feat(sbom): write CycloneDX 1.7 by default

.github/workflows/sbom-interoperability.yml

@@ -65,7 +65,7 @@ jobs:
           fi
           {
             printf '# SBOM compatibility check: %s %s\n\n' "${icon}" "${result}"
-            printf 'Bomly generated SPDX 2.3 and CycloneDX 1.6 files, then asked the official validators to check them.\n\n'
+            printf 'Bomly generated SPDX 2.3 and CycloneDX 1.7 files, then asked the official validators to check them.\n\n'
             printf -- '- **Revision:** `%s`\n' "${GITHUB_SHA}"
             printf -- '- **Validation:** `%s`\n' "${VALIDATION_RESULT}"
             printf -- '- **Evidence:** %s\n\n' "${evidence}"

README.md

@@ -139,7 +139,7 @@ See [Getting Started](docs/GETTING_STARTED.md) for the first-run walkthrough and
 
 ## Generate Output for CI
 
-Bomly can write human-readable text, JSON, SARIF, SPDX 2.3, and CycloneDX 1.6:
+Bomly can write human-readable text, JSON, SARIF, SPDX 2.3, and CycloneDX 1.7:
 
 ```bash
 # Structured JSON for automation
@@ -220,7 +220,7 @@ See [Plugins](docs/PLUGINS.md) for install, trust, and authoring guidance.
 - [Use Cases](docs/USE_CASES.md) - practical recipes for PR gates, SBOMs, triage, and offline scans
 - [Scan Targets](docs/SCAN_TARGETS.md) - directories, Git repos, containers, and SBOMs
 - [Output Formats](docs/OUTPUT_FORMATS.md) - text, JSON, SARIF, SPDX, CycloneDX
-- [SBOM Formats](docs/SBOM.md) - SPDX 2.3 and CycloneDX 1.6, ingest, and conversion recipes
+- [SBOM Formats](docs/SBOM.md) - SPDX 2.3 and CycloneDX 1.7, ingest, and conversion recipes
 - [CI Integration](docs/CI_INTEGRATION.md) - GitHub Actions, GitLab, Jenkins, Azure, CircleCI
 - [Bomly Guard](docs/BOMLY_GUARD.md) - turnkey GitHub Action for PR dependency review
 - [MCP Server](docs/MCP.md) - connect Bomly to Claude Code, Cursor, VS Code, or another MCP client

docs/GETTING_STARTED.md

@@ -99,7 +99,7 @@ This calls the enabled built-in matchers, including OSV, KEV, deps.dev, and Open
 
 ## Generate an SBOM
 
-Use `-o` to write SPDX 2.3 or CycloneDX 1.6:
+Use `-o` to write SPDX 2.3 or CycloneDX 1.7:
 
 ```bash
 bomly scan \

docs/GLOSSARY.md

@@ -56,7 +56,7 @@ separate network behavior.
 
 ## SBOM
 
-**SBOM** — Software Bill of Materials. Bomly writes SPDX 2.3 and CycloneDX 1.6 JSON via `-o`, and ingests both via `--sbom`. See [SBOM formats](SBOM.md).
+**SBOM** — Software Bill of Materials. Bomly writes SPDX 2.3 and CycloneDX 1.7 JSON via `-o`, and ingests SPDX 2.3 and CycloneDX 1.4–1.7 via `--sbom`. See [SBOM formats](SBOM.md).
 
 **PURL** — Package URL identifier (`pkg:type/namespace/name@version`). Bomly emits PURLs on every package.
 

docs/OUTPUT_FORMATS.md

@@ -13,7 +13,7 @@ Use `--json` as a shortcut for `--format json` when you want structured output q
 | `markdown` | Reviews | Job summaries, PR comments, and other Markdown surfaces |
 | `sarif` | Audit-only | CI security panes, GitHub Security tab, IDE problem markers |
 | `spdx` | Scan only | SPDX 2.3 JSON SBOMs |
-| `cyclonedx` | Scan only | CycloneDX 1.6 JSON SBOMs |
+| `cyclonedx` | Scan only | CycloneDX 1.7 JSON SBOMs |
 
 Flag:
 
@@ -216,7 +216,7 @@ Supported targets:
 | `markdown` | GitHub-flavored Markdown report |
 | `sarif` | SARIF 2.1.0 report; requires `--audit` |
 | `spdx` | SPDX 2.3 JSON |
-| `cyclonedx` | CycloneDX 1.6 JSON |
+| `cyclonedx` | CycloneDX 1.7 JSON |
 
 `spdx` and `cyclonedx` are supported by `scan`. Report formats (`text`, `json`, `markdown`, `sarif`) are supported by report-producing commands. See [SBOM formats](SBOM.md) for the SBOM comparison and writing rules.
 

docs/SBOM.md

@@ -1,6 +1,6 @@
 # SBOM Formats
 
-Bomly reads and writes the two open SBOM standards used in production today: SPDX 2.3 and CycloneDX 1.6.
+Bomly reads and writes the two open SBOM standards used in production today. It writes SPDX 2.3 and CycloneDX 1.7, and ingests SPDX 2.3 plus CycloneDX 1.4 through 1.7.
 
 ## What's an SBOM?
 
@@ -10,7 +10,7 @@ You produce an SBOM once and consume it many times: in PR checks, in release art
 
 ## Format comparison
 
-| | SPDX 2.3 | CycloneDX 1.6 |
+| | SPDX 2.3 | CycloneDX 1.7 |
 | --- | --- | --- |
 | Steward | Linux Foundation | OWASP |
 | Primary use case | Software supply chain and license compliance | Component analysis and vulnerability management |

docs/SCAN_TARGETS.md

@@ -186,7 +186,7 @@ bomly scan --sbom --path ./vendor.spdx.json
 bomly scan --sbom --path ./build/sbom.cdx.json
 ```
 
-SPDX 2.3 JSON and CycloneDX 1.6 JSON are auto-detected. Useful when:
+SPDX 2.3 JSON and CycloneDX 1.4–1.7 JSON are auto-detected. Useful when:
 
 - You produced an SBOM in a previous CI step and want to audit it.
 - A vendor sent you an SBOM and you want to evaluate it against your policy.

docs/detectors/sbom/sbom.md

@@ -19,7 +19,7 @@ Bomly uses this chain when it finds `sbom` evidence.
 
 ## How `sbom` resolves
 
-`sbom-detector` is a **direct ingest** — it accepts SPDX 2.3 JSON or CycloneDX 1.6 JSON as input and treats the SBOM as the source of truth for the graph. No subprocess runs, no other detector chains fire.
+`sbom-detector` is a **direct ingest** — it accepts SPDX 2.3 JSON or CycloneDX 1.4–1.7 JSON as input and treats the SBOM as the source of truth for the graph. No subprocess runs, no other detector chains fire.
 
 | Step | Strategy | Command |
 | --- | --- | --- |
@@ -78,5 +78,5 @@ bomly diff --sbom --base ./v1.0.cdx.json --head ./v1.1.cdx.json
 - **Relationship fidelity depends on the source SBOM.** If the SBOM was produced by a tool that emits a flat package list (no `DEPENDS_ON` / `dependencies` edges), Bomly's graph is also flat. `bomly explain` cannot show paths that aren't recorded.
 - **Vendor-specific extensions** (custom properties, non-standard package types) are passed through to the JSON output but are not used for policy decisions.
 - **SBOM ingest is exclusive** — combining `--sbom` with `--image` or `--url` is rejected with exit 4.
-- **Format versions other than SPDX 2.3 JSON and CycloneDX 1.6 JSON** are rejected. SPDX 3.0 and CycloneDX 1.5 ingest are tracked for follow-up.
+- **Format versions other than SPDX 2.3 JSON and CycloneDX 1.4–1.7 JSON** are rejected. SPDX 3.0 ingest is tracked for follow-up.
 - **Tag-Value SPDX** and **XML CycloneDX** are not currently ingested.

docs/evidence/TARGETS_AND_OPERATIONS.md

@@ -47,7 +47,7 @@ started interoperability workflow adds an external check:
 gh workflow run sbom-interoperability.yml --ref v0.20.0
 ```
 
-It generates canonical SPDX 2.3 and CycloneDX 1.6 files, verifies the
+It generates canonical SPDX 2.3 and CycloneDX 1.7 files, verifies the
 downloaded validator checksums, runs the named official validators, and saves
 the generated files plus a `bomly.sbom-assurance-run/v1` report. See
 [`test/assurance/SBOM_INTEROPERABILITY.md`](../../test/assurance/SBOM_INTEROPERABILITY.md)

docs/faq.json

@@ -165,7 +165,7 @@
               "id": "can-bomly-read-or-generate-sboms",
               "question": "Can Bomly read or generate SBOMs?",
               "toc": "Reading & generating SBOMs",
-              "answer": "Both. `bomly scan --sbom --path ./sbom.cdx.json` reads an existing SPDX or CycloneDX SBOM and turns it into a dependency graph you can diff, explain, and audit. Bomly also writes SBOMs in SPDX 2.3 and CycloneDX 1.6, either to stdout or to files while still printing the normal report.",
+              "answer": "Both. `bomly scan --sbom --path ./sbom.cdx.json` reads an existing SPDX or CycloneDX SBOM and turns it into a dependency graph you can diff, explain, and audit. Bomly also writes SBOMs in SPDX 2.3 and CycloneDX 1.7, either to stdout or to files, and ingests CycloneDX 1.4 through 1.7.",
               "links": [
                 {
                   "label": "SBOM guide",
@@ -294,7 +294,7 @@
               "id": "output-formats",
               "question": "What output formats does Bomly produce?",
               "toc": "Output formats",
-              "answer": "The default output is a human-readable text report. With `--format` you can switch to `json`, `markdown`, SARIF 2.1.0 (requires `--audit`), SPDX 2.3, or CycloneDX 1.6, and `-o format=path` writes several formats in one run while still printing the normal report.",
+              "answer": "The default output is a human-readable text report. With `--format` you can switch to `json`, `markdown`, SARIF 2.1.0 (requires `--audit`), SPDX 2.3, or CycloneDX 1.7, and `-o format=path` writes several formats in one run while still printing the normal report.",
               "links": [
                 {
                   "label": "Output formats",

docs/manifest.json

@@ -66,7 +66,7 @@
     {
       "slug": "sbom",
       "title": "SBOM formats",
-      "description": "SPDX 2.3 vs. CycloneDX 1.6, when to pick which, ingest and conversion recipes.",
+      "description": "SPDX 2.3 vs. CycloneDX 1.7, when to pick which, ingest and conversion recipes.",
       "group": "start"
     },
     {

internal/benchmark/run.go

@@ -476,7 +476,7 @@ func bomlySBOMTarget(format string) (sbom.Target, error) {
 	case "spdx":
 		return sbom.TargetSPDX23JSON, nil
 	case "cyclonedx":
-		return sbom.TargetCycloneDX16JSON, nil
+		return sbom.TargetCycloneDX17JSON, nil
 	default:
 		return "", fmt.Errorf("unsupported Bomly benchmark SBOM format %q", format)
 	}

internal/cli/render/sbom.go

@@ -41,7 +41,7 @@ func SBOMTarget(format output.Format) (sbom.Target, bool) {
 	case output.FormatSPDX:
 		return sbom.TargetSPDX23JSON, true
 	case output.FormatCycloneDX:
-		return sbom.TargetCycloneDX16JSON, true
+		return sbom.TargetCycloneDX17JSON, true
 	default:
 		return "", false
 	}

internal/cli/render/sbom_test.go

@@ -24,8 +24,8 @@ func TestParseOutputFormatAcceptsSharedFormatsAndAliases(t *testing.T) {
 		{value: "sarif", wantFormat: output.FormatSARIF, wantLabel: "sarif"},
 		{value: "spdx", wantFormat: output.FormatSPDX, wantTarget: sbom.TargetSPDX23JSON, wantLabel: "spdx"},
 		{value: "spdx-json", wantFormat: output.FormatSPDX, wantTarget: sbom.TargetSPDX23JSON, wantLabel: "spdx"},
-		{value: "cyclonedx", wantFormat: output.FormatCycloneDX, wantTarget: sbom.TargetCycloneDX16JSON, wantLabel: "cyclonedx"},
-		{value: "cyclonedx-json", wantFormat: output.FormatCycloneDX, wantTarget: sbom.TargetCycloneDX16JSON, wantLabel: "cyclonedx"},
+		{value: "cyclonedx", wantFormat: output.FormatCycloneDX, wantTarget: sbom.TargetCycloneDX17JSON, wantLabel: "cyclonedx"},
+		{value: "cyclonedx-json", wantFormat: output.FormatCycloneDX, wantTarget: sbom.TargetCycloneDX17JSON, wantLabel: "cyclonedx"},
 	}
 
 	for _, tc := range tests {
@@ -74,7 +74,7 @@ func TestParseOutputSpecsParsesReportAndSBOMTargets(t *testing.T) {
 	if specs[4].Target != sbom.TargetSPDX23JSON || !specs[4].IsSBOM() {
 		t.Fatalf("unexpected spdx spec: %#v", specs[4])
 	}
-	if specs[5].Target != sbom.TargetCycloneDX16JSON || !specs[5].IsSBOM() {
+	if specs[5].Target != sbom.TargetCycloneDX17JSON || !specs[5].IsSBOM() {
 		t.Fatalf("unexpected cyclonedx spec: %#v", specs[5])
 	}
 }

internal/output/output.go

@@ -21,7 +21,7 @@ const (
 	FormatSARIF Format = "sarif"
 	// FormatSPDX renders an SPDX 2.3 JSON SBOM.
 	FormatSPDX Format = "spdx"
-	// FormatCycloneDX renders a CycloneDX 1.6 JSON SBOM.
+	// FormatCycloneDX renders a CycloneDX 1.7 JSON SBOM.
 	FormatCycloneDX Format = "cyclonedx"
 )
 

internal/support/prose/detectors/sbom.md

@@ -1,6 +1,6 @@
 ## How `sbom` resolves
 
-`sbom-detector` is a **direct ingest** — it accepts SPDX 2.3 JSON or CycloneDX 1.6 JSON as input and treats the SBOM as the source of truth for the graph. No subprocess runs, no other detector chains fire.
+`sbom-detector` is a **direct ingest** — it accepts SPDX 2.3 JSON or CycloneDX 1.4–1.7 JSON as input and treats the SBOM as the source of truth for the graph. No subprocess runs, no other detector chains fire.
 
 | Step | Strategy | Command |
 | --- | --- | --- |
@@ -59,5 +59,5 @@ bomly diff --sbom --base ./v1.0.cdx.json --head ./v1.1.cdx.json
 - **Relationship fidelity depends on the source SBOM.** If the SBOM was produced by a tool that emits a flat package list (no `DEPENDS_ON` / `dependencies` edges), Bomly's graph is also flat. `bomly explain` cannot show paths that aren't recorded.
 - **Vendor-specific extensions** (custom properties, non-standard package types) are passed through to the JSON output but are not used for policy decisions.
 - **SBOM ingest is exclusive** — combining `--sbom` with `--image` or `--url` is rejected with exit 4.
-- **Format versions other than SPDX 2.3 JSON and CycloneDX 1.6 JSON** are rejected. SPDX 3.0 and CycloneDX 1.5 ingest are tracked for follow-up.
+- **Format versions other than SPDX 2.3 JSON and CycloneDX 1.4–1.7 JSON** are rejected. SPDX 3.0 ingest is tracked for follow-up.
 - **Tag-Value SPDX** and **XML CycloneDX** are not currently ingested.

internal/tools/sbomassurance/main.go

@@ -140,7 +140,7 @@ func run(bomlyPath, outputDir, inputPath string) error {
 		path string
 	}{
 		{name: "spdx-2.3-json", path: filepath.Join(outputDir, "bomly.spdx.json")},
-		{name: "cyclonedx-1.6-json", path: filepath.Join(outputDir, "bomly.cdx.json")},
+		{name: "cyclonedx-1.7-json", path: filepath.Join(outputDir, "bomly.cdx.json")},
 	}
 	for _, format := range formats {
 		cliFormat := "spdx"
@@ -164,7 +164,7 @@ func run(bomlyPath, outputDir, inputPath string) error {
 
 	commands := [][]string{
 		{"java", "-jar", spdxJar, "Verify", formats[0].path},
-		{cdxBinary, "validate", "--input-file", formats[1].path, "--input-format", "json", "--input-version", "v1_6", "--fail-on-errors"},
+		{cdxBinary, "validate", "--input-file", formats[1].path, "--input-format", "json", "--input-version", "v1_7", "--fail-on-errors"},
 	}
 	for _, command := range commands {
 		result, _ := execute(ctx, command[0], command[1:]...)

test/evidence/cases.json

@@ -856,7 +856,7 @@
         {
           "kind": "workflow",
           "location": ".github/workflows/sbom-interoperability.yml",
-          "sha256": "5434c3b2971034416cacbde5788320d47f3c1e976bdfdc60ff1f077b2e16ef09"
+          "sha256": "3d379300ab8e7bc02f6859c088ba06153fcbd2dc3cf159a62d890d1abda24f1a"
         }
       ],
       "required_tools": [
@@ -875,7 +875,7 @@
       "evidence": [
         {
           "path": ".github/workflows/sbom-interoperability.yml",
-          "sha256": "5434c3b2971034416cacbde5788320d47f3c1e976bdfdc60ff1f077b2e16ef09"
+          "sha256": "3d379300ab8e7bc02f6859c088ba06153fcbd2dc3cf159a62d890d1abda24f1a"
         }
       ],
       "proves": [