This library claims to implement the CycloneDX standard. And it doe.

but it also has some implementation parts that are not standard - they should be moved to the "contrib" area, or removed entirely.

Goal

• move helpers/factories/builders to the "contrib" area
  • moved: feat: prepare "contrib" area #569
  • remove deprevcated (old) functionality: BC: removed deprecated symbols #587
• remove the usage of external models
  • Compoennt.purl is no longer an instance of PackageUrl but a simple str or instance of string-castable
    • cast to string on normalization
    • downstream users can still use a PackageURL object, if needed ....
    • remove packageurl dependency
    • BC: PackageUrl as string #588
  • validation of external standards -like SPDX expressios and such...
  • tbc...

Motivation:

• have a clean standard implementation, no opinionated fluff, only models and (de)serailization.