Skip to content

[pull] master from CycloneDX:master #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 7 commits into from
Feb 8, 2026
Merged

[pull] master from CycloneDX:master #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a77af53
Update ratings descriptions in schema files for clarity on VEX usage
fahedouch Nov 14, 2025
adf8f16
Update vulnerability ratings description in XML and Protobuf schemas,…
fahedouch Dec 26, 2025
713a20c
fix(spec): improve ratings descriptions in schema files for clarity o…
fahedouch Jan 17, 2026
60d1ae6
Update ratings descriptions in schema files for clarity on VEX usage
fahedouch Nov 14, 2025
82770ac
Update vulnerability ratings description in XML and Protobuf schemas,…
fahedouch Dec 26, 2025
80db025
fix(schema): clarify ratings description for prioritization decisions
fahedouch Feb 7, 2026
251b1cd
Update ratings descriptions in schema files for clarity on VEX usage …
stevespringett Feb 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion schema/bom-1.6.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -888,7 +888,7 @@ message Vulnerability {
optional Source source = 3;
// Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Oftentimes, the same vulnerability may exist in multiple sources of vulnerability intelligence but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
repeated VulnerabilityReference references = 4;
// List of vulnerability ratings
// List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.
repeated VulnerabilityRating ratings = 5;
// List of Common Weaknesses Enumerations (CWEs) codes that describe this vulnerability. For example, 399 (of https://cwe.mitre.org/data/definitions/399.html)
repeated int32 cwes = 6;
Expand Down
2 changes: 1 addition & 1 deletion schema/bom-1.6.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2681,7 +2681,7 @@
"ratings": {
"type": "array",
"title": "Ratings",
"description": "List of vulnerability ratings",
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
"items": {
"$ref": "#/definitions/rating"
}
Expand Down
2 changes: 1 addition & 1 deletion schema/bom-1.6.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4218,7 +4218,7 @@ limitations under the License.
</xs:element>
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
Expand Down
2 changes: 1 addition & 1 deletion schema/bom-1.7.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -990,7 +990,7 @@ message Vulnerability {
optional Source source = 3;
// Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Oftentimes, the same vulnerability may exist in multiple sources of vulnerability intelligence but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
repeated VulnerabilityReference references = 4;
// List of vulnerability ratings
// List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.
repeated VulnerabilityRating ratings = 5;
// List of Common Weaknesses Enumerations (CWEs) codes that describe this vulnerability. For example, 399 (of https://cwe.mitre.org/data/definitions/399.html)
repeated int32 cwes = 6;
Expand Down
2 changes: 1 addition & 1 deletion schema/bom-1.7.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2841,7 +2841,7 @@
"ratings": {
"type": "array",
"title": "Ratings",
"description": "List of vulnerability ratings",
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
"items": {
"$ref": "#/definitions/rating"
}
Expand Down
2 changes: 1 addition & 1 deletion schema/bom-1.7.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4461,7 +4461,7 @@ limitations under the License.
</xs:element>
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
Expand Down