pyproject.toml

[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"



[tool.poetry]
name = "cyclonedx-bom"
version = "7.2.2"
description = "CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments"
authors = [
  "Jan Kowalleck <jan.kowalleck@gmail.com>",
]
maintainers = [
  "Jan Kowalleck <jan.kowalleck@gmail.com>",
]
license = "Apache-2.0"
readme = "README.md"
homepage = "https://github.com/CycloneDX/cyclonedx-python/#readme"
repository = "https://github.com/CycloneDX/cyclonedx-python/"
documentation = "https://cyclonedx-bom-tool.readthedocs.io/"
packages = [
  { include = "cyclonedx_py" }
]
include = [
  # all is an object -> prevent parse issue with dependabot
  { path = "README.md", format = ["sdist"] },
  { path = "tests", format = ["sdist"] },
  { path = "CHANGELOG.md", format = ["sdist"] },
  { path = "docs", format = ["sdist"] },
]
exclude = [
  "**/.*", # exclude dotfiles and dotfolders
  "docs/_build", "docs/processes",
]
keywords = [
  "OWASP", "CycloneDX",
  "bill-of-materials", "BOM", "software-bill-of-materials", "SBOM",
  "environment", "virtualenv", "venv", "Poetry", "Pipenv", "requirements", "PDM", "Conda",
  "SPDX", "licenses", "PURL", "package-url", "dependency-graph",
]
classifiers = [
  # Trove classifiers - https://packaging.python.org/specifications/core-metadata/#metadata-classifier
  # Full list: https://pypi.python.org/pypi?%3Aaction=list_classifiers
  "Development Status :: 5 - Production/Stable",
  "Environment :: Console",
  "Intended Audience :: Developers",
  "Intended Audience :: Information Technology",
  "Intended Audience :: Legal Industry",
  "Intended Audience :: System Administrators",
  "Topic :: Security",
  "Topic :: Software Development",
  "Topic :: System :: Software Distribution",
  "License :: OSI Approved :: Apache Software License",
  "Programming Language :: Python :: 3.9",
  "Programming Language :: Python :: 3.10",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Programming Language :: Python :: 3.14",
  "Typing :: Typed"
]
[tool.poetry.urls]
"Changelog" = "https://github.com/CycloneDX/cyclonedx-python/releases"
"Bug Tracker" = "https://github.com/CycloneDX/cyclonedx-python/issues"
"Funding" = "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"

[tool.poetry.scripts]
cyclonedx-py = "cyclonedx_py._internal.cli:run"

[tool.poetry.dependencies]
python = "^3.9"
cyclonedx-python-lib = { version = "^8.0 || ^9.0 || ^10 || ^11", extras = ["validation"] }
packageurl-python = ">=0.11, <2"  # keep in sync with same dep in `cyclonedx-python-lib`
pip-requirements-parser = "^32.0"
packaging = "^22 || ^23 || ^24 || ^25 || ^26"
tomli = { version = "^2.0.1", python = "<3.11" }
chardet = "^5.1"

[tool.poetry.group.dev.dependencies]
# pin to exact versions, if the tool/lib/plugin is process-relevant
coverage = "7.10.7"
ddt = "1.7.2"
flake8 = "7.3.0"
flake8-annotations = "3.1.1"
flake8-bugbear = "24.12.12"
flake8-copyright-validator = "^0.0.1"
flake8-isort = "6.1.2"
flake8-quotes = "3.4.0"
flake8-use-fstring = "1.4"
pep8-naming = "0.15.1"
flake8-logging = "1.8.0"
isort = "6.1.0"
autopep8 = "2.3.2"
mypy = "1.19.1"
bandit = "1.8.6"
tomli = { version = "^2.0.1", python = "<3.11" }
tox = "4.30.3"
pyupgrade = [
  { version = "3.21.0", python = "<3.10" },
  { version = "3.21.2", python = ">=3.10" },
]
deptry = "0.23.1"
# for tests, use the GPL-version of jsonschema format validators - they are faster
jsonschema = { version = "*", extras = ["format"] }

# min version required to be able to install some dependencies
# see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
setuptools = ">= 47.0.0"

# some package managers needed for setup/init of testbeds for `environment` purpose.
# we do not relaly care for exact versions, as long as they have a stable CLI and craft usable virtual-environments
pip = ">=23.0"
pipenv = ">=2023.11.5"
poetry = "^1.7"
pdm = "^2.11"
uv = "0.10.7"  # keep pinned to exact version, until a v1.0.0 is released



[tool.semantic_release]
# see https://python-semantic-release.readthedocs.io/en/latest/configuration.html
logging_use_named_masks = true
commit_parser = "conventional"
commit_parser_options = { parse_squash_commits = true, ignore_merge_commits = true }
commit_author = "semantic-release <semantic-release@bot.local>"
commit_message = "chore(release): {version}\n\nAutomatically generated by python-semantic-release\n\nSigned-off-by: semantic-release <semantic-release@bot.local>"
upload_to_vcs_release = true
build_command = """
  pip install poetry
  poetry build
"""
version_toml = ["pyproject.toml:tool.poetry.version"]
version_variables = [
  "cyclonedx_py/__init__.py:__version__",
  "docs/conf.py:release",
]

[tool.semantic_release.publish]
dist_glob_patterns = ["dist/*"]
upload_to_vcs_release = true

[tool.semantic_release.changelog]
default_templates = { changelog_file = "CHANGELOG.md" }
exclude_commit_patterns = [
  '''chore(?:\([^)]*?\))?: .+''',
  '''ci(?:\([^)]*?\))?: .+''',
  '''refactor(?:\([^)]*?\))?: .+''',
  '''style(?:\([^)]*?\))?: .+''',
  '''tests?(?:\([^)]*?\))?: .+''',
  '''build\((?!deps\): .+)''',
]

[tool.semantic_release.branches.main]
match = "(main|master)"
prerelease = false

[tool.semantic_release.branches."step"]
match = "(build|chore|ci|docs|feat|fix|perf|style|refactor|tests?)"
prerelease = true
prerelease_token = "alpha"

[tool.semantic_release.branches."major-dev"]
match = "(\\d+\\.0\\.0-(dev|rc)|dev/\\d+\\.0\\.0)"
prerelease = true
prerelease_token = "rc"


[tool.deptry]
extend_exclude = ["docs", "package_aliases"]