Skip to content

fix(proto): remove stale CPE deprecation comment (1.4-1.7) - #1116

Open
yusuke-koyoshi wants to merge 1 commit into
CycloneDX:masterfrom
yusuke-koyoshi:fix/proto-cpe-deprecation
Open

yusuke-koyoshi wants to merge 1 commit into
CycloneDX:masterfrom
yusuke-koyoshi:fix/proto-cpe-deprecation

Conversation

@yusuke-koyoshi

Copy link
Copy Markdown

Follow-up to #105.

The deprecation of component.cpe was withdrawn in #105 (commit 7b2c23a, 2021-12-20), but that commit only touched schema/bom-1.4-SNAPSHOT.schema.json and schema/bom-1.4-SNAPSHOT.xsd. The ProtoBuf schemas were missed, so every version from 1.4 to 1.7 still documents cpe as DEPRECATED - DO NOT USE, while the JSON Schema and XSD of the same version do not:

version .proto .schema.json / .xsd
1.4 DEPRECATED - DO NOT USE. This will be removed in a future version. … not deprecated
1.5 DEPRECATED - DO NOT USE. … not deprecated
1.6 DEPRECATED - DO NOT USE. … not deprecated
1.7 DEPRECATED - DO NOT USE. … not deprecated

This PR aligns the ProtoBuf comment with the wording used in the respective XSD:

-  // DEPRECATED - DO NOT USE. This will be removed in a future version. Specifies a well-formed CPE name. See https://nvd.nist.gov/products/cpe
+  // Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe

Deliberately not changed:

  • schema/bom-1.3.proto — CPE is genuinely deprecated in 1.3, and the JSON Schema and XSD of 1.3 say so as well.
  • Component.modified — still deprecated in all three formats.

This is a comment-only change; the wire format is unaffected — there was never a [deprecated = true] option on the field, only the comment. #786 is a precedent for correcting comments in already-released ProtoBuf schemas.

tools/src/test/proto/test.sh was run locally: schema-lint, schema-breaking-version and schema-breaking-remote all pass.

The deprecation of `component.cpe` was withdrawn in CycloneDX#105 / 7b2c23a (2021-12-20),
but that commit only touched `bom-1.4-SNAPSHOT.schema.json` and
`bom-1.4-SNAPSHOT.xsd`. The ProtoBuf schemas were missed, so 1.4 through 1.7
still document `cpe` as "DEPRECATED - DO NOT USE", while the JSON Schema and
XSD of the same versions do not.

Align the ProtoBuf comment with the wording of the respective XSD.
`bom-1.3.proto` is left untouched, since CPE is genuinely deprecated in 1.3.

Comment-only change; the wire format is unaffected.

Signed-off-by: yusuke.koyoshi <yusuke.koyoshi@assured.inc>
@yusuke-koyoshi
yusuke-koyoshi requested a review from a team as a code owner September 18, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant