Unfortunately, there are also breaking changes in this release:
The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.
Changelog
Fixes
64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@nscuro)
Building and Packaging
696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@dependabot[bot])
b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@dependabot[bot])
5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@dependabot[bot])
b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@dependabot[bot])
9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@dependabot[bot])
89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@dependabot[bot])
Others
61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@nscuro)
f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@nscuro)
ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@mmorel-35)
Bumps the go-modules group with 25 updates:
1.30.01.31.10.18.00.18.20.7.20.8.00.0.0-20230412183729-8602f1afc5740.0.11.0.61.1.01.3.61.3.71.7.111.7.130.8.00.8.10.4.00.5.00.17.00.19.01.4.01.6.01.17.41.17.64.1.194.1.210.4.40.4.70.2.00.3.02.15.02.15.10.0.0-20230301185719-21920a456ad50.0.0-20230925121702-07e42b3cdba00.17.00.18.00.14.00.15.00.19.00.21.00.5.00.6.00.15.00.17.00.16.00.16.11.59.01.61.11.31.01.32.0Updates
github.com/onsi/gomegafrom 1.30.0 to 1.31.1Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
762b171v1.31.126661b8tidy up go.sumbde8f7abump dependencies24e958dShow how to import the format sub packagead1a367Update test in case keeping msg is desirede0dd999Inverted arguments order of FailureMessage of BeComparableToMatcherba8bba2v1.31.0121c37fAsync assertions include context cancellation cause if presentdee1e3cBump minimum go version49005fedocs: fix typo in example usage "occured" -> "occurred"Updates
github.com/paketo-buildpacks/occamfrom 0.18.0 to 0.18.2Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
f37d228Bump github.com/opencontainers/runc from 1.1.5 to 1.1.121d68391tests: adding tests for NewContainerFromInspectOutput function13e5704fix: avoid accessing undefined host ports on while creating a new container f...0fb0353Bump github.com/containerd/containerd from 1.7.7 to 1.7.11Updates
github.com/CycloneDX/cyclonedx-gofrom 0.7.2 to 0.8.0Release notes
Sourced from github.com/CycloneDX/cyclonedx-go's releases.
Commits
b9654aeMerge pull request #90 from CycloneDX/spec-v1.564eb0c8fix: remove format linters that require extra toolingc7a84acfeat(spec1-5): handle deprecation of toolsf856daafeat(spec1-5): add support for formulation2fbde0efeat(spec1-5): add support for identity, occurrences, and callstack evidence61dd91efeat(spec1-5): add support for machine learningf831960feat(spec1-5): updatevalid-vulnerabilitytest snapshotsfe3a904feat(spec1-5): add support for ssvc scoring method7d2713ffeat(spec1-5): add support for vulnerability proof of concept2ae5445feat(spec1-5): add support for additional compositions and composition identityUpdates
github.com/anchore/stereoscopefrom 0.0.0-20230412183729-8602f1afc574 to 0.0.1Commits
Updates
github.com/andybalholm/brotlifrom 1.0.6 to 1.1.0Commits
17e5901Make my matchfinder work more accessible.cf812c0matchfinder: add M01b6cf36matchfinder: remove MultiHash265f3afmatchfinder: penalize score for overlapping matchesa8d524amatchfinder: replace Score function with DistanceBitCost578645ematchfinder: add MultiHash24b2bfamatchfinder.M4: add Score function4a024e3matchfinder.M4: add match chain3a1c5cdFix typo in comment.0d2aef3matchfinder.M4: factor out extendMatch2Updates
github.com/cloudflare/circlfrom 1.3.6 to 1.3.7Release notes
Sourced from github.com/cloudflare/circl's releases.
Commits
c48866bReleasing CIRCL v1.3.775ef91ekyber: remove division by q in ciphertext compression899732abuild(deps): bump golang.org/x/cryptoUpdates
github.com/containerd/containerdfrom 1.7.11 to 1.7.13Release notes
Sourced from github.com/containerd/containerd's releases.
... (truncated)
Commits
7c3aca7Merge pull request #9724 from dmcgowan/prepare-v1.7.13b97e611Prepare release notes for v1.7.132e7fa14Update runc binary to v1.1.12cbda56bMerge pull request #9693 from k8s-infra-cherrypick-robot/cherry-pick-9684-to-...1bed378seccomp: kernel 6.71944259Merge pull request #9685 from elezar/dependency-update-container-device-inter...14628d4Update container-device-interface to v0.6.28c780b7Merge pull request #9658 from vvoland/contentprovider-1.78364779content: Add InfoReaderProvider71909c1Merge pull request #9632 from dmcgowan/prepare-v1.7.12Updates
github.com/docker/docker-credential-helpersfrom 0.8.0 to 0.8.1Release notes
Sourced from github.com/docker/docker-credential-helpers's releases.
Commits
292722bMerge pull request #308 from thaJeztah/update_golang_1.21.6979dcc4Merge pull request #309 from thaJeztah/update_golangcif411a65Dockerfile: update golangci-lint to v1.55.29629bd7update to go1.21.6f642c26Merge pull request #306 from thaJeztah/err_checks8fc3306Merge pull request #307 from thaJeztah/bump_wincred6a3e64cmove trimming whitespace to error-check helpers218f178vendor: github.com/danieljoos/wincred v1.2.1Updates
github.com/docker/go-connectionsfrom 0.4.0 to 0.5.0Commits
fa09c95Merge pull request #108 from thaJeztah/carry_67a67a58Swap CloseRead and CloseWrite481d3d2Merge pull request #107 from thaJeztah/drop_legacy_go9548f9ftlsconfig: remove deprecated io/ioutilc564c21drop support for go1.17 and older7cbebcfgha: update actions2cf423ftlsconfig: move allTLSVersions vardca283btlsconfig: drop support for go1.12 and older21876c5tlsconfig: drop support for go1.6 and older4d174dbtlsconfig: drop support for go1.4 and olderUpdates
github.com/google/go-containerregistryfrom 0.17.0 to 0.19.0Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
8dadbe7Work around docker v25 tarballs (#1872)a0658aaAlways print pushed digest in crane push (#1860)55ffb00fix: goreleaser config (#1764)Updates
github.com/google/uuidfrom 1.4.0 to 1.6.0Release notes
Sourced from github.com/google/uuid's releases.
Changelog
Sourced from github.com/google/uuid's changelog.
Commits
0f11ee6chore(master): release 1.6.0 (#151)16939dachore(tests): add strict monotonicity test case for uuid v7. (#154)016b199fix: fix typo in version 7 uuid documentation (#153)1d8b6eaci: set token permissions to github workflows (#143)a2b2b32fix: Monotonicity in UUIDv7 (#150)c58770efeat: add Max UUID constant (#149)4d47f8echore(master): release 1.5.0 (#145)9ee7366feat: Validate UUID without creating new UUID (#141)b35aa6aadd uuid version 6 and 7 (#139)Updates
github.com/klauspost/compressfrom 1.17.4 to 1.17.6Release notes
Sourced from github.com/klauspost/compress's releases.
Commits
255a132s2: Fix DecodeConcurrent deadlock on errors (#925)e8251aabuild: Remove garble compiler (#924)32f34cfbuild(deps): bump the github-actions group with 1 update (#921)aac36dczstd: Fix incorrect repeat coding in best mode (#923)9b0f130Update README.md6662a21s2: Document and test how to peek the stream for skippable blocks (#918)3deb878s2: Fix up AddSkippableBlock more (#919)6ac58c9s2: Fix incorrect length encoded by writer.AddSkippableBlock (#917)515f153s2: Fix callbacks for skippable blocks and disallow 0xfe (Padding) for custom...01b2a79zstd: Limit default window to 8MB (#913)Updates
github.com/pierrec/lz4/v4from 4.1.19 to 4.1.21Commits
294e765Merge pull request #216 from evanphx/b-fix-tests6e17a24Reverts bc1239ba, no longer needed to conform to legacy9542ba5CI: update go versions to more recent onesd9eb671cmd/lz4c: update go.mod and fix issue #214219b252Merge pull request #213 from corneliusroemer/patch-158c6073Update README.md: add@latestto cli install commande974631Merge pull request #211 from oakad/issue_2107613989CompressingReader: support older Go versions4a80a2fCompressingReader: account for possible out buffer statef2ece5bCompressingReader: make sure to clear out bufferUpdates
github.com/rivo/unisegfrom 0.4.4 to 0.4.7Commits
03509a9Fixed wrong width calculation for variation selectors combined with regular c...601bbb3Clarified some performance statements.f302f7fClarifications and improvements in the package documentation.0b9a924Improved performance by using switch statements instead of maps for state tra...e258aa1Switched from transition map to switch statement to improve performance.b74d4dcSome performance improvements by fast-tracking property search on ASCII chara...97691fcMerge pull request #47 from junegunn/eastasian-ambiguous1f39ebcAdd comment272e3f0Allow configuring the width of East Asian ambiguous width characters3628fa1Merge pull request #42 from meowgorithm/unicode-v15.0.0Updates
github.com/sassoftware/go-rpmutilsfrom 0.2.0 to 0.3.0Release notes
Sourced from github.com/sassoftware/go-rpmutils's releases.
Commits
d2036ffchore: update dependencies and remove refs to ioutilbceacf4feat: support RPMs with a payload digest but no SIG_MD5 (#28)277b154Add CONFLICT tagsd2202c0Fix non-continuous link groupsUpdates
github.com/sylabs/sif/v2from 2.15.0 to 2.15.1Release notes
Sourced from github.com/sylabs/sif/v2's releases.
Commits
c428dc6Merge pull request #341 from tri-adam/bump-crypto3af14f4build(deps): bump github.com/ProtonMail/go-crypto from v0.0.0-20230717121422-...4fa5c1dMerge pull request #339 from sylabs/dependabot/go_modules/main/github.com/sec...cb18ad9refactor: adapt to breaking change in dsse package702020fbuild(deps): bump github.com/secure-systems-lab/go-securesystemslibbb85aa2build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 (#338)3685695build(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#337)252b6fbbuild(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#336)85920b1build(deps): bump github.com/google/go-containerregistry (#335)a8b0ecfbuild(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#334)Updates
github.com/wagoodman/go-progressfrom 0.0.0-20230301185719-21920a456ad5 to 0.0.0-20230925121702-07e42b3cdba0Commits
Updates
golang.org/x/cryptofrom 0.17.0 to 0.18.0Commits
dbb6ec1ssh/test: skip tests on darwin that fail on the darwin-amd64-longtest LUCI bu...403f699ssh/test: avoid leaking a net.UnixConn in server.TryDialWithAddr055043dgo.mod: update golang.org/x dependencies08396bbinternal/poly1305: drop Go 1.12 compatibilityUpdates
golang.org/x/modfrom 0.14.0 to 0.15.0Commits
fa1ba42sumdb: replace globsMatchPath with module.MatchPrefixPatternsUpdates
golang.org/x/netfrom 0.19.0 to 0.21.0Commits
73d21fdgo.mod: update golang.org/x dependencies643fd16html: fix SOLIDUS '/' handling in attribute parsing73e4b50dns/dnsmessage: allow name compression for SRV resource parsingb2208d0internal/quic/qlog: fix typo0d0b98chttp2: avoid goroutine starvation in TestServer_Push_RejectAfterGoAway07e05fdhttp2: remove suspicious uint32->v conversion in frame code26b646equic: avoid deadlock in Endpoint.Closecb5b10fgo.mod: update golang.org/x dependencies689bbc7quic: deflake TestStreamsCreateConcurrencyf12db26internal/quic/cmd/interop: use wget --no-verbose in DockerfileUpdates
golang.org/x/syncfrom 0.5.0 to 0.6.0Commits
59c1ca1errgroup: add reference to sync.WaitGroupUpdates
golang.org/x/sysfrom 0.15.0 to 0.17.0Commits
914b96cwindows: support ill-formed UTF-16 in UTF16PtrToString511ec84Revert "windows: support nil done parameter in ReadFile and WriteFile"628365dwindows: support nil done parameter in ReadFile and WriteFileSuperseded by #704.