Bump cyclonedx-core-java to 13.0.0, add CycloneDX 1.7 support, test all schema versions

[patbaumgartner]

Fixes #564

What

Bump cyclonedx-core-java 9.0.5 -> 13.0.0

This picks up the fix for the Unknown keyword meta:enum / Unknown keyword deprecated warnings emitted during JSON BOM validation (CycloneDX/cyclonedx-core-java#280, fixed and released in core-java 13.0.0). The makeBom IT now asserts that no Unknown keyword warning appears in the build log while JSON validation still runs and passes.

CycloneDX 1.7 support

core-java 13.0.0 supports schema 1.7, so schemaVersion=1.7 is now accepted. Following the existing convention that the default tracks the latest supported schema, the default (and the fallback for invalid values, as asserted by VerboseTest via CycloneDxSchema.VERSION_LATEST) is now 1.7. Note for reviewers: this is a behavior change - if you prefer to keep 1.6 as the default and only support 1.7 opt-in, I'm happy to adjust.

Systematic test coverage for all schema versions

Existing tests only exercised schema versions 1.2/1.3/1.4/1.6 incidentally through issue reproducers. The new SchemaVersionsTest generates and validates a BOM for every supported version: 1.0 and 1.1 (XML only, JSON was introduced with 1.2) and 1.2-1.7 (XML + JSON), asserting the requested version is accepted as-is, ends up in the output (xmlns / specVersion), and no Unknown keyword warning is logged.

Bugfix: invalid license/url element in 1.0 BOMs

The new test immediately uncovered that schemaVersion=1.0 produced a BOM that fails the plugin's own XSD validation: a <url> element inside <license>, which only exists since schema 1.1. This looks pre-existing and independent of the dependency bump. Fixed in DefaultModelConverter by not emitting the license url for 1.0, consistent with the existing VERSION_10 guards.

Verification

• mvn clean verify green: 26 unit tests + 2 invoker ITs
• both IT build logs contain Writing and validating BOM (JSON) with zero Unknown keyword warnings

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 17 complexity · 0 duplication

Metric	Results
Complexity	17
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[patbaumgartner]

The CI failure on Java 8 (java.security.NoSuchAlgorithmException: SHA3-256 MessageDigest not available) is fixed in 9d45891.

Root cause: cyclonedx-core-java 9.x silently skipped hash algorithms that are unavailable on the current JVM, but since the rewrite of BomUtils.calculateHashes(file, schemaVersion) it fails hard when a requested MessageDigest is missing. SHA3 digests only ship with the JDK since Java 9, so the plugin's Java 8 builds broke.

Fix: DefaultModelConverter now calls the BomUtils.calculateHashes(file, schemaVersion, algorithms) overload introduced in core-java 9.2.0, passing only algorithms that are supported by both:

• the current JVM — probed once via MessageDigest.getInstance(algorithm.getSpec()) over Hash.Algorithm.values(), and
• the target schema version — derived from the same @VersionFilter annotations that BomUtils uses internally.

No algorithm names are hardcoded, so future algorithms added to Hash.Algorithm are picked up automatically, and BLAKE/STREEBOG hashes would be included if a third-party security provider (e.g. BouncyCastle) is registered.

Behavior: on Java 9+ the BOM output is unchanged; on Java 8 the SHA3 hashes are omitted — the same behavior as the currently released plugin versions.

Verified locally: full test suite passes on JDK 8 (Corretto 8.0.472, reproduces the CI failure without the fix) and JDK 21.