feat!: implement ModelValidator and remove Bom.validate() by saquibsaifee · Pull Request #935 · CycloneDX/cyclonedx-python-lib

saquibsaifee · 2026-02-15T04:42:37Z

Description

Implements #455 as a breaking change.

Bom.validate() is removed and replaced by ModelValidator in cyclonedx.validation.model, which provides the "more advanced" validation API — typed errors with severity levels, side-effect free, and fully testable.

Changes

`cyclonedx/validation/model.py`

New ModelValidationErrorSeverity enum (ERROR / WARNING) for typed severity
ModelValidationError gains a severity field (default ERROR)
ModelValidator.validate(bom) returns Iterable[ModelValidationError] — fully side-effect free
Bug fix: nested components under metadata.component are now included in license validation (previously only the root was checked)
Bug fix: top-level d.ref values in bom.dependencies are now validated against known BOM components (previously only nested refs were checked)
Incomplete dependency graph check now yields a ModelValidationError(severity=WARNING) with UserWarning data, instead of emitting a Python warnings.warn() — making it visible to callers and testable via ModelValidator

`cyclonedx/model/bom.py`

Bom.validate() removed (breaking change)

`cyclonedx/output/init.py`, `json.py`, `xml.py`

Dependency graph normalization (register_dependency) and model validation are consolidated into a single BaseOutput._prepare() hook, shared by both JSON and XML serializers — eliminating duplicated logic

Migration

Replace bom.validate() calls with:

from cyclonedx.validation.model import ModelValidationErrorSeverity, ModelValidator

errors = [e for e in ModelValidator().validate(bom)
          if e.severity is ModelValidationErrorSeverity.ERROR]

AI Tool Disclosure

My contribution includes AI-generated content, as disclosed below:
- AI Tools: Claude Code
- LLMs and versions: Claude Sonnet 4.6

Affirmation

My code follows the CONTRIBUTING.md guidelines

read-the-docs-community · 2026-02-15T04:43:26Z

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #33588301 | 📁 Comparing 00df85b against latest (4ef5bc3)

🔍 Preview build

18 files changed · + 2 added · ± 16 modified

+ Added

± Modified

Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

codacy-production · 2026-04-25T15:30:31Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 6 complexity · 0 duplication

Metric Results

Complexity 6

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

…ator - Add ModelValidationErrorSeverity enum (ERROR/WARNING) for typed severity - Fix nested components under metadata.component not being license-checked - Fix top-level dependency d.ref not validated against known BOM components - Convert incomplete-dependency-graph warning to typed ModelValidationError with WARNING severity instead of Python warnings.warn() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

Bom.validate() has been removed. Use cyclonedx.validation.model.ModelValidator instead, which provides typed validation errors with severity levels. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

…utput._prepare() Both JSON and XML serializers now share a single _prepare() hook that runs dependency graph normalization (register_dependency) and ModelValidator before serialization, eliminating duplicated logic. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

Replace bom.validate() calls with ModelValidator().validate(bom) across test_model_bom.py and test_real_world_examples.py. Add regression tests for the two bug fixes (nested component license check, top-level dependency ref). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

saquibsaifee · 2026-04-29T20:53:03Z

@jkowalleck, please have a look. I made it as a breaking change, which might be uncalled for, and happy to make it deprecated with a warning instead.

CAOShurong

The new ModelValidator behavior looks well covered, but this head removes Bom.validate() outright even though the maintainer direction in issue #455 says the existing public API should be deprecated while the advanced replacement is provided: #455 (comment)

I reproduced the compatibility break against current main (52cb3c9) and this exact head (00df85b): Bom().validate() returns True on main, while this head raises AttributeError: 'Bom' object has no attribute 'validate'. The full candidate suite passes (6,965 tests), so the current tests do not protect that public call path.

Please keep Bom.validate() as a deprecated compatibility wrapper (preserving its normalization, warning, exception, and boolean-return behavior while delegating validation where appropriate), and add a regression that exercises the legacy caller during the deprecation window. The new side-effect-free ModelValidator and output _prepare() path can remain the preferred API.

Verification on exact head 00df85b: 744 focused output/model/validation tests and all 6,965 tests passed; flake8 and mypy passed; sdist/wheel build, clean-wheel install, valid JSON dependency normalization/warning, invalid-license rejection, and unknown-reference validation probes passed.

Review prepared with assistance from OpenAI Codex; I independently ran and checked the commands and results described above.

feat: refactor Bom.validate() to ModelValidator...

745d773

Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>

saquibsaifee force-pushed the feat/refactor-validation-to-model-validator branch from 228bc94 to 745d773 Compare February 15, 2026 04:44

saquibsaifee added 3 commits February 27, 2026 09:48

Merge branch 'main' into feat/refactor-validation-to-model-validator

42240b7

Merge branch 'main' into feat/refactor-validation-to-model-validator

3814d71

Merge branch 'main' into feat/refactor-validation-to-model-validator

d726148

saquibsaifee and others added 4 commits April 29, 2026 16:41

saquibsaifee marked this pull request as ready for review April 29, 2026 20:43

saquibsaifee requested a review from a team as a code owner April 29, 2026 20:43

saquibsaifee changed the title ~~feat: refactor Bom.validate() to ModelValidator...~~ feat!: implement ModelValidator and remove Bom.validate() (resolves #455) Apr 29, 2026

saquibsaifee changed the title ~~feat!: implement ModelValidator and remove Bom.validate() (resolves #455)~~ feat!: implement ModelValidator and remove Bom.validate() Apr 29, 2026

jkowalleck added enhancement New feature or request breaking change labels Apr 30, 2026

jkowalleck linked an issue Apr 30, 2026 that may be closed by this pull request

move model.bom.Bom.validate() to validation.models #455

Open

saquibsaifee and others added 4 commits May 9, 2026 02:10

Merge branch 'main' into feat/refactor-validation-to-model-validator

1a096e2

Merge branch 'main' into feat/refactor-validation-to-model-validator

3698335

Merge branch 'main' into feat/refactor-validation-to-model-validator

07795d8

Merge branch 'main' into feat/refactor-validation-to-model-validator

189e790

jkowalleck mentioned this pull request Jun 24, 2026

[PERF] Quadratic (O(N^2)) serialization time for large BOMs — Bom.validate() → register_dependency() linear scan #1006

Open

Merge branch 'main' into feat/refactor-validation-to-model-validator

00df85b

CAOShurong suggested changes Aug 14, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

feat!: implement ModelValidator and remove Bom.validate() - #935

feat!: implement ModelValidator and remove Bom.validate()#935
saquibsaifee wants to merge 13 commits into
CycloneDX:mainfrom
saquibsaifee:feat/refactor-validation-to-model-validator

saquibsaifee commented Feb 15, 2026 •

edited

Loading

Uh oh!

read-the-docs-community Bot commented Feb 15, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

saquibsaifee commented Apr 29, 2026

Uh oh!

CAOShurong left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

saquibsaifee commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

cyclonedx/validation/model.py

cyclonedx/model/bom.py

cyclonedx/output/__init__.py, json.py, xml.py

Migration

AI Tool Disclosure

Affirmation

Uh oh!

read-the-docs-community Bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

codacy-production Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

saquibsaifee commented Apr 29, 2026

Uh oh!

CAOShurong left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saquibsaifee commented Feb 15, 2026 •

edited

Loading

`cyclonedx/validation/model.py`

`cyclonedx/model/bom.py`

`cyclonedx/output/init.py`, `json.py`, `xml.py`

read-the-docs-community Bot commented Feb 15, 2026 •

edited

Loading

codacy-production Bot commented Apr 25, 2026 •

edited

Loading