see https://github.com/CycloneDX/cyclonedx-php-library/milestone/4

• BREAKING changes
  • Removed deprecated symbols
  • Changed constructor of CycloneDX\Contrib\License\Factories\LicenseFactory
  • Changed dependencies
• Removed
  • Class CycloneDX\Core\Factories\LicenseFactory
    Use CycloneDX\Contrib\License\Factories\LicenseFactory instead.
  • Class CycloneDX\Core\Utils\BomUtility
    Use CycloneDX\Contrib\Bom\Utils\BomUtils instead.
  • Method CycloneDX\Core\Validation\BaseValidator::getSpec()
• Changed
  • CycloneDX\Contrib\License\Factories\LicenseFactory::__construct() parameters are no longer autopopulated
    Downstream implementations have to populate the parameters on their own, now.
  • CycloneDX\Core\Models\Component::setPackageUrl() accepts ?string
    Downstream implementations may use package-url/packageurl-php for generation.
  • CycloneDX\Core\Models\Component::getPackageUrl() returns ?string
    Downstream implementations may use package-url/packageurl-php for parsing.
  • CycloneDX\Core\Validation\BaseValidator::__construct() parameter is type CycloneDX\Core\Spec\Version
    Was internal type CycloneDX\Core\Spec\_SpecProtocol.
• Dependencies
  • No longer depends on, but suggests composer/spdx-licenses:^1.5
    May be used when utilizing CycloneDX\Contrib\License\Factories\LicenseFactory.
  • No longer depend on package-url/packageurl-php

• contains BC: removed deprecated symbols #587
• contains BC: PackageUrl as string #588
• contains Feat/base validator store version #591