fix(cyclonedx): update aggregate BOM and tool metadata

[JustinWonjaePark]

• Bug Fixes

  • CycloneDX reports can now be generated with their default filenames on Windows.
  • Generated reports now include scanner details and all relevant coverage information.

• Compatibility

  • Updated minimum supported versions for runtime components while preserving existing version limits.
  • These updates support consistent scanning and report generation across compatible component versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 452ef3d8-23ff-4d50-a719-d57f0d6bd711

📥 Commits

Reviewing files that changed from the base of the PR and between 4c39a33 and c465089.

📒 Files selected for processing (1)

• pyproject.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request raises four runtime dependency minimums. It changes Windows handling for SPDX and CycloneDX output formats. It also passes the scanner cover and all collected cover items to report generation.

Changes

Scanner updates

Layer / File(s)	Summary
Runtime dependency constraints pyproject.toml	Raises the minimum versions of four fosslight_* runtime dependencies. The existing upper bounds remain unchanged.
Report format handling and scanner covers src/fosslight_scanner/fosslight_scanner.py	Treats SPDX as unsupported on Windows while assigning the default CycloneDX filename on Windows. Passes the scanner cover and all collected cover items to write_output_file.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c4650

The dependency and report-generation changes have no established merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the CycloneDX changes, including aggregate BOM content and tool metadata. These changes are present in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cyclonedx

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}