v1.5 introduced a new format for the metadata.tools field: https://cyclonedx.org/docs/1.5/json/#metadata_tools
It seems that @cyclonedx/cyclonedx-library currently only supports the legacy format:
|
tools?: Metadata['tools'] |
|
export interface OptionalToolProperties { |
|
vendor?: Tool['vendor'] |
|
name?: Tool['name'] |
|
version?: Tool['version'] |
|
hashes?: Tool['hashes'] |
|
externalReferences?: Tool['externalReferences'] |
|
} |
|
|
|
export class Tool implements Comparable<Tool> { |
|
vendor?: string |
|
name?: string |
|
version?: string |
|
hashes: HashDictionary |
|
externalReferences: ExternalReferenceRepository |
|
|
|
constructor (op: OptionalToolProperties = {}) { |
|
this.vendor = op.vendor |
|
this.name = op.name |
|
this.version = op.version |
|
this.hashes = op.hashes ?? new HashDictionary() |
|
this.externalReferences = op.externalReferences ?? new ExternalReferenceRepository() |
|
} |
|
|
|
compare (other: Tool): number { |
|
// The purpose of this method is not to test for equality, but have deterministic comparability. |
|
/* eslint-disable @typescript-eslint/strict-boolean-expressions -- run compares in weighted order */ |
|
return (this.vendor ?? '').localeCompare(other.vendor ?? '') || |
|
(this.name ?? '').localeCompare(other.name ?? '') || |
|
(this.version ?? '').localeCompare(other.version ?? '') |
|
/* eslint-enable @typescript-eslint/strict-boolean-expressions */ |
|
} |
|
} |
|
|
|
export class ToolRepository extends SortableComparables<Tool> { |
|
} |
This prevents other tools like @cyclonedx/cyclonedx-npm from creating v1.5 or v1.6 SBOMs with the new tools format.