chore(deps): bump cyclonedx-python-lib from 11.11.1 to 11.12.0

[dependabot]

Bumps cyclonedx-python-lib from 11.11.1 to 11.12.0.

Release notes

Sourced from cyclonedx-python-lib's releases.

v11.12.0 (2026-08-13)

Features

• Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

---

What's Changed

• tests: add Python 3.14 to tox tests by @​jkowalleck in CycloneDX/cyclonedx-python-lib#1029
• feat: add isExternal property to Component for CycloneDX v1.7 by @​tonal in CycloneDX/cyclonedx-python-lib#959

New Contributors

• @​tonal made their first contribution in CycloneDX/cyclonedx-python-lib#959

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.2...v11.12.0

v11.11.2 (2026-08-12)

Bug Fixes

• Encode paths when loading XML schemas (#1028, 17a0136)

---

What's Changed

• fix: encode paths when loading XML schemas by @​CAOShurong in CycloneDX/cyclonedx-python-lib#1028

New Contributors

• @​CAOShurong made their first contribution in CycloneDX/cyclonedx-python-lib#1028

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.1...v11.11.2

Changelog

Sourced from cyclonedx-python-lib's changelog.

v11.12.0 (2026-08-13)

Features

• Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

v11.11.2 (2026-08-12)

Bug Fixes

• Encode paths when loading XML schemas (#1028, 17a0136)

Commits

• 52cb3c9 chore(release): 11.12.0
• 6993dea feat: add isExternal property to Component for CycloneDX v1.7 (#959)
• 27b2d43 tests: add Python 3.14 to tox tests (#1029)
• a092c49 chore(release): 11.11.2
• 17a0136 fix: encode paths when loading XML schemas (#1028)
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: deps, poetry. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[lab700xdev]

Verified locally with current main merged in.

Exposure: this is the highest blast radius of the current dependency PRs — cyclonedx-python-lib is a production dependency and the serializer behind the CLI's default output. A silent change here would alter a public artifact format that downstream consumers parse.

Upstream review. This bump crosses two releases:

• 11.11.2 — bug fix only: encode paths when loading XML schemas (#1028). Not a code path this CLI uses; we emit JSON, and schema loading only happens in the test-only validation extra.
• 11.12.0 — adds an isExternal property to Component for CycloneDX v1.7 (#959), plus Python 3.14 in upstream tox.

The isExternal addition is the one that needed checking rather than assuming: this CLI emits specVersion 1.7, so a new 1.7 field that serialized by default would land in every SBOM we produce.

It does not. The property is optional and stays unset, so the serializer omits it. Confirmed directly on the generated SBOM:

specVersion=1.7  components=7
isExternal occurrences: 0

specVersion is unchanged at 1.7, which also means there is no spec-version coupling to handle on the receiving side — nothing downstream needs to widen or deploy ahead of this.

Constraint: no pyproject.toml change needed. The existing >=11.4,<12.0 already resolves 11.12.0, and the documented 11.4 floor (first release exporting JsonV1Dot7 / SchemaVersion.V1_7) is unaffected.

Lock isolation: poetry check --lock → exit 0. Diff vs main is cyclonedx-python-lib 11.11.1→11.12.0 alone — no content-hash, no lock-version, no other packages.

Tests: poetry run pytest → 1094 passed, coverage 92.80% (gate 85%). Relevant here: the suite validates generated SBOMs against the bundled schema via the validation extra, so a malformed 1.7 document would fail rather than pass quietly.

CLI regression harness: full surface snapshot diffed against the pre-bump baseline — empty diff. That comparison includes the byte content of the emitted CycloneDX JSON and SPDX JSON-LD documents (with only inherently volatile fields normalized: timestamps, urn:uuid serial numbers, random bom-refs, and the SPDX documentNamespace clock), so any change to the serialized output would have shown up.

No user-visible change. Merging.