[wleeaf]

ReleaseNotes.Resolves is a nested class and has no @JsonInclude. The NON_EMPTY on ReleaseNotes does not carry over to it, so a resolved issue without a name or references is written as:

"resolves" : [ {
  "type" : "enhancement",
  "id" : "JIRA-17240",
  "name" : null,
  "description" : "Great new feature that does something",
  "source" : { ... },
  "references" : null
} ]

The JSON schema doesn't allow null there (/components/0/releaseNotes/resolves/0/name: null found, string expected). So parsing valid-release-notes-1.6.json from the spec test data, which the repo already has under src/test/resources/1.6/, and generating JSON again gives an invalid BOM. The same happens for 1.4, 1.5 and 1.7, and when the input is the XML file.

This adds @JsonInclude(JsonInclude.Include.NON_EMPTY) to Resolves, as on ReleaseNotes and on the top-level Issue class.

schema16ReleaseNotesResolvesWithoutNameJsonTest parses that resource, generates 1.6 JSON, and checks that there are no null values and that the output passes the schema. It fails without the change and passes with it. mvn -B test passes: 1762 tests, 0 failures. On master the suite has 1761 tests, all passing.

I found this by parsing every valid JSON and XML file in CycloneDX/specification tools/src/test/resources/1.2–1.7, generating both formats again for the same version, and validating the output with the library's own parsers.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}