalleck
committed
ec7a40d
tests: validate bundled schema only on mainline (#1007)
jkowalleck
authored
67d3ec8
chore: fix js test runner chain
jkowalleck
committed
0bb19a1
chore: fix schema-bundler workflow
jkowalleck
committed
886366a
chore: fix schema-bundler workflow
jkowalleck
committed
93e1d82

Commits on Aug 7, 2026

Commits on Aug 9, 2026

Update schema/2.0/model/cyclonedx-risk-2.0.schema.json

stevespringett
and
jkowalleck
authored
d9718d6
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
4109d01
Update schema/2.0/model/cyclonedx-control-2.0.schema.json

stevespringett
and
jkowalleck
authored
3ac3bea
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
217916f
Update schema/behavior-taxonomy.schema.json

stevespringett
and
jkowalleck
authored
eeb8a3f
Update schema/2.0/model/cyclonedx-common-2.0.schema.json

stevespringett
and
jkowalleck
authored
40c5873
Update schema/2.0/model/cyclonedx-profile-2.0.schema.json

stevespringett
and
jkowalleck
authored
75bb5bd
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
3e3282d
Update schema/2.0/model/cyclonedx-weakness-2.0.schema.json

stevespringett
and
jkowalleck
authored
b0e8640
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
713d4fb
Update schema/2.0/model/cyclonedx-common-2.0.schema.json

stevespringett
and
jkowalleck
authored
3dcab8a
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
906c579

Commits on Aug 10, 2026

chore: split docs CDX1.x
jkowalleck
committed
68da661
chore: split docs CDX1.x
jkowalleck
committed
c5fc0d5
chore: split docs CDX1.x
jkowalleck
committed
998df95
chore: split docs CDX1.x
jkowalleck
committed
1beae2b
2.0 dev split docsgen (#1017)
jkowalleck
authored
6de25ce

Commits on Aug 14, 2026

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-vuln-evidence
jkowalleck
committed
84b08a4
revert docsgen scehma-v1 json mods
jkowalleck
committed
d52129e

Commits on Aug 15, 2026

Commits on Aug 18, 2026

chore: dependabot config (#1032)
jkowalleck
authored
721c601
Removed constraint on enum.
stevespringett
committed
1da95b5

Commits on Aug 20, 2026

Commits on Aug 21, 2026

chore: update test tools (#1038)
jkowalleck
authored
673a118

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Extensible Property Object allow `integer`
jkowalleck
committed
74e8a5e
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
32d19b0
2.0 dev tests default valus in range (#1044)
jkowalleck
authored
e082072
tests: check enum value constraints (#1046)
jkowalleck
authored
5725251
[2.0] linter detects enums literall "other" (#1047)
jkowalleck
authored
44fb005
linter-docs
jkowalleck
committed
63294a0
chore: GH workflow concurrency
jkowalleck
committed
e600705
Added support for GS1 Digital Link
stevespringett
committed
ad035fc
Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev
stevespringett
committed
4338510
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
9be30e5
[2.0] chema linter runs in in GH workflow (#1048)
jkowalleck
authored
1a950b1

Commits on Aug 26, 2026

Commits on Aug 27, 2026

chore: CI/CT linter summary (#1055)
jkowalleck
authored
0c2a413
2.0-dev ci linter summary download link (#1056)
jkowalleck
authored
fb30595
2.0-dev ci linter artifact underscoped
jkowalleck
committed
6ae0925
2.0-dev ci linter more data in result & more CI summary (#1057)
jkowalleck
authored
10978a3
linter summary fix
jkowalleck
committed
9001443
2.0-dev ci linter rename enum-value-no-other (#1059)
jkowalleck
authored
b5f7553
[2.0] refactor: JSON schema - trip trailing spaces and add final newline (#1060)
jkowalleck
authored
9065df8
[2.0] refactor: JSON schema - fix indention (#1061)
jkowalleck
authored
f1b38ce

Commits on Aug 28, 2026

2.0-dev ci linter check schema ID matches filepath (#1062)
jkowalleck
authored
9035eb8
docs
jkowalleck
committed
9099e16
linter checks bundled schemas (#1063)
jkowalleck
authored
f429a48
linter: no todo's (#1064)
jkowalleck
authored
9228572
Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
jkowalleck
authored
6c13d40
linter: no todo's
jkowalleck
committed
e73bf57

Commits on Aug 31, 2026

linter: refactor getEnabledChecks returns array
jkowalleck
committed
ad6b143
linter: add check ref-best-practice (#1068)
jkowalleck
authored
14eea6b
linter-docs
jkowalleck
committed
3b38e2e
2.0 dev linter object strictness (#1069)
jkowalleck
authored
1e9ca09
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
2299181
linter: mixin fix (#1071)
jkowalleck
authored
2c624a0
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
b53d6b9
Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
jkowalleck
authored
683a5d6
2.0 dev linter no deprecated (#1070)
jkowalleck
authored
6cc5bf1
linter_no-todos_more
jkowalleck
committed
f216a9e

Commits on Sep 1, 2026

2.0 dev linter cdx2-ref-type-usage (#1073)
jkowalleck
authored
b176983
Apply batched suggestions from code review
jkowalleck
authored
478ca70
Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
jkowalleck
authored
30d9dbb
linter: verbose tell getEnabledChecks
jkowalleck
committed
de41034
Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
jkowalleck
authored
a2fd703
2.0-dev_ghworkflows_split_by_schemaversion (#1074)
jkowalleck
authored
e8b6f37
Merge branch 'master' into 2.0-dev
jkowalleck
authored
abc621e
Merge branch '2.0-dev' into 2.0-dev-refType-nonconflicting-bom-link
jkowalleck
authored
e50d433
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck
authored
ea34c2d

Commits on Sep 3, 2026

Commits on Sep 9, 2026

Split selectedBy into mechanism and selecting party
bhess
committed
2e8b48a
Document the registry join and add protocol type tests
bhess
committed
0f67c4a

Commits on Sep 10, 2026

revisit linter check for schema ref best practice (#1092)
jkowalleck
authored
62eaac7
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
70393f9
chore: linter order checks alhabetically (#1093)
jkowalleck
authored
108c2e2
add some clarification
bhess
committed
c77c986
chore: linter improv: config & comment-ckeck (#1096)
jkowalleck
authored
73859c3
tests: lint non-core schemas (#1095)
jkowalleck
authored
7e16f47
ci: less verbose (#1097)
jkowalleck
authored
fb6775a
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck
authored
ffc4845
ci: fix lint_non-core_schemas artifact retention
jkowalleck
committed
b91d157
Merge branch '2.0-dev' into bhe-protocol-registry
jkowalleck
authored
dcd8f24

Commits on Sep 14, 2026

chore: fix liters literal other (#1105)
jkowalleck
authored
ea6cb04
refactor: const and enum shall have no type (#1104)
jkowalleck
authored
32b778e
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
439d4eb

Commits on Sep 17, 2026

Commits on Sep 18, 2026

ci: zizmor fix ref to reusable workflows (#1114)
jkowalleck
authored
90f99fe

Commits on Sep 24, 2026

Commits on Sep 30, 2026

fix(linter): fix property order check (#1130)
jkowalleck
authored
ad51902

Commits on Oct 1, 2026

fix(linter): property order check supports optionals (#1131)
jkowalleck
authored
8db6cfd

Commits on Oct 2, 2026