[Defect]: Regression in the latest 2.0 schema WIP where component identifiers details are lost

Open

#1,008 opened on Aug 5, 2026 0 comments 0 reactions 1 assignee View on GitHub

@stevespringett is already working on this.

Since Aug 6, 2026.

Assessment

This issue has not been assessed yet.

Description

defect

Describe the defect

In previous versions each component identifier (and PURL in particular) had a detailed description including links to the spec, providing important information for implementers.

With this commit, the doc is gone

https://github.com/CycloneDX/specification/commit/10b343a3f2271e23fe8ad2d1f64e47866c4cd38f

For example with PURL, before we had title, rich description with URLs and examples:

{
  "purl": {
    "type": "string",
    "title": "Package URL (purl)",
    "description": "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
    "examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"]
  }
}

(at https://github.com/CycloneDX/specification/blame/522d5b7fe4ade53e5e4f540981cd34b0763e8fa7/schema/2.0/model/cyclonedx-component-2.0.schema.json#L165 )

After, we only have this information, essentially a title, and have lost all the other details:

{
  "purl": "Package-URL identifier, conforming to the Package-URL specification.",
}

(at https://github.com/CycloneDX/specification/blame/67d3ec8d604361f28b8789907c9d6c5aa33eb341/schema/2.0/model/cyclonedx-component-2.0.schema.json#L788 )

Dominant language: XSLT
Stars: 551
Forks: 93
Avg merge: 4h 51m
Merged PRs (30d): 42

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.