Skip to content

Conversation

@mr-raj12
Copy link

@mr-raj12 mr-raj12 commented Jan 1, 2026

Summary

  • Use DESCRIBES relationships for SPDX 2.3+ output (per spec, documentDescribes is deprecated)
  • Maintain backward compatibility with documentDescribes for SPDX 2.2
  • Handle both formats when parsing SPDX documents

Fixes #1958

Test plan

  • Added test test_spdx_document_2_3_uses_describes_relationships
  • Added test test_spdx_document_2_2_uses_document_describes
  • Added test test_spdx_document_from_data_with_describes_relationships
  • Added test test_spdx_document_from_data_with_document_describes
  • All existing SPDX tests pass
  • Verified with docker-compose test run

…or SPDX 2.3+

  The documentDescribes field is deprecated in SPDX 2.3 specification.
  This change:
  - Uses DESCRIBES relationships for SPDX 2.3+ output
  - Maintains backward compatibility with documentDescribes for SPDX 2.2
  - Handles both formats when parsing SPDX documents

  Fixes aboutcode-org#1958

Signed-off-by: Mrityunjay Raj <mr.raj.earth@gmail.com>
@mr-raj12 mr-raj12 force-pushed the fix-spdx-describes-relationship branch from 0893d32 to dcd9c57 Compare January 1, 2026 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use of deprecated field to state relationships in SBOM

1 participant