[WIP] CycloneDX v2.0 Specification - #652

Draft

stevespringett wants to merge 268 commits into

This pull request is big! We're only showing the most recent 250 commits

Commits on Nov 12, 2025

Added further optimization to minified version
stevespringett
committed
0427839
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
8668856

Commits on Nov 23, 2025

Modified risk and model schemas
petra-dv
committed
7a04e95

Commits on Nov 24, 2025

Commits on Nov 25, 2025

Updated JSON Schema for Humans
stevespringett
committed
dd45ceb

Commits on Nov 29, 2025

Initial commit of CycloneDX linter
stevespringett
committed
b8abb0c
Moved bundler
stevespringett
committed
f0c447b
Added lock file
stevespringett
committed
41ad354

Commits on Nov 30, 2025

Commits on Dec 1, 2025

Ported multiple models minus deprecations and standardized id and comment patterns.
stevespringett
committed
38547b6
Ported model card
stevespringett
committed
9be3484
Updating indent check. Added two new checks.
stevespringett
committed
4e77988
Updating readme
stevespringett
committed
08e4936
Updating readme
stevespringett
committed
666b40d
Ported dependency and composition objects
stevespringett
committed
7f3c089
Updated title
stevespringett
committed
4456b54
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
ce23470
Ported vulnerability model
stevespringett
committed
0f9f07f
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
17daf80
Ported annotation model
stevespringett
committed
976a9d2
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
80cf0cc
Ported formulation model
stevespringett
committed
8237c95
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
98a2ce7
Ported declaration model
stevespringett
committed
c1c1e03
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
9575876
Ported definition and standard model. Updated patent model.
stevespringett
committed
37e04be
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
f2e7bb2
Ported citation model.
stevespringett
committed
cbba940
Added remaining root objects.
stevespringett
committed
9a09935
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
43945b5
Removed properties from license. Removed unused model files.
stevespringett
committed
93f57a5
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
1caff3e
Removed extensible properties to root object.
stevespringett
committed
5012f06
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
66cd80e
Ported service model.
stevespringett
committed
c23f59b
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
691bc49

Commits on Dec 2, 2025

Fixed extensibleProperties defect preventing validation
stevespringett
committed
2d9b07a
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
7ddf4b8
Fixed properties defect.
stevespringett
committed
da1b173
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
dde65f3
Synced external references with 1.7 version
stevespringett
committed
57beb2e
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
2114c27
Fixed property issue with component
stevespringett
committed
5f14c2a
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
9f13aae
Fixed composition model
stevespringett
committed
3a80369
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
0d619e3
Synced hash with v1.7 version
stevespringett
committed
75c344d
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
8db8674

Commits on Dec 3, 2025

Fixed copyright issue to align with how v1.7 does it.
stevespringett
committed
1c8bab8
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
9c8c622

Commits on Dec 4, 2025

Ported 1.7 unit tests to 2.0.
stevespringett
committed
6a39e36

Commits on Dec 5, 2025

Commits on Dec 7, 2025

adressed comments and reviewed further the schema
petra-dv
committed
e8f7aba
fixed naming inconsistency
petra-dv
committed
53cfdd1

Commits on Dec 10, 2025

Merge branch '2.0-dev-threatmodeling' into 2.0-dev-threat-modeling-petras-suggestions
stevespringett
authored
d999fac
Modified risk and model schemas (#732)
stevespringett
authored
d1ebee2
Fixed JSON issue
stevespringett
committed
c6e1657

Commits on Dec 15, 2025

Initial checkin of behavior model. Should satisfy goals outlined in #670. Blueprints working group will continue to iterate and validate.
stevespringett
committed
941fa1f

Commits on Dec 19, 2025

Commits on Jan 7, 2026

feat(cryptography): implement CBOM v2.0 enhancements from #738
bhess
committed
b7585b0

Commits on Jan 8, 2026

Extend cryptography-related behaviors
bhess
committed
96117b4

Commits on Jan 14, 2026

Added unit test
stevespringett
committed
54a7138
Updated unit test
stevespringett
committed
f16489b
must -> shall
stevespringett
committed
2a6e499
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
8ca8115
Improved description of secProperties
bhess
committed
daa4052
A few extensions to the crypto behaviors
bhess
committed
70de945

Commits on Jan 22, 2026

Commits on Feb 7, 2026

Ported rating clarification to 2.0 branch. #722
stevespringett
committed
24fd64a
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
5127956

Commits on Feb 14, 2026

Harden enum meta:enum handling
Mehrn0ush
committed
5162baf

Commits on Feb 19, 2026

Harden enum-value-formatting meta:enum handling (#821)
stevespringett
authored
5b0d747

Commits on Feb 24, 2026

Merge branch 'master' into 2.0-dev
jkowalleck
authored
979b738
Adds gmac/cmac to modes, and unwrap to cryptoFunctions
bhess
committed
5dd5f64

Commits on Feb 26, 2026

Add paramgen, paramver, and keyver cryptographic functions
jvdsn
committed
ebeeb0f
Add X9.31 padding for RSA
jvdsn
committed
8fd1f0e
Add more symmetric modes
jvdsn
committed
abcc155
Add CAVP validation level
jvdsn
committed
edefa4b
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
ff45d63
Add more cryptographic functions, paddings, modes, and validation levels to schema (#841)
stevespringett
authored
ae266d4

Commits on Mar 1, 2026

Migrated enveloped signature support from JSF to JSS. Expanded on the number of valid and invalid use cases.
stevespringett
committed
8147988

Commits on Mar 4, 2026

Commits on Mar 5, 2026

Commits on Mar 27, 2026

Commits on Mar 31, 2026

Commits on Apr 2, 2026

Adds custom fingerprints
bhess
committed
ebcf4c2

Commits on May 4, 2026

Commits on May 7, 2026

Added mockups
stevespringett
committed
54d16af

Commits on May 12, 2026

Added support for conditional components and associated unit tests.
stevespringett
committed
47319f5

Commits on May 14, 2026

Initial commit of the party model and test cases.
stevespringett
committed
41baec2

Commits on May 21, 2026

Add title/description to hash in common schema
bhess
committed
d54f9a0

Commits on May 22, 2026

Added new component identity model with updated test cases.
stevespringett
committed
10b343a

Commits on May 27, 2026

Major updates to threatmodeling and bluepring schemas and their related schemas. Supersedes and closes #777.
stevespringett
committed
21ca15a

Commits on Jun 1, 2026

Commits on Jun 3, 2026

feat(cryptography): add cryptographic agility plane to CBOM
bhess
committed
92a0604

Commits on Jun 4, 2026

CBOM: add custom fingerprints (#903)
stevespringett
authored
dd06849
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
96d485a

Commits on Jun 5, 2026

Move agility to component level, unify rotation and renewal object
bhess
committed
92c9827
WIP 2.0 threat-modeling schema set
stevespringett
committed
8a14716

Commits on Jun 6, 2026

Commits on Jun 7, 2026

Commits on Jun 8, 2026

Commits on Jun 11, 2026

Added control as first-class citizen and expanded use of controls to related areas in the spec.
stevespringett
committed
6ec41a6

Commits on Jun 12, 2026

Address review comments
bhess
committed
48a218c
feat: add origin region for hardware provenance
taleodor
committed
4bd160d

Commits on Jun 16, 2026

Added test cases, comment to schema, and corrected space issue with behavior schema.
stevespringett
committed
72407e7

Commits on Jun 18, 2026

Changed risk type to align with the kind of risk assessment performed - and updated it to be an array. Added cadence (previously was risk assessment type) to be a noun representing temporal data. U…
stevespringett
committed
10d7dd2

Commits on Jun 22, 2026

Removed name from being required. Updated test cases to address comments from Jan
stevespringett
committed
af32aca

Commits on Jun 28, 2026

Commits on Jul 12, 2026

Commits on Jul 20, 2026

unified evidence model addressing #278, #333 and other concerns.
stevespringett
committed
22b0d13

Commits on Jul 22, 2026

Commits on Jul 29, 2026

chore: mark generated
jkowalleck
committed
62dee9e
chore: mark generated
jkowalleck
committed
2a86067

Commits on Aug 3, 2026

[2.0] Tests: split schema 1.x 2.x (#999)
jkowalleck
authored
e1c91b7

Commits on Aug 4, 2026

2.0 tests init (#1000)
jkowalleck
authored
0c4b8c0
2.0 dev mergemaster 20260704 (#1002)

authored
de910cb
Merge remote-tracking branch 'origin/master' into 2.0-dev_mergemaster-20260704-2
jkowalleck
committed
ffae620
2.0 dev mergemaster 20260704 2 (#1003)
jkowalleck
authored
f9a5002

Commits on Aug 5, 2026

chore: group tests by version
jkowalleck
committed
854a91f
tests: meta:enum tests
jkowalleck
committed
1bd21ad
tests: meta:enum tests (#1004)
jkowalleck
authored
bb2800a
tests: fix errorneous file output
jkowalleck
committed
372efe6
chore: tools private and gitignore
jkowalleck
committed
8159643
have schema paths
jkowalleck
committed
8a32e0c
feat: rewire excluded $ref
jkowalleck
committed
94566fa
tidy
jkowalleck
committed
eb17a0b
tidy
jkowalleck
committed
915eaca
schema fixes
jkowalleck
committed
7bdca03
tidy
jkowalleck
committed
0aa32c3
2.0 dev bundler externals rewrite (#1006)
jkowalleck
authored
3c2d065
tests: validate bundled schema only on mainline
jkowalleck
committed
ec7a40d
tests: validate bundled schema only on mainline (#1007)
jkowalleck
authored
67d3ec8
chore: fix js test runner chain
jkowalleck
committed
0bb19a1
chore: fix schema-bundler workflow
jkowalleck
committed
886366a
chore: fix schema-bundler workflow
jkowalleck
committed
93e1d82

Commits on Aug 7, 2026

Merge branch 'master' into 2.0-dev
jkowalleck
authored
83c633a
chore: editorconfir for cdx-2.0 bundled
jkowalleck
committed
480a1c0
chore: editorconfir for cdx-2.0 bundled
jkowalleck
committed
724dfda

Commits on Aug 9, 2026

Update schema/2.0/model/cyclonedx-risk-2.0.schema.json

stevespringett
and
jkowalleck
authored
d9718d6
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
4109d01
Update schema/2.0/model/cyclonedx-control-2.0.schema.json

stevespringett
and
jkowalleck
authored
3ac3bea
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
217916f
Update schema/behavior-taxonomy.schema.json

stevespringett
and
jkowalleck
authored
eeb8a3f
Update schema/2.0/model/cyclonedx-common-2.0.schema.json

stevespringett
and
jkowalleck
authored
40c5873
Update schema/2.0/model/cyclonedx-profile-2.0.schema.json

stevespringett
and
jkowalleck
authored
75bb5bd
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
3e3282d
Update schema/2.0/model/cyclonedx-weakness-2.0.schema.json

stevespringett
and
jkowalleck
authored
b0e8640
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
713d4fb
Update schema/2.0/model/cyclonedx-common-2.0.schema.json

stevespringett
and
jkowalleck
authored
3dcab8a
chore: update bundled schemas [skip ci]
github-actions[bot]
committed
906c579

Commits on Aug 10, 2026

chore: split docs CDX1.x
jkowalleck
committed
68da661
chore: split docs CDX1.x
jkowalleck
committed
c5fc0d5
chore: split docs CDX1.x
jkowalleck
committed
998df95
chore: split docs CDX1.x
jkowalleck
committed
1beae2b
2.0 dev split docsgen (#1017)
jkowalleck
authored
6de25ce

Commits on Aug 14, 2026

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-vuln-evidence
jkowalleck
committed
84b08a4
revert docsgen scehma-v1 json mods
jkowalleck
committed
d52129e

Commits on Aug 15, 2026

Commits on Aug 18, 2026

chore: dependabot config (#1032)
jkowalleck
authored
721c601
Removed constraint on enum.
stevespringett
committed
1da95b5

Commits on Aug 20, 2026