From 9b4250cd47ffee920aec10d62d20ca99cad4f179 Mon Sep 17 00:00:00 2001 From: tdruez Date: Fri, 16 Oct 2026 08:46:57 +0400 Subject: [PATCH] feat: add CycloneDX 1.7 export support and make it the default spec version Signed-off-by: tdruez --- .../component_catalog/component_details.html | 3 ++- .../templates/component_catalog/package_details.html | 3 ++- dje/outputs.py | 2 +- docs/howto-3.rst | 2 +- .../templates/product_portfolio/product_details.html | 9 ++++++--- product_portfolio/tests/test_api.py | 6 +++--- product_portfolio/tests/test_views.py | 12 ++++++------ 7 files changed, 21 insertions(+), 16 deletions(-) diff --git a/component_catalog/templates/component_catalog/component_details.html b/component_catalog/templates/component_catalog/component_details.html index 94640261..08a15fda 100644 --- a/component_catalog/templates/component_catalog/component_details.html +++ b/component_catalog/templates/component_catalog/component_details.html @@ -27,7 +27,8 @@
CycloneDX SBOM - 1.6 + 1.7 + 1.6 1.5 1.4
diff --git a/component_catalog/templates/component_catalog/package_details.html b/component_catalog/templates/component_catalog/package_details.html index dedc3d38..7815928f 100644 --- a/component_catalog/templates/component_catalog/package_details.html +++ b/component_catalog/templates/component_catalog/package_details.html @@ -35,7 +35,8 @@
CycloneDX SBOM - 1.6 + 1.7 + 1.6 1.5 1.4
diff --git a/dje/outputs.py b/dje/outputs.py index 77bf6ec1..152093ec 100644 --- a/dje/outputs.py +++ b/dje/outputs.py @@ -26,7 +26,7 @@ from dejacode_toolkit import openvex from dejacode_toolkit import spdx -CYCLONEDX_DEFAULT_SPEC_VERSION = "1.6" +CYCLONEDX_DEFAULT_SPEC_VERSION = "1.7" def safe_filename(filename): diff --git a/docs/howto-3.rst b/docs/howto-3.rst index 485f0520..f66b0f31 100644 --- a/docs/howto-3.rst +++ b/docs/howto-3.rst @@ -25,4 +25,4 @@ the REST API: Replace ``{uuid}`` with the unique identifier of your product. You can also provide your preferred CycloneDX spec version using the ``spec_version`` -query argument such as: ``/api/v2/products/{uuid}/cyclonedx_sbom/?spec_version=1.6`` +query argument such as: ``/api/v2/products/{uuid}/cyclonedx_sbom/?spec_version=1.7`` diff --git a/product_portfolio/templates/product_portfolio/product_details.html b/product_portfolio/templates/product_portfolio/product_details.html index a4886c2e..8520c958 100644 --- a/product_portfolio/templates/product_portfolio/product_details.html +++ b/product_portfolio/templates/product_portfolio/product_details.html @@ -128,20 +128,23 @@
CycloneDX
SBOM - 1.6 + 1.7 + 1.6 1.5 1.4
{% if request.user.dataspace.enable_vulnerablecodedb_access %}
VEX (only) - 1.6 + 1.7 + 1.6 1.5 1.4
SBOM+VEX (combined) - 1.6 + 1.7 + 1.6 1.5 1.4
diff --git a/product_portfolio/tests/test_api.py b/product_portfolio/tests/test_api.py index 00cee1d0..d4989709 100644 --- a/product_portfolio/tests/test_api.py +++ b/product_portfolio/tests/test_api.py @@ -762,11 +762,11 @@ def test_api_product_endpoint_cyclonedx_sbom_action(self): expected = 'attachment; filename="dejacode_nexb_p1.cdx.json"' self.assertEqual(expected, response["Content-Disposition"]) self.assertEqual("application/json", response["Content-Type"]) - self.assertIn('"specVersion": "1.6"', str(response.getvalue())) + self.assertIn('"specVersion": "1.7"', str(response.getvalue())) # Old spec version - response = self.client.get(url, data={"spec_version": "1.5"}) - self.assertIn('"specVersion": "1.5"', str(response.getvalue())) + response = self.client.get(url, data={"spec_version": "1.6"}) + self.assertIn('"specVersion": "1.6"', str(response.getvalue())) response = self.client.get(url, data={"spec_version": "10.10"}) self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code) diff --git a/product_portfolio/tests/test_views.py b/product_portfolio/tests/test_views.py index 54371451..712c3436 100644 --- a/product_portfolio/tests/test_views.py +++ b/product_portfolio/tests/test_views.py @@ -3354,9 +3354,9 @@ def test_product_portfolio_product_details_view_cyclonedx_links(self): url = self.product1.get_absolute_url() export_cyclonedx_url = self.product1.get_export_cyclonedx_url() - sbom_link = f"{export_cyclonedx_url}?spec_version=1.6" - vex_link = f"{export_cyclonedx_url}?spec_version=1.6&content=vex" - combined_link = f"{export_cyclonedx_url}?spec_version=1.6&content=combined" + sbom_link = f"{export_cyclonedx_url}?spec_version=1.7" + vex_link = f"{export_cyclonedx_url}?spec_version=1.7&content=vex" + combined_link = f"{export_cyclonedx_url}?spec_version=1.7&content=combined" response = self.client.get(url) self.assertContains(response, "SBOM") @@ -3491,11 +3491,11 @@ def test_product_portfolio_product_export_cyclonedx_view(self): # } # self.assertDictEqual(expected, bom_as_dict) - self.assertEqual("http://cyclonedx.org/schema/bom-1.6.schema.json", bom_as_dict["$schema"]) + self.assertEqual("http://cyclonedx.org/schema/bom-1.7.schema.json", bom_as_dict["$schema"]) # Old spec version - response = self.client.get(export_cyclonedx_url, data={"spec_version": "1.5"}) - self.assertIn('"specVersion": "1.5"', str(response.getvalue())) + response = self.client.get(export_cyclonedx_url, data={"spec_version": "1.6"}) + self.assertIn('"specVersion": "1.6"', str(response.getvalue())) response = self.client.get(export_cyclonedx_url, data={"spec_version": "10.10"}) self.assertEqual(404, response.status_code)