Merge pull request #829 from Shnatsel/release-0.5.8

Shnatsel · web-flow · commit 0e56b4635245 · 2026-03-12T17:04:18.000Z
Release 0.5.8
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/cargo-cyclonedx/CHANGELOG.md b/cargo-cyclonedx/CHANGELOG.md
@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.5.8 - 2026-03-12
+
+### Fixed
+
+ - Do not include a license file if SPDX license identifiers are present, fixing a spec compliance issue which doesn't allow both at once ([#826])
+ - Do not include subcomponents in `metadata.component` when describing individual build artifacts (as opposed to an entire crate), fixing interoperability with some CycloneDX deserializing libraries ([#828])
+
 ## 0.5.7 - 2024-11-30
 
 ### Added
diff --git a/cargo-cyclonedx/Cargo.toml b/cargo-cyclonedx/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cargo-cyclonedx"
-version = "0.5.7"
+version = "0.5.8"
 categories = ["command-line-utilities", "development-tools", "development-tools::cargo-plugins"]
 description = "CycloneDX Software Bill of Materials (SBOM) for Rust Crates"
 keywords = ["sbom", "bom", "components", "dependencies", "owasp"]
