v11.7.0-rc.4

v11.7.0-rc.4 (2026-04-10)

---

Detailed Changes: v11.7.0-rc.3...v11.7.0-rc.4

v11.7.0-rc.3

v11.7.0-rc.3 (2026-04-10)

---

Detailed Changes: v11.7.0-rc.2...v11.7.0-rc.3

v11.7.0-rc.2

v11.7.0-rc.2 (2026-04-10)

---

Detailed Changes: v11.7.0-rc.1...v11.7.0-rc.2

v11.7.0-rc.1

v11.7.0-rc.1 (2026-04-10)

---

Detailed Changes: v11.7.0...v11.7.0-rc.1

v11.7.0

v11.7.0 (2026-03-17)

Documentation

• Add comprehensive SBOM validation guide (#933, bf596c0)

• Docstrings for schema version classes (#946, 6460b71)

• Modernize RTF setup (#921, af0059d)

Features

• Add properties for licenses according to CycloneDX 1.5 (#947, 375d209)

• Make schema deprecation warnings handle-able (#945, 71edacf)

---

What's Changed

• docs: modernize RTF setup by @jkowalleck in #921
• chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #924
• chore(deps): bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #925
• chore(deps-dev): update mypy requirement from 1.19.0 to 1.19.1 by @dependabot[bot] in #929
• chore(deps): Update pyupgrade version to 3.21.2 by @jkowalleck in #930
• chore(ci): modernize GH ci by @jkowalleck in #932
• docs: Add comprehensive SBOM validation guide by @saquibsaifee in #933
• Fix signing command in contribution guide by @stefan6419846 in #943
• docs: docstrings for schema version classes by @jkowalleck in #946
• feat: make schema deprecation warnings handle-able by @jkowalleck in #945
• feat: add properties for licenses according to CycloneDX 1.5 by @peschuster in #947
• chore: force tox environment to utf8 by @peschuster in #949

New Contributors

• @stefan6419846 made their first contribution in #943
• @peschuster made their first contribution in #947

Full Changelog: v11.6.0...v11.7.0

v11.6.0

v11.6.0 (2025-12-02)

Features

• Moved non‑standard implementations to Contrib area (#916, 15a9023)
  • Added
    • New sub-package contrib.
  • Changed
    • Moved non‑standard implementations to Contrib area.
  • Deprecated
    • Certain exports have been deprecated; downstream imports should be updated to the new locations.
      Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.
    • Some (trivial) non-standard functionality was deprecated:
      • model.bom.Bom.get_component_by_purl()
      • model.bom.Bom.get_urn_uuid()
      • model.bom.Bom.has_component()
      • model.bom.Bom.get_vulnerabilities_for_bom_ref()
      • model.bom.Bom.has_vulnerabilities()
      • model.bom.Bom.urn()
  • Refactored
    • The following symbols were moved.
      The symbols are still import-able through their old location.
      • OLD -> NEW
      • builder.this.this_component() -> contrib.this.builders.this_component()
      • builder.this.this_tool() -> contrib.this.builders.this_tool()
      • exception.factory.* -> contrib.license.exceptions.*
      • factory.license.LicenseFactory -> contrib.license.factories.LicenseFactory
      • model.HashType.from_hashlib_alg() -> contrib.hash.factories.HashTypeFactory.from_hashlib_alg()
      • model.HashType.from_composite_str() -> contrib.hash.factories.HashTypeFactory.from_composite_str()
      • model.component.Component.for_file() -> contrib.component.builders.ComponentBuilder.make_for_file()
      • model.vulnerability.VulnerabilitySeverity.get_from_cvss_scores() -> contrib.vulnerability.cvss.vs_from_cvss_scores()

---

What's Changed

• chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #915
• chore(deps-dev): update mypy requirement from 1.18.2 to 1.19.0 by @dependabot[bot] in #918
• docs: update 1.7 by @jkowalleck in #920
• feat: Moved non‑standard implementations to Contrib area by @jkowalleck in #916

Full Changelog: v11.5.0...v11.6.0

v11.5.0

v11.5.0 (2025-10-31)

Features

• Add support for DistributionConstraints in BOM metadata (#906, 70adb7c)

• Add support for properties in external references (#907, 73e7c1a)

---

What's Changed

• chore(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #904
• chore(deps): bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #905
• feat: add support for DistributionConstraints in BOM metadata by @Churro in #906
• feat: add support for properties in external references by @Churro in #907

Full Changelog: v11.4.0...v11.5.0

v11.4.0

v11.4.0 (2025-10-23)

Features

• Add support for CycloneDX 1.7 (basics) (#902, f35b9ee)

---

What's Changed

• feat: add support for CycloneDX 1.7 (basics) by @jkowalleck in #902

Full Changelog: v11.3.0...v11.4.0

v11.3.0

v11.3.0 (2025-10-22)

Bug Fixes

• Implement __lt__ for models still missing it (#899, bebda4f)

Features

• Deserialize single ComponentEvidence.identity (#900, 9425c67)

---

What's Changed

• ci: use py314 per default by @jkowalleck in #898
• feat: deserialize single ComponentEvidence.identity by @qkaiser in #900
• fix: implement __lt__ for models still missing it by @qkaiser in #899

New Contributors

• @qkaiser made their first contribution in #900

Full Changelog: v11.2.0...v11.3.0

v11.2.0

v11.2.0 (2025-10-15)

Documentation

• Add Changelog to project urls (d8a24b7)

Features

• Support Python 3.14 (#897, 267672b)

---

What's Changed

• chore(deps-dev): update mypy requirement from 1.17.1 to 1.18.1 by @dependabot[bot] in #889
• chore(deps-dev): update mypy requirement from 1.18.1 to 1.18.2 by @dependabot[bot] in #890
• chore(deps-dev): update coverage requirement from 7.10.6 to 7.10.7 by @dependabot[bot] in #891
• feat: support Python 3.14 by @jkowalleck in #897
• chore(deps-dev): update isort requirement from 6.0.1 to 6.1.0 by @dependabot[bot] in #894
• chore(deps-dev): update tox requirement from 4.30.2 to 4.30.3 by @dependabot[bot] in #893
• chore(deps-dev): update pyupgrade requirement from 3.20.0 to 3.21.0 by @dependabot[bot] in #896
• chore(deps-dev): update tomli requirement from 2.2.1 to 2.3.0 by @dependabot[bot] in #895

Full Changelog: v11.1.0...v11.2.0