feat: add cyclonedx.model.dependency.Dependency.provides - #1036
Open
saquibsaifee wants to merge 1 commit into
Open
saquibsaifee wants to merge 1 commit into
saquibsaifee wants to merge 1 commit into
Conversation
Documentation build overview
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
saquibsaifee
force-pushed
the
feat-uzair-provides-7524676707032308925
branch
from
September 1, 2026 18:06
e606ca5 to
beac7ca
Compare
saquibsaifee
changed the title
Fixes CycloneDX#691 - Add `Dependency.provides` property with schema view limited to v1.6+ - Add `Dependency.provides_as_bom_refs()` helper - Fix `BomDependencyGraphFlatMerger._flatten_merge()` to preserve `provides` during JSON serialization pipeline (was silently dropped before) - Add unit tests for `Dependency.provides` in `test_model_dependency` - Add unit test for flat-merger preserving `provides` in `test_bom_utils` - Add snapshot fixture `get_bom_with_provides` across all schema versions; v1.6 and v1.7 JSON snapshots include `provides` array Signed-off-by: saquibsaifee <saquibsaifee2@gmail.com> Co-authored-by: Uzair Chhapra <uzairchhapra@gmail.com>
saquibsaifee
force-pushed
the
feat-uzair-provides-7524676707032308925
branch
from
September 1, 2026 18:12
beac7ca to
9988631
Compare
Contributor
Author
|
@jkowalleck does this look promising? |
saquibsaifee
force-pushed
the
feat-uzair-provides-7524676707032308925
branch
from
September 1, 2026 19:01
9386458 to
9988631
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The registration path mishandles generator inputs, mutates hash-bearing set elements, and weakens regression coverage.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds CycloneDX 1.6+ support for dependency provides relationships across modeling, serialization, validation, and graph flattening.
Changes:
- Adds
Dependency.providesand BOM registration/validation support. - Preserves
providesduring dependency graph flattening. - Adds model tests and versioned serialization snapshots.
File summaries
| File | Description |
|---|---|
cyclonedx/model/dependency.py |
Models and serializes provides. |
cyclonedx/model/bom.py |
Registers and validates provided references. |
cyclonedx/contrib/bom/utils.py |
Preserves provides while flattening. |
tests/test_model_dependency.py |
Tests the new model field. |
tests/test_contrib/test_bom_utils.py |
Tests graph flattening. |
tests/_data/models.py |
Adds a BOM fixture with provides. |
tests/_data/snapshots/get_bom_with_provides-1.7.xml.bin |
XML 1.7 snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.7.json.bin |
JSON 1.7 snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.6.xml.bin |
XML 1.6 snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.6.json.bin |
JSON 1.6 snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.5.xml.bin |
XML 1.5 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.5.json.bin |
JSON 1.5 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.4.xml.bin |
XML 1.4 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.4.json.bin |
JSON 1.4 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.3.xml.bin |
XML 1.3 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.3.json.bin |
JSON 1.3 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.2.xml.bin |
XML 1.2 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.2.json.bin |
JSON 1.2 omission snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.1.xml.bin |
XML 1.1 snapshot. |
tests/_data/snapshots/get_bom_with_provides-1.0.xml.bin |
XML 1.0 snapshot. |
Review details
- Files reviewed: 20/20 changed files
- Comments generated: 4
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if depends_on: | ||
| _d.dependencies.update(map(lambda _d: Dependency(ref=_d.bom_ref), depends_on)) | ||
| if provides: | ||
| _d.provides.update(map(lambda _p: Dependency(ref=_p.bom_ref), provides)) |
Contributor
Author
There was a problem hiding this comment.
It's a pre-existing pattern: the existing _d.dependencies.update(...) line has the same hash-mutation-while-in-SortedSet issue. This PR follows the established pattern for the new provides field.
Comment on lines
+785
to
787
| provides: Optional[Iterable[Dependable]] = None, | ||
| ) -> None: | ||
| _d = next(filter(lambda _d: _d.ref == target.bom_ref, self.dependencies), None) |
Comment on lines
1741
to
1743
| get_bom_with_licenses, | ||
| get_bom_with_provides, | ||
| get_bom_with_multiple_licenses, |
Comment on lines
+67
to
+73
| ref_a = BomRef(value='0b049d09-64c0-4490-a0f5-c84d9aacf857') | ||
| ref_b = BomRef(value='be2c6502-7e9a-47db-9a66-e34f729810a3') | ||
| dep_a = Dependency(ref=ref_a, provides=[Dependency(ref=ref_b)]) | ||
| dep_b = Dependency(ref=ref_b) | ||
| sorted_result = sorted([dep_b, dep_a]) | ||
| self.assertEqual(sorted_result[0].ref, ref_a) | ||
| self.assertEqual(sorted_result[1].ref, ref_b) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add support for
cyclonedx.model.dependency.Dependency.provides)field in Dependency, originally implemented in PR #735 by Uzair.Fixes #691
AI Tool Disclosure
Gemini JulesGemini 3.1 ProAffirmation
Co-authored-by: Uzair Chhapra uzairchhapra@gmail.com
Signed-off-by: saquibsaifee saquibsaifee2@gmail.com