Skip to content

fix: XML vulnerability published and updated dates - #1538

Merged
jkowalleck merged 2 commits into
CycloneDX:mainfrom
rajanpanth:fix/xml-vulnerability-published-updated
Nov 11, 2026
Merged

jkowalleck merged 2 commits into
CycloneDX:mainfrom
rajanpanth:fix/xml-vulnerability-published-updated

Conversation

@rajanpanth

Copy link
Copy Markdown
Contributor

Description

The XML normalizer wrote a vulnerability's created date into <published> and <updated> as well, because all three elements were built from data.created. Each element now uses its own field, as the JSON normalizer already does.

Eight snapshot files change (xml_sortedLists_spec1.{4,5,6,7}.json and xml_complex_spec1.{4,5,6,7}.xml.bin). Only published and updated values differ, and the new values are the ones the fixture in tests/_data/models.js sets. With the fix and the old snapshots those 8 tests fail; with the regenerated ones all 4225 tests pass. tsc --noEmit and ESLint are clean.

Resolves or fixes issue: #1537

AI Tool Disclosure

  • My contribution does not include any AI-generated content
  • My contribution includes AI-generated content, as disclosed below:
    • AI Tools: Claude Code
    • LLMs and versions: Claude Fable 5
    • Prompts: Look for cases where the library's XML and JSON output disagree or break the bundled schemas, reproduce each with a script, then fix this one and regenerate the affected snapshots.

Affirmation

The XML normalizer built `published` and `updated` from the
vulnerability's `created` date. Use the matching fields, as the JSON
normalizer does, and regenerate the affected snapshots.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: rajanpanth <rajan.pantha@samriddhicollege.edu.np>
@rajanpanth
rajanpanth requested a review from a team as a code owner November 11, 2026 05:17
@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: rajanpanth <rajan.pantha@samriddhicollege.edu.np>
@read-the-docs-community

Copy link
Copy Markdown

Documentation build overview

📚 CycloneDX JavaScript Library | 🛠️ Build #35804459 | 📁 Comparing 8d2b452 against latest (7456cad)

  🔍 Preview build  

1 file changed
± changelog.html

@jkowalleck jkowalleck added the bug Something isn't working label Nov 11, 2026
@jkowalleck
jkowalleck merged commit af4cfba into CycloneDX:main Nov 11, 2026
39 checks passed
@jkowalleck

Copy link
Copy Markdown
Member

thank you for the report and the fix, @rajanpanth

@jkowalleck

Copy link
Copy Markdown
Member

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

XML output writes a vulnerability's created date as published and updated

2 participants