feat: add contrib.bom.utils.BomDependencyGraphFlatMerger

[jkowalleck]

Description

add a utility to flatten/merge bom dependnecy graphs.

related to #941

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #33091139 | 📁 Comparing d791222 against latest (9beaf5c)

  🔍 Preview build  

2 files changed

± genindex.html
± autoapi/cyclonedx/contrib/bom/utils/index.html

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 11 complexity · 0 duplication

Metric	Results
Complexity	11
Duplication	0

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.04% coverage variation

Metric	Results
Coverage variation	✅ +0.04% coverage variation
Diff coverage	✅ 100.00% diff coverage (80.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (9beaf5c)	6050	5699	94.20%
Head commit (d791222)	6078 (+28)	5728 (+29)	94.24% (+0.04%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#997)	29	29	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Adds a contrib utility to flatten/merge a BOM dependency graph into a non-recursive representation, intended to help with cases where nested Dependency structures are not serialized as expected (related to #941).

Changes:

• Introduces contrib.bom.utils.BomDependencyGraphFlatMerger as a context-manager for temporary flatten/merge of Bom.dependencies.
• Adds unit tests exercising both manual reset() and context-manager usage for the new merger.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cyclonedx/contrib/bom/utils.py	Adds BomDependencyGraphFlatMerger and exports it via __all__.
tests/test_contrib/test_bom_utils.py	Adds tests validating flatten/merge behavior and restoration of original dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.