build(deps): bump org.cyclonedx.bom from 3.3.0 to 3.4.1 - #10
build(deps): bump org.cyclonedx.bom from 3.3.0 to 3.4.1#10dependabot[bot] wants to merge 1 commit into
Conversation
51c2b85 to
6992c2e
Compare
Bumps org.cyclonedx.bom from 3.3.0 to 3.4.1. --- updated-dependencies: - dependency-name: org.cyclonedx.bom dependency-version: 3.4.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
6992c2e to
8b0cc07
Compare
Supersedes #10, which could not pass on its own: 3.4.1 emits each component's hash entries in a different order, and verify-sbom-lock does an exact diff. Checked before taking it. All 115 components are byte-identical once hashes are compared as a set — nothing added, nothing removed, no version moved. The only real changes are the ordering and the generator version recorded in the BOM metadata, so the lock is regenerated rather than the check relaxed. gradlew.bat comes along because the wrapper bump in #7 committed it with CRLF bytes, which contradicts this repository's own .gitattributes rule that stores *.bat as LF and checks it out as CRLF. Staging it normalises the blob; the working tree file is unchanged. Verified on Gradle 9.7.0 from #7: clean build, 121 tests, SBOM lock matches, OSV reports 0 vulnerable components across 104 external dependencies.
|
Applied on main in 7b8a602 rather than merged from here, because the bump could not pass CI on its own: 3.4.1 emits each component's hash entries in a different order, and I checked that the difference is only ordering before taking it. Comparing hashes as a set, all 115 components are identical — nothing added, nothing removed, no version moved. The only other change is the generator version recorded in BOM metadata. So the lock was regenerated instead of the check being loosened. Verified on Gradle 9.7.0 (from #7): clean build, 121 tests, lock matches, OSV reports 0 vulnerable components across 104 external dependencies. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps org.cyclonedx.bom from 3.3.0 to 3.4.1.