2.0 dev threat modeling petras suggestions by P3tra-WP · Pull Request #760 · CycloneDX/specification

P3tra-WP · 2026-01-04T20:52:05Z

As discussed in ticket, this PR updates the data and governance schemas:

Added shared cyclonedx-data-2.0.schema.json with merged data classification (secret/restricted) and expanded data categories plus richer data object metadata (format/protocol/schema).
Updated blueprint schema to reference shared data objects, renamed dataset sensitivity to data classification, added data categories/data object refs, and moved flow classification/format into the data object; clarified services are modeled as components.
Expanded authentication/authorization/encryption details (assurance/factors, PDP/PEP context, per-state algorithms/protocols) and restored ownership fields; kept threat/risk/vulnerability linkages.

Signed-off-by: Steve Springett <steve@springett.us>

Signed-off-by: Aki <a@expertzebra.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v5...v6) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Pull request overview

This PR adds third-party Python library files to a virtual environment directory, specifically installing the htmlmin, dataclasses-json, and click packages. These appear to be dependencies for a documentation generation tool related to threat modeling and data governance schemas.

Changes:

Added htmlmin 0.1.12 package files for HTML minification functionality
Added dataclasses-json 0.5.14 package files for JSON serialization of dataclasses
Added click 8.1.7 package files for command-line interface creation

Reviewed changes

Copilot reviewed 99 out of 2785 changed files in this pull request and generated 11 comments.

File	Description
docgen/json/venv/lib/python3.12/site-packages/htmlmin/*	HTML minification library source files and package metadata
docgen/json/venv/lib/python3.12/site-packages/dataclasses_json/*	JSON dataclass serialization library source files and package metadata
docgen/json/venv/lib/python3.12/site-packages/click/*	CLI framework library source files and package metadata

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-15T13:05:21Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/main.py

+  :param remove_optional_attribute_quotes: When True, optional quotes around
+    attributes are removed. When False, all attribute quotes are left intact.
+    Defaults to True.
+  :param conver_charrefs: Decode character references such as &amp; and &#46;


Parameter name 'conver_charrefs' appears to be a typo; should be 'convert_charrefs' to match the function signature at line 39.

Suggested change

:param conver_charrefs: Decode character references such as & and .

:param convert_charrefs: Decode character references such as & and .

Copilot · 2026-01-15T13:05:22Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/main.py

+
+  Options are passed into this class at initialization time and are then
+  persisted across each use of the instance. If you are going to be minifying
+  multiple peices of HTML, this will be more efficient than using


Corrected spelling of 'peices' to 'pieces'.

Suggested change

multiple peices of HTML, this will be more efficient than using

multiple pieces of HTML, this will be more efficient than using

Copilot · 2026-01-15T13:05:22Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/main.py

+    :returns: A string containing the minified HTML.
+
+    This is the simplest way to use an existing ``Minifier`` instance. This
+    method takes in HTML and minfies it, returning the result. Note that this


Corrected spelling of 'minfies' to 'minifies'.

Copilot · 2026-01-15T13:05:23Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/main.py

+    return self._parser.result
+
+  def finalize(self):
+    """Finishes current input HTML and returns mininified result.


Corrected spelling of 'mininified' to 'minified'.

Suggested change

"""Finishes current input HTML and returns mininified result.

"""Finishes current input HTML and returns minified result.

Copilot · 2026-01-15T13:05:23Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/escape.py

+import re
+


The 're' module is imported twice (lines 28 and 35). Remove the duplicate import on line 35.

Suggested change

import re

Copilot · 2026-01-15T13:05:24Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/decorator.py

+          'htmlmin decorator does accept positional arguments')
+  elif len(args) > 1:
+    raise RuntimeError(
+      'htmlmin decorator does accept positional arguments')


Error message is misleading: should say 'does not accept' instead of 'does accept'.

Suggested change

'htmlmin decorator does accept positional arguments')

elif len(args) > 1:

raise RuntimeError(

'htmlmin decorator does accept positional arguments')

'htmlmin decorator does not accept positional arguments')

elif len(args) > 1:

raise RuntimeError(

'htmlmin decorator does not accept positional arguments')

Copilot · 2026-01-15T13:05:25Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/command.py

+
+parser.add_argument('-s', '--remove-empty-space',
+  help=(
+'''When set, this removes empty space betwen tags in certain cases.


Corrected spelling of 'betwen' to 'between'.

Copilot · 2026-01-15T13:05:25Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/command.py

+
+parser.add_argument('--remove-all-empty-space',
+  help=(
+'''When set, this removes ALL empty space betwen tags. WARNING: this can and


Corrected spelling of 'betwen' to 'between'.

Copilot · 2026-01-15T13:05:25Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/command.py

+
+parser.add_argument('-k', '--keep-pre-attr',
+  help=(
+'''HTMLMin supports the propietary attribute 'pre' that can be added to elements


Corrected spelling of 'propietary' to 'proprietary'.

Suggested change

'''HTMLMin supports the propietary attribute 'pre' that can be added to elements

'''HTMLMin supports the proprietary attribute 'pre' that can be added to elements

Copilot · 2026-01-15T13:05:26Z

docgen/json/venv/lib/python3.12/site-packages/htmlmin/command.py

+  help=(
+'''By default, the contents of 'pre', and 'textarea' tags are left unminified.
+You can specify different tags using the --pre-tags option. 'script' and 'style'
+tags are always left unmininfied.


Corrected spelling of 'unmininfied' to 'unminified'.

Suggested change

tags are always left unmininfied.

tags are always left unminified.

stevespringett and others added 10 commits January 4, 2026 20:47

Create bundle_2.0_schemas.yml

5bf4f74

Signed-off-by: Steve Springett <steve@springett.us>

Update bundle_2.0_schemas.yml

c4d6398

Signed-off-by: Steve Springett <steve@springett.us>

Update bundle_2.0_schemas.yml

def0936

Signed-off-by: Steve Springett <steve@springett.us>

Update bundle_2.0_schemas.yml

e89821c

Signed-off-by: Steve Springett <steve@springett.us>

Fix typos in descriptions

b7132cf

Signed-off-by: Aki <a@expertzebra.com>

Syncing with master

2ad9542

Update schema data/governance models

d7ad44b

P3tra-WP requested a review from a team as a code owner January 4, 2026 20:52

jkowalleck requested a review from Copilot January 15, 2026 13:03

Copilot AI reviewed Jan 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

2.0 dev threat modeling petras suggestions#760

2.0 dev threat modeling petras suggestions#760
P3tra-WP wants to merge 10 commits intoCycloneDX:2.0-dev-threatmodelingfrom
P3tra-WP:2.0-dev-threat-modeling-petras-suggestions

P3tra-WP commented Jan 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	:param conver_charrefs: Decode character references such as & and .
	:param convert_charrefs: Decode character references such as & and .

	multiple peices of HTML, this will be more efficient than using
	multiple pieces of HTML, this will be more efficient than using

	"""Finishes current input HTML and returns mininified result.
	"""Finishes current input HTML and returns minified result.

	'''HTMLMin supports the propietary attribute 'pre' that can be added to elements
	'''HTMLMin supports the proprietary attribute 'pre' that can be added to elements

	tags are always left unmininfied.
	tags are always left unminified.

Uh oh!

Conversation

P3tra-WP commented Jan 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants