From dfd4597864cdc2b2bbaeea313dc29d91d40d481f Mon Sep 17 00:00:00 2001 From: "yusuke.koyoshi" Date: Fri, 18 Sep 2026 17:58:04 +0900 Subject: [PATCH] fix(proto): remove stale CPE deprecation comment (1.4-1.7) The deprecation of `component.cpe` was withdrawn in #105 / 7b2c23a (2021-12-20), but that commit only touched `bom-1.4-SNAPSHOT.schema.json` and `bom-1.4-SNAPSHOT.xsd`. The ProtoBuf schemas were missed, so 1.4 through 1.7 still document `cpe` as "DEPRECATED - DO NOT USE", while the JSON Schema and XSD of the same versions do not. Align the ProtoBuf comment with the wording of the respective XSD. `bom-1.3.proto` is left untouched, since CPE is genuinely deprecated in 1.3. Comment-only change; the wire format is unaffected. Signed-off-by: yusuke.koyoshi --- schema/bom-1.4.proto | 2 +- schema/bom-1.5.proto | 2 +- schema/bom-1.6.proto | 2 +- schema/bom-1.7.proto | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/schema/bom-1.4.proto b/schema/bom-1.4.proto index 2bf7d1d49..d69a18da8 100644 --- a/schema/bom-1.4.proto +++ b/schema/bom-1.4.proto @@ -95,7 +95,7 @@ message Component { repeated LicenseChoice licenses = 13; // An optional copyright notice informing users of the underlying claims to copyright ownership in a published work. optional string copyright = 14; - // DEPRECATED - DO NOT USE. This will be removed in a future version. Specifies a well-formed CPE name. See https://nvd.nist.gov/products/cpe + // Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe optional string cpe = 15; // Specifies the package-url (PURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec optional string purl = 16; diff --git a/schema/bom-1.5.proto b/schema/bom-1.5.proto index a6ecd79d1..abb9be389 100644 --- a/schema/bom-1.5.proto +++ b/schema/bom-1.5.proto @@ -110,7 +110,7 @@ message Component { repeated LicenseChoice licenses = 13; // An optional copyright notice informing users of the underlying claims to copyright ownership in a published work. optional string copyright = 14; - // DEPRECATED - DO NOT USE. This will be removed in a future version. Specifies a well-formed CPE name. See https://nvd.nist.gov/products/cpe + // Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe optional string cpe = 15; // Specifies the package-url (PURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec optional string purl = 16; diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index 737a133af..164b18acf 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -118,7 +118,7 @@ message Component { repeated LicenseChoice licenses = 13; // An optional copyright notice informing users of the underlying claims to copyright ownership in a published work. optional string copyright = 14; - // DEPRECATED - DO NOT USE. This will be removed in a future version. Specifies a well-formed CPE name. See https://nvd.nist.gov/products/cpe + // Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe optional string cpe = 15; // Specifies the package-url (PURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec optional string purl = 16; diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto index 5a1dc6c84..9ee3f34f3 100644 --- a/schema/bom-1.7.proto +++ b/schema/bom-1.7.proto @@ -130,7 +130,7 @@ message Component { repeated LicenseChoice licenses = 13; // An copyright notice informing users of the underlying claims to copyright ownership in a published work. optional string copyright = 14; - // DEPRECATED - DO NOT USE. This will be removed in a future version. Specifies a well-formed CPE name. See https://nvd.nist.gov/products/cpe + // Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe optional string cpe = 15; // Specifies the package-url (PURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec optional string purl = 16;