feat: basic support cdx17 (#579)

reworked internal design to automatically support any defined
SpecVersion

---------

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

HISTORY.md

@@ -6,6 +6,14 @@ All notable changes to this project will be documented in this file.
 
 <!-- add unreleased items here -->
 
+Added _basic_ support for [_CycloneDX_ Specification-1.7](https://github.com/CycloneDX/specification/releases/tag/1.7).
+
+* Changed
+  * This tool may support _CycloneDX_ Specification-1.7 now (via [#579])  
+    This feature depends on `cyclonedx/cyclonedx-library:^3.8`.
+
+[#579]: https://github.com/CycloneDX/cyclonedx-php-composer/pull/579
+
 ## 5.2.3 - 2025-05-12
 
 Maintenance release.

README.md

@@ -74,7 +74,7 @@ Options:
                                                       {choices: "dev", "plugin"}
                                                       (multiple values allowed)
       --spec-version=SPEC-VERSION                     Which version of CycloneDX spec to use.
-                                                      {choices: "1.1", "1.2", "1.3", "1.4", "1.5", "1.6"}
+                                                      {choices: "1.1", "1.2", "1.3", "1.4", "1.5", "1.6", "1.7"}
                                                       [default: "1.5"]
       --output-reproducible|--no-output-reproducible  Whether to go the extra mile and make the output reproducible.
                                                       This might result in loss of time- and random-based-values.

composer.json

@@ -55,6 +55,7 @@
     },
     "config": {
         "allow-plugins": {
+            "cyclonedx/cyclonedx-php-composer": true,
             "ergebnis/composer-normalize": true,
             "icanhazstring/composer-unused": true
         },

demo/devReq/README.md

@@ -14,10 +14,14 @@ The following are examples generated by _cyclonedx-php-composer_:
 * [`results/bom.1.3.xml`](results/bom.1.3.xml)
 * [`results/bom.1.4.xml`](results/bom.1.4.xml)
 * [`results/bom.1.5.xml`](results/bom.1.5.xml)
+* [`results/bom.1.6.xml`](results/bom.1.6.xml)
+* [`results/bom.1.7.xml`](results/bom.1.7.xml)
 * [`results/bom.1.2.json`](results/bom.1.2.json)
 * [`results/bom.1.3.json`](results/bom.1.3.json)
 * [`results/bom.1.4.json`](results/bom.1.4.json)
 * [`results/bom.1.5.json`](results/bom.1.5.json)
+* [`results/bom.1.6.json`](results/bom.1.6.json)
+* [`results/bom.1.7.json`](results/bom.1.7.json)
 
 ## Setup
 

demo/devReq/project/composer.json

@@ -39,6 +39,7 @@
             "@putenv CDX_CP_TOOLS_VERSION_OVERRIDE=in-dev",
             "@putenv CDX_CP_TOOLS_EXCLUDE_LIBS=1",
             "@putenv CDX_CP_TOOLS_EXCLUDE_COMPOSER=1",
+            "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.7 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.7.json $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.6 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.6.json $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.5 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.5.json $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.4 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.4.json $PWD/composer.json",
@@ -49,6 +50,7 @@
             "@putenv CDX_CP_TOOLS_VERSION_OVERRIDE=in-dev",
             "@putenv CDX_CP_TOOLS_EXCLUDE_LIBS=1",
             "@putenv CDX_CP_TOOLS_EXCLUDE_COMPOSER=1",
+            "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.7 --output-reproducible --output-format=XML  --output-file=$PWD/../results/bom.1.7.xml $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.6 --output-reproducible --output-format=XML  --output-file=$PWD/../results/bom.1.6.xml $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.5 --output-reproducible --output-format=XML  --output-file=$PWD/../results/bom.1.5.xml $PWD/composer.json",
             "@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.4 --output-reproducible --output-format=XML  --output-file=$PWD/../results/bom.1.4.xml $PWD/composer.json",