feat(cyclonedx): CycloneDX output is pinned to 1.4, three minor versions behind the spec

[sonukapoor]

Problem

src/output/cyclonedx.ts hardcodes specVersion: "1.4". CycloneDX has moved on:

Version	Released
1.5	superseded
1.6	superseded
1.7	2025-10-21 (1.7.1 on 2026-06-02)

So we are three minor versions behind the current specification. For comparison, snyk sbom offers 1.4, 1.5 and 1.6 in both JSON and XML.

This matters more now that SPDX 2.3 output has been added, because the two SBOM formats are presented side by side in the docs and in the README comparison table. Shipping a current SPDX alongside a 2021-era CycloneDX is an odd pairing, and consumers such as Dependency-Track have supported newer versions for some time.

Proposed change

Move the default CycloneDX output to a current version, most likely 1.6 or 1.7, and decide whether older versions stay selectable.

Open questions to settle before implementing:

1. Which version becomes the default. 1.6 is the more widely ingested version today; 1.7 is current. Worth checking what Dependency-Track and GitHub dependency submission accept before choosing.
2. Whether to make the version selectable, for example --sbom cyclonedx1.6. The --sbom flag already resolves aliases through SBOM_FORMAT_ALIASES in src/cli/args.ts, so adding version-qualified names is a small change. spdx2.3 already works this way.
3. Backward compatibility. --cdx and --sbom cyclonedx currently promise 1.4. Silently changing what an existing pinned CI job emits is a behaviour change; bumping the default is probably right, but it belongs in release notes rather than passing unnoticed.
4. What the newer schema versions actually require. Each version added fields and tightened others; the emitted document must validate against whichever schema it declares.

Notes

• Output-format internals, in-house.
• Related: feat(action): add sbom input so SPDX output is reachable from the GitHub Action #1078 (action sbom input), fix(parser): five-path cap leaves gaps in the SBOM dependency graph #1079 (dependency graph completeness).

Decision, so this is not open-ended

Target CycloneDX 1.6 as the new default, not 1.7. 1.6 is what Dependency-Track and the wider tooling ecosystem ingest reliably today, and it is the newest version Snyk emits. 1.7 can follow once consumer support is broader.

--cdx and --sbom cyclonedx keep working unchanged; only the emitted specVersion moves. That is a visible behaviour change for anyone diffing SBOMs in CI, so it needs a line in the changelog rather than shipping silently.

Version-qualified aliases such as --sbom cyclonedx1.4 are explicitly out of scope here. If someone needs to pin an older version we can add that later; SBOM_FORMAT_ALIASES in src/cli/args.ts already has the shape for it (spdx2.3 works that way today).

Where to look

• src/output/cyclonedx.ts builds the document; specVersion is hardcoded there.
• The emitted document must validate against the 1.6 schema: https://raw.githubusercontent.com/CycloneDX/specification/master/schema/bom-1.6.schema.json
• tests/cyclonedx.test.ts has the existing coverage to extend.
• Please do not add a dependency for schema validation. Assert the required fields directly, the way the existing tests do.

[AbdaullahAG]

Hey @sonukapoor, I'd like to work on this one. I've looked into the CycloneDX 1.6 schema and confirmed the current output shape is compatible without any structural changes needed — just the version bump and updated test coverage. --cdx/--sbom cyclonedx behavior stays the same as decided, just emitting a newer spec version. Ready to open a PR shortly.

[sonukapoor]

Sure. Go for it.

[AbdaullahAG]

PR is up: #1093. All CycloneDX tests pass (including new coverage for the 1.6 schema's required fields), build is clean, and --cdx/--sbom cyclonedx behavior is unchanged as discussed — only the emitted specVersion moves to 1.6. Ready for review whenever you get a chance.