I don't love the idea of ignoring the type hints here, even if it incidentally works -- that strongly suggests undocumented API behavior that could change at any time.

Is there a reason we can't use c.bom_ref.value instead? From the API docs, that seems to produce a str that should correspond to the right value to pass into a BomTarget.

The thing is, the approach depends on whether bom_ref is manually set vs auto-generated.
When components have auto-generated bom_refs (which is the case in pip-audit), c.bom_ref.value returns None
The .value approach works when bom_ref is manually set as a string ( like in CycloneDX/cyclonedx-python-lib#547 )

Since pip-audit uses auto-generated bom_refs (no manual bom_ref= assignment), we need to pass the BomRef object itself rather than its .value property. The type mismatch is a quirk of the cyclonedx-python-lib API - the type hint says str, but the implementation handles BomRef objects for auto-generated refs.

The # type: ignore is unfortunate but necessary to work around the library's type annotation not matching its runtime behavior.

I also noticed that the Vulnerability class itself accepts bom_ref: str | BomRef (as shown in the docs), suggesting the library has a pattern of accepting both types even when type hints indicate otherwise. This supports using the BomRef object directly for auto-generated refs.
( https://cyclonedx-python-library.readthedocs.io/en/latest/autoapi/cyclonedx/model/vulnerability/index.html )

Ah, that's kind of not ideal -- do you think we could get those type hints fixed upstream? My experience with this CycloneDX dependency is that there have been significant breaking changes over time, so I'm hesitant to merge something that works unless it's actually encoded in the types.

As a stop-gap, I'd be okay with merging this if we also add a "backstop" test, i.e. add a test for the CycloneDX APIs themselves to ensure they don't deviate between releases. That way at least the tests will fail on dependency updates, which will give us advance warning if they change things 🙂

hmm good idea will write the test