Generated SBOMs use deprecated features

[stefan6419846]

SBOM files generated by this package (as part of the maturin Python build backend) currently use deprecated features of the CycloneDX 1.5 specification:

lib/python3.11/site-packages/cyclonedx/model/tool.py:243: DeprecationWarning: @.tools is deprecated from CycloneDX v1.5 onwards. Please use @.components and @.services instead.

Reference: https://cyclonedx.org/docs/1.5/json/#metadata_tools_oneOf_i1

Example: Python wheels for nh3 0.3.3: https://pypi.org/project/nh3/0.3.3/

[Shnatsel]

How can I view the CycloneDX files? The download list only lists .whl files, not .cdx or .json or anything like that.

[stefan6419846]

Download one of the wheel files (like https://files.pythonhosted.org/packages/6f/84/c0dc75c7fb596135f999e59a410d9f45bdabb989f1cb911f0016d22b747b/nh3-0.3.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl) and unpack it (these are simple ZIP files). Then you can find the BOM at nh3-0.3.3.dist-info/sboms/nh3.cyclonedx.json.

For completeness, I have attached the corresponding file: nh3.cyclonedx.json