hoppr-cyclonedx-models 0.6.0__py3-none-any.whl → 0.6.1__py3-none-any.whl

hoppr_cyclonedx_models/cyclonedx_1_6.py

@@ -1,6 +1,6 @@
 """
 --------------------------------------------------------------------------------
-SPDX-FileCopyrightText: Copyright © 2024 Lockheed Martin <open.source@lmco.com>
+SPDX-FileCopyrightText: Copyright © 2025 Lockheed Martin <open.source@lmco.com>
 SPDX-FileName: hoppr_cyclonedx_models/cyclonedx_1_6.py
 SPDX-FileType: SOURCE
 SPDX-License-Identifier: MIT
@@ -25,15 +25,15 @@ THE SOFTWARE.
 --------------------------------------------------------------------------------
 This file was generated by datamodel-codegen:
   filename:  bom-1.6.schema.json
-  timestamp: 2024-07-15T17:53:40+00:00
-  version:   0.21.5
+  timestamp: 2025-09-17T19:02:47+00:00
+  version:   0.25.7
 """
 
 from __future__ import annotations
 
 from datetime import datetime
 from enum import Enum
-from typing import Any, List, Optional, Union
+from typing import List, Optional, Union
 
 from pydantic import AnyUrl, EmailStr, Extra, Field
 from typing_extensions import Annotated, Literal
@@ -65,18 +65,6 @@ class Confidence(CycloneDXBaseModel):
     ] = None
 
 
-RefType = Annotated[
-    str,
-    Field(
-        description=(
-            "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link"
-            " intro 'urn:cdx:' to avoid conflicts with BOM-Links."
-        ),
-        min_length=1,
-    ),
-]
-
-
 RefLinkType = Annotated[
     str,
     Field(
@@ -130,14 +118,22 @@ class Phase(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class Lifecycle(CycloneDXBaseModel):
+class Lifecycles(CycloneDXBaseModel):
+    """
+    The product lifecycle(s) that this BOM represents.
+    """
+
     class Config:
         extra = Extra.forbid
 
     phase: Annotated[Phase, Field(description="A pre-defined phase in the product lifecycle.", title="Phase")]
 
 
-class Lifecycle1(CycloneDXBaseModel):
+class Lifecycles1(CycloneDXBaseModel):
+    """
+    The product lifecycle(s) that this BOM represents.
+    """
+
     class Config:
         extra = Extra.forbid
 
@@ -157,7 +153,7 @@ class OrganizationalContact(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -235,7 +231,15 @@ class Attachment(CycloneDXBaseModel):
     contentType: Annotated[
         Optional[str],
         Field(
-            description="Specifies the content type of the text. Defaults to text/plain if not specified.",
+            description=(
+                "Specifies the format and nature of the data being attached, helping systems correctly interpret and"
+                " process the content. Common content type examples include `application/json` for JSON data and"
+                " `text/plain` for plan text documents.\n [RFC 2045 section"
+                " 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content"
+                " types. For a comprehensive list of registered content types, refer to the [IANA media types"
+                " registry](https://www.iana.org/assignments/media-types/media-types.xhtml)."
+            ),
+            examples=["text/plain", "application/json", "image/png"],
             title="Content-Type",
         ),
     ] = "text/plain"
@@ -307,71 +311,54 @@ class LicenseType(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class Licensing(CycloneDXBaseModel):
+class LicenseAcknowledgementEnumeration(Enum):
     """
-    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
+    Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
     """
 
+    DECLARED = declared = "declared"
+    CONCLUDED = concluded = "concluded"
+
+    def __str__(self) -> str:
+        return str(self.value)
+
+    @classmethod
+    def _missing_(cls, value: object):
+        return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
+
+
+class LicenseChoice21(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    altIds: Annotated[
-        Optional[List[str]],
-        Field(
-            description="License identifiers that may be used to manage licenses and their lifecycle",
-            title="Alternate License Identifiers",
-        ),
-    ] = None
-    purchaseOrder: Annotated[
-        Optional[str],
+    expression: Annotated[
+        str,
         Field(
             description=(
-                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
+                "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements"
             ),
-            title="Purchase Order",
+            examples=["Apache-2.0 AND (MIT OR GPL-2.0-only)", "GPL-3.0-only WITH Classpath-exception-2.0"],
+            title="SPDX License Expression",
         ),
-    ] = None
-    licenseTypes: Annotated[
-        Optional[List[LicenseType]],
-        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
-    ] = None
-    lastRenewal: Annotated[
-        Optional[datetime],
+    ]
+    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
+    bom_ref: Annotated[
+        Optional[str],
         Field(
+            alias="bom-ref",
             description=(
-                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
-                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
-                " when the license was last renewed."
+                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " conflicts with BOM-Links."
             ),
-            title="Last Renewal",
-        ),
-    ] = None
-    expiration: Annotated[
-        Optional[datetime],
-        Field(
-            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
+            min_length=1,
+            title="BOM Reference",
         ),
     ] = None
 
 
-class LicenseAcknowledgementEnumeration(Enum):
-    """
-    Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
-    """
-
-    DECLARED = declared = "declared"
-    CONCLUDED = concluded = "concluded"
-
-    def __str__(self) -> str:
-        return str(self.value)
-
-    @classmethod
-    def _missing_(cls, value: object):
-        return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
-
-
 LicenseChoice2 = Annotated[
-    List[Any],
+    List[LicenseChoice21],
     Field(
         description="A tuple of exactly one SPDX License Expression.",
         max_items=1,
@@ -560,7 +547,7 @@ class Type3(Enum):
 
 class Dependency(CycloneDXBaseModel):
     """
-    Defines the direct dependencies of a component, service, or the components provided/implemented by a given component. Components or services that do not have their own dependencies MUST be declared as empty elements within the graph. Components or services that are not represented in the dependency graph MAY have unknown dependencies. It is RECOMMENDED that implementations assume this to be opaque and not an indicator of an object being dependency-free. It is RECOMMENDED to leverage compositions to indicate unknown dependency graphs.
+    Defines the direct dependencies of a component, service, or the components provided/implemented by a given component. Components or services that do not have their own dependencies must be declared as empty elements within the graph. Components or services that are not represented in the dependency graph may have unknown dependencies. It is recommended that implementations assume this to be opaque and not an indicator of an object being dependency-free. It is recommended to leverage compositions to indicate unknown dependency graphs.
     """
 
     class Config:
@@ -573,16 +560,17 @@ class Dependency(CycloneDXBaseModel):
         ),
     ]
     dependsOn: Annotated[
-        Optional[List[RefLinkType]],
+        Optional[List[str]],
         Field(
             description=(
                 "The bom-ref identifiers of the components or services that are dependencies of this dependency object."
             ),
+            min_length=1,
             title="Depends On",
         ),
     ] = None
     provides: Annotated[
-        Optional[List[RefLinkType]],
+        Optional[List[str]],
         Field(
             description=(
                 "The bom-ref identifiers of the components or services that define a given specification or standard,"
@@ -590,6 +578,7 @@ class Dependency(CycloneDXBaseModel):
                 " which implements a cryptographic algorithm. A component which implements another component does not"
                 " imply that the implementation is in use."
             ),
+            min_length=1,
             title="Provides",
         ),
     ] = None
@@ -614,10 +603,14 @@ class DataFlowDirection(Enum):
 
 
 class Copyright(CycloneDXBaseModel):
+    """
+    A copyright notice informing users of the underlying claims to copyright ownership in a published work.
+    """
+
     class Config:
         extra = Extra.forbid
 
-    text: Annotated[str, Field(title="Copyright Text")]
+    text: Annotated[str, Field(description="The textual content of the copyright.", title="Copyright Text")]
 
 
 class Occurrence(CycloneDXBaseModel):
@@ -630,7 +623,7 @@ class Occurrence(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the occurrence elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -745,7 +738,7 @@ class AggregateType(Enum):
 
 class Property(CycloneDXBaseModel):
     """
-    Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL.
+    Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.
     """
 
     class Config:
@@ -799,19 +792,6 @@ class Advisory(CycloneDXBaseModel):
     url: Annotated[str, Field(description="Location where the advisory can be obtained.", title="URL")]
 
 
-Cwe = Annotated[
-    int,
-    Field(
-        description=(
-            "Integer representation of a Common Weaknesses Enumerations (CWE). For example 399 (of"
-            " https://cwe.mitre.org/data/definitions/399.html)"
-        ),
-        ge=1,
-        title="CWE",
-    ),
-]
-
-
 class Severity(Enum):
     """
     Textual representation of the severity of the vulnerability adopted by the analysis method. If the analysis method uses values other than what is provided, the user is expected to translate appropriately.
@@ -1019,19 +999,6 @@ class Analysis(CycloneDXBaseModel):
     ] = None
 
 
-class Affect(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    ref: Annotated[
-        Union[RefLinkType, BomLinkElementType],
-        Field(description="References a component or service by the objects bom-ref", title="Reference"),
-    ]
-    versions: Annotated[
-        Optional[List], Field(description="Zero or more individual versions or range of versions.", title="Versions")
-    ] = None
-
-
 class AffectedStatus(Enum):
     """
     The vulnerability status of a given version or range of versions of a product. The statuses 'affected' and 'unaffected' indicate that the version is affected or unaffected by the vulnerability. The status 'unknown' indicates that it is unknown or unspecified whether the given version is affected. There can be many reasons for an 'unknown' status, including that an investigation has not been undertaken or that a vendor has not disclosed the status.
@@ -1102,7 +1069,7 @@ class Approach(CycloneDXBaseModel):
     ] = None
 
 
-class Dataset(CycloneDXBaseModel):
+class Datasets(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
@@ -1177,7 +1144,7 @@ class Graphic(CycloneDXBaseModel):
     image: Annotated[
         Optional[Attachment],
         Field(
-            description="The graphic (vector or raster). Base64 encoding MUST be specified for binary images.",
+            description="The graphic (vector or raster). Base64 encoding must be specified for binary images.",
             title="Graphic Image",
         ),
     ] = None
@@ -1346,7 +1313,7 @@ class PostalAddress(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the address elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -1382,7 +1349,20 @@ class Command(CycloneDXBaseModel):
     executed: Annotated[
         Optional[str], Field(description="A text representation of the executed command.", title="Executed")
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class AccessMode(Enum):
@@ -1464,7 +1444,20 @@ class Volume(CycloneDXBaseModel):
         Optional[bool],
         Field(description="Indicates if the volume is remotely (i.e., network) attached.", title="Remote"),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Type6(Enum):
@@ -1524,7 +1517,20 @@ class Condition(CycloneDXBaseModel):
             title="Expression",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class TaskType(Enum):
@@ -1679,9 +1685,6 @@ class ComponentIdentityEvidence(CycloneDXBaseModel):
     ] = None
 
 
-OpenCre = Annotated[str, Field(examples=["CRE:764-507"], regex="^CRE:[0-9]+-[0-9]+$")]
-
-
 class Level(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
@@ -1692,7 +1695,7 @@ class Level(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -1707,12 +1710,16 @@ class Level(CycloneDXBaseModel):
         Optional[str], Field(description="The description of the level.", title="Description")
     ] = None
     requirements: Annotated[
-        Optional[List[RefLinkType]],
-        Field(description="The list of requirement `bom-ref`s that comprise the level.", title="Requirements"),
+        Optional[List[str]],
+        Field(
+            description="The list of requirement `bom-ref`s that comprise the level.",
+            min_length=1,
+            title="Requirements",
+        ),
     ] = None
 
 
-class AlgorithmEnum(Enum):
+class Algorithm(Enum):
     """
     Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".
     """
@@ -2032,7 +2039,7 @@ class AlgorithmProperties(CycloneDXBaseModel):
                 "The target platform for which the algorithm is implemented. The implementation can be 'generic',"
                 " running on any platform or for a specific platform."
             ),
-            title="implementation platform",
+            title="Implementation platform",
         ),
     ] = None
     certificationLevel: Annotated[
@@ -2147,7 +2154,7 @@ class CertificateProperties(CycloneDXBaseModel):
     ] = None
 
 
-class Type8(Enum):
+class Type10(Enum):
     """
     The type for the related cryptographic material
     """
@@ -2200,7 +2207,7 @@ class State(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class Type9(Enum):
+class Type11(Enum):
     """
     The concrete protocol type.
     """
@@ -2239,8 +2246,10 @@ class CipherSuite(CycloneDXBaseModel):
         ),
     ] = None
     algorithms: Annotated[
-        Optional[List[RefType]],
-        Field(description="A list of algorithms related to the cipher suite.", title="Related Algorithms"),
+        Optional[List[str]],
+        Field(
+            description="A list of algorithms related to the cipher suite.", min_length=1, title="Related Algorithms"
+        ),
     ] = None
     identifiers: Annotated[
         Optional[List[str]],
@@ -2290,9 +2299,10 @@ class Conformance(CycloneDXBaseModel):
         Optional[str], Field(description="The rationale for the conformance score.", title="Rationale")
     ] = None
     mitigationStrategies: Annotated[
-        Optional[List[RefLinkType]],
+        Optional[List[str]],
         Field(
             description="The list of  `bom-ref` to the evidence provided describing the mitigation strategies.",
+            min_length=1,
             title="Mitigation Strategies",
         ),
     ] = None
@@ -2307,12 +2317,16 @@ class Map(CycloneDXBaseModel):
         Field(description="The `bom-ref` to the requirement being attested to.", min_length=1, title="Requirement"),
     ] = None
     claims: Annotated[
-        Optional[List[RefLinkType]],
-        Field(description="The list of `bom-ref` to the claims being attested to.", title="Claims"),
+        Optional[List[str]],
+        Field(description="The list of `bom-ref` to the claims being attested to.", min_length=1, title="Claims"),
     ] = None
     counterClaims: Annotated[
-        Optional[List[RefLinkType]],
-        Field(description="The list of  `bom-ref` to the counter claims being attested to.", title="Counter Claims"),
+        Optional[List[str]],
+        Field(
+            description="The list of  `bom-ref` to the counter claims being attested to.",
+            min_length=1,
+            title="Counter Claims",
+        ),
     ] = None
     conformance: Annotated[
         Optional[Conformance],
@@ -2351,7 +2365,7 @@ class OrganizationalEntity(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -2424,96 +2438,493 @@ class Hash(CycloneDXBaseModel):
     ]
 
 
-class License(CycloneDXBaseModel):
+class Licensor(CycloneDXBaseModel):
+    """
+    The individual or organization that grants a license to another individual or organization
+    """
+
     class Config:
         extra = Extra.forbid
 
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
-                " conflicts with BOM-Links."
-            ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ] = None
-    id: Annotated[
-        Optional[spdx.LicenseID],
-        Field(description="A valid SPDX license ID", examples=["Apache-2.0"], title="License ID (SPDX)"),
-    ] = None
-    name: Annotated[
-        Optional[str],
-        Field(
-            description="If SPDX does not define the license used, this field may be used to provide the license name",
-            examples=["Acme Software License"],
-            title="License Name",
-        ),
-    ] = None
-    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
-    text: Annotated[
-        Optional[Attachment],
-        Field(description="An optional way to include the textual content of a license.", title="License text"),
-    ] = None
-    url: Annotated[
-        Optional[str],
+    organization: Annotated[
+        OrganizationalEntity,
+        Field(description="The organization that granted the license", title="Licensor (Organization)"),
+    ]
+    individual: Annotated[
+        Optional[OrganizationalContact],
         Field(
-            description=(
-                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
-                " completeness"
-            ),
-            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
-            title="License URL",
+            description="The individual, not associated with an organization, that granted the license",
+            title="Licensor (Individual)",
         ),
     ] = None
-    licensing: Annotated[
-        Optional[Licensing],
-        Field(
-            description=(
-                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
-                " other important metadata"
-            ),
-            title="Licensing information",
-        ),
+
+
+class Licensor1(CycloneDXBaseModel):
+    """
+    The individual or organization that grants a license to another individual or organization
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity],
+        Field(description="The organization that granted the license", title="Licensor (Organization)"),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    individual: Annotated[
+        OrganizationalContact,
         Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
-            ),
-            title="Properties",
+            description="The individual, not associated with an organization, that granted the license",
+            title="Licensor (Individual)",
         ),
-    ] = None
+    ]
 
 
-class LicenseChoice1(CycloneDXBaseModel):
+class Licensee(CycloneDXBaseModel):
+    """
+    The individual or organization for which a license was granted to
+    """
+
     class Config:
         extra = Extra.forbid
 
-    license: License
+    organization: Annotated[
+        OrganizationalEntity,
+        Field(description="The organization that was granted the license", title="Licensee (Organization)"),
+    ]
+    individual: Annotated[
+        Optional[OrganizationalContact],
+        Field(
+            description="The individual, not associated with an organization, that was granted the license",
+            title="Licensee (Individual)",
+        ),
+    ] = None
 
 
-class Commit(CycloneDXBaseModel):
+class Licensee1(CycloneDXBaseModel):
     """
-    Specifies an individual commit
+    The individual or organization for which a license was granted to
     """
 
     class Config:
         extra = Extra.forbid
 
-    uid: Annotated[
-        Optional[str],
+    organization: Annotated[
+        Optional[OrganizationalEntity],
+        Field(description="The organization that was granted the license", title="Licensee (Organization)"),
+    ] = None
+    individual: Annotated[
+        OrganizationalContact,
         Field(
-            description=(
+            description="The individual, not associated with an organization, that was granted the license",
+            title="Licensee (Individual)",
+        ),
+    ]
+
+
+class Purchaser(CycloneDXBaseModel):
+    """
+    The individual or organization that purchased the license
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        OrganizationalEntity,
+        Field(description="The organization that purchased the license", title="Purchaser (Organization)"),
+    ]
+    individual: Annotated[
+        Optional[OrganizationalContact],
+        Field(
+            description="The individual, not associated with an organization, that purchased the license",
+            title="Purchaser (Individual)",
+        ),
+    ] = None
+
+
+class Purchaser1(CycloneDXBaseModel):
+    """
+    The individual or organization that purchased the license
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity],
+        Field(description="The organization that purchased the license", title="Purchaser (Organization)"),
+    ] = None
+    individual: Annotated[
+        OrganizationalContact,
+        Field(
+            description="The individual, not associated with an organization, that purchased the license",
+            title="Purchaser (Individual)",
+        ),
+    ]
+
+
+class Licensing(CycloneDXBaseModel):
+    """
+    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    altIds: Annotated[
+        Optional[List[str]],
+        Field(
+            description="License identifiers that may be used to manage licenses and their lifecycle",
+            title="Alternate License Identifiers",
+        ),
+    ] = None
+    licensor: Annotated[
+        Optional[Union[Licensor, Licensor1]],
+        Field(
+            description="The individual or organization that grants a license to another individual or organization",
+            title="Licensor",
+        ),
+    ] = None
+    licensee: Annotated[
+        Optional[Union[Licensee, Licensee1]],
+        Field(description="The individual or organization for which a license was granted to", title="Licensee"),
+    ] = None
+    purchaser: Annotated[
+        Optional[Union[Purchaser, Purchaser1]],
+        Field(description="The individual or organization that purchased the license", title="Purchaser"),
+    ] = None
+    purchaseOrder: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
+            ),
+            title="Purchase Order",
+        ),
+    ] = None
+    licenseTypes: Annotated[
+        Optional[List[LicenseType]],
+        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
+    ] = None
+    lastRenewal: Annotated[
+        Optional[datetime],
+        Field(
+            description=(
+                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
+                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
+                " when the license was last renewed."
+            ),
+            title="Last Renewal",
+        ),
+    ] = None
+    expiration: Annotated[
+        Optional[datetime],
+        Field(
+            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
+        ),
+    ] = None
+
+
+class License1(CycloneDXBaseModel):
+    """
+    Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    bom_ref: Annotated[
+        Optional[str],
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
+    ] = None
+    id: Annotated[
+        spdx.LicenseID,
+        Field(
+            description=(
+                "A valid SPDX license identifier. If specified, this value must be one of the enumeration of valid SPDX"
+                " license identifiers defined in the spdx.schema.json (or spdx.xml) subschema which is synchronized"
+                " with the official SPDX license list."
+            ),
+            examples=["Apache-2.0"],
+            title="License ID (SPDX)",
+        ),
+    ]
+    name: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The name of the license. This may include the name of a commercial or proprietary license or an open"
+                " source license that may not be defined by SPDX."
+            ),
+            examples=["Acme Software License"],
+            title="License Name",
+        ),
+    ] = None
+    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
+    text: Annotated[
+        Optional[Attachment],
+        Field(description="An optional way to include the textual content of a license.", title="License text"),
+    ] = None
+    url: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
+                " completeness"
+            ),
+            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
+            title="License URL",
+        ),
+    ] = None
+    licensing: Annotated[
+        Optional[Licensing],
+        Field(
+            description=(
+                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
+                " other important metadata"
+            ),
+            title="Licensing information",
+        ),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class Licensor2(Licensor):
+    """
+    The individual or organization that grants a license to another individual or organization
+    """
+
+
+class Licensor3(Licensor1):
+    """
+    The individual or organization that grants a license to another individual or organization
+    """
+
+
+class Licensee2(Licensee):
+    """
+    The individual or organization for which a license was granted to
+    """
+
+
+class Licensee3(Licensee1):
+    """
+    The individual or organization for which a license was granted to
+    """
+
+
+class Purchaser2(Purchaser):
+    """
+    The individual or organization that purchased the license
+    """
+
+
+class Purchaser3(Purchaser1):
+    """
+    The individual or organization that purchased the license
+    """
+
+
+class Licensing1(CycloneDXBaseModel):
+    """
+    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    altIds: Annotated[
+        Optional[List[str]],
+        Field(
+            description="License identifiers that may be used to manage licenses and their lifecycle",
+            title="Alternate License Identifiers",
+        ),
+    ] = None
+    licensor: Annotated[
+        Optional[Union[Licensor2, Licensor3]],
+        Field(
+            description="The individual or organization that grants a license to another individual or organization",
+            title="Licensor",
+        ),
+    ] = None
+    licensee: Annotated[
+        Optional[Union[Licensee2, Licensee3]],
+        Field(description="The individual or organization for which a license was granted to", title="Licensee"),
+    ] = None
+    purchaser: Annotated[
+        Optional[Union[Purchaser2, Purchaser3]],
+        Field(description="The individual or organization that purchased the license", title="Purchaser"),
+    ] = None
+    purchaseOrder: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
+            ),
+            title="Purchase Order",
+        ),
+    ] = None
+    licenseTypes: Annotated[
+        Optional[List[LicenseType]],
+        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
+    ] = None
+    lastRenewal: Annotated[
+        Optional[datetime],
+        Field(
+            description=(
+                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
+                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
+                " when the license was last renewed."
+            ),
+            title="Last Renewal",
+        ),
+    ] = None
+    expiration: Annotated[
+        Optional[datetime],
+        Field(
+            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
+        ),
+    ] = None
+
+
+class License2(CycloneDXBaseModel):
+    """
+    Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    bom_ref: Annotated[
+        Optional[str],
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
+    ] = None
+    id: Annotated[
+        Optional[spdx.LicenseID],
+        Field(
+            description=(
+                "A valid SPDX license identifier. If specified, this value must be one of the enumeration of valid SPDX"
+                " license identifiers defined in the spdx.schema.json (or spdx.xml) subschema which is synchronized"
+                " with the official SPDX license list."
+            ),
+            examples=["Apache-2.0"],
+            title="License ID (SPDX)",
+        ),
+    ] = None
+    name: Annotated[
+        str,
+        Field(
+            description=(
+                "The name of the license. This may include the name of a commercial or proprietary license or an open"
+                " source license that may not be defined by SPDX."
+            ),
+            examples=["Acme Software License"],
+            title="License Name",
+        ),
+    ]
+    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
+    text: Annotated[
+        Optional[Attachment],
+        Field(description="An optional way to include the textual content of a license.", title="License text"),
+    ] = None
+    url: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
+                " completeness"
+            ),
+            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
+            title="License URL",
+        ),
+    ] = None
+    licensing: Annotated[
+        Optional[Licensing1],
+        Field(
+            description=(
+                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
+                " other important metadata"
+            ),
+            title="Licensing information",
+        ),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class LicenseChoice1(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    license: Annotated[
+        Union[License1, License2],
+        Field(
+            description=(
+                "Specifies the details and attributes related to a software license. It can either include a valid SPDX"
+                " license identifier or a named license, along with additional properties such as license"
+                " acknowledgment, comprehensive commercial licensing information, and the full text of the license."
+            ),
+            title="License",
+        ),
+    ]
+
+
+class Commit(CycloneDXBaseModel):
+    """
+    Specifies an individual commit
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    uid: Annotated[
+        Optional[str],
+        Field(
+            description=(
                 "A unique identifier of the commit. This may be version control specific. For example, Subversion uses"
                 " revision numbers whereas git uses commit hashes."
             ),
@@ -2618,9 +3029,9 @@ class ComponentEvidence(CycloneDXBaseModel):
         Optional[Union[List[ComponentIdentityEvidence], ComponentIdentityEvidence]],
         Field(
             description=(
-                "Evidence that substantiates the identity of a component. The identify may be an object or an array of"
-                " identity objects. Support for specifying identify as a single object was introduced in CycloneDX"
-                " v1.5. Arrays were introduced in v1.6. It is RECOMMENDED that all implementations use arrays, even if"
+                "Evidence that substantiates the identity of a component. The identity may be an object or an array of"
+                " identity objects. Support for specifying identity as a single object was introduced in CycloneDX"
+                " v1.5. Arrays were introduced in v1.6. It is recommended that all implementations use arrays, even if"
                 " only one identity object is specified."
             ),
             title="Identity Evidence",
@@ -2735,7 +3146,7 @@ class ReleaseNotes(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -2797,12 +3208,132 @@ class Credits(CycloneDXBaseModel):
     ] = None
 
 
-class DataGovernanceResponsibleParty(CycloneDXBaseModel):
+class Versions(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[Optional[OrganizationalEntity], Field(title="Organization")] = None
-    contact: Annotated[Optional[OrganizationalContact], Field(title="Individual")] = None
+    version: Annotated[
+        str,
+        Field(
+            description="A single version of a component or service.",
+            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
+            max_length=1024,
+            title="Version",
+        ),
+    ]
+    range: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "A version range specified in Package URL Version Range syntax (vers) which is defined at"
+                " https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst"
+            ),
+            examples=[
+                "vers:cargo/9.0.14",
+                "vers:npm/1.2.3|>=2.0.0|<5.0.0",
+                "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1",
+                "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1",
+                "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0",
+            ],
+            max_length=4096,
+            min_length=1,
+            title="Version Range",
+        ),
+    ] = None
+    status: Annotated[
+        Optional[AffectedStatus],
+        Field(description="The vulnerability status for the version or range of versions.", title="Status"),
+    ] = AffectedStatus.affected
+
+
+class Versions1(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    version: Annotated[
+        Optional[str],
+        Field(
+            description="A single version of a component or service.",
+            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
+            max_length=1024,
+            title="Version",
+        ),
+    ] = None
+    range: Annotated[
+        str,
+        Field(
+            description=(
+                "A version range specified in Package URL Version Range syntax (vers) which is defined at"
+                " https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst"
+            ),
+            examples=[
+                "vers:cargo/9.0.14",
+                "vers:npm/1.2.3|>=2.0.0|<5.0.0",
+                "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1",
+                "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1",
+                "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0",
+            ],
+            max_length=4096,
+            min_length=1,
+            title="Version Range",
+        ),
+    ]
+    status: Annotated[
+        Optional[AffectedStatus],
+        Field(description="The vulnerability status for the version or range of versions.", title="Status"),
+    ] = AffectedStatus.affected
+
+
+class Affect(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    ref: Annotated[
+        Union[RefLinkType, BomLinkElementType],
+        Field(description="References a component or service by the objects bom-ref", title="Reference"),
+    ]
+    versions: Annotated[
+        Optional[List[Union[Versions, Versions1]]],
+        Field(description="Zero or more individual versions or range of versions.", title="Versions"),
+    ] = None
+
+
+class DataGovernanceResponsibleParty1(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        OrganizationalEntity,
+        Field(
+            description="The organization that is responsible for specific data governance role(s).",
+            title="Organization",
+        ),
+    ]
+    contact: Annotated[
+        Optional[OrganizationalContact],
+        Field(
+            description="The individual that is responsible for specific data governance role(s).", title="Individual"
+        ),
+    ] = None
+
+
+class DataGovernanceResponsibleParty2(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity],
+        Field(
+            description="The organization that is responsible for specific data governance role(s).",
+            title="Organization",
+        ),
+    ] = None
+    contact: Annotated[
+        OrganizationalContact,
+        Field(
+            description="The individual that is responsible for specific data governance role(s).", title="Individual"
+        ),
+    ]
 
 
 class GraphicsCollection(CycloneDXBaseModel):
@@ -2835,7 +3366,7 @@ class EnergyProvider(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the energy provider elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -2845,7 +3376,9 @@ class EnergyProvider(CycloneDXBaseModel):
     description: Annotated[
         Optional[str], Field(description="A description of the energy provider.", title="Description")
     ] = None
-    organization: Annotated[OrganizationalEntity, Field(title="Organization")]
+    organization: Annotated[
+        OrganizationalEntity, Field(description="The organization that provides energy.", title="Organization")
+    ]
     energySource: Annotated[
         EnergySource, Field(description="The energy source for the energy provider.", title="Energy Source")
     ]
@@ -2882,10 +3415,23 @@ class Step(CycloneDXBaseModel):
         Optional[List[Command]],
         Field(description="Ordered list of commands or directives for the step", title="Commands"),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
-class ResourceReferenceChoice(CycloneDXBaseModel):
+class ResourceReferenceChoice1(CycloneDXBaseModel):
     """
     A reference to a locally defined resource (e.g., a bom-ref) or an externally accessible resource.
     """
@@ -2894,15 +3440,33 @@ class ResourceReferenceChoice(CycloneDXBaseModel):
         extra = Extra.forbid
 
     ref: Annotated[
-        Optional[Union[RefLinkType, BomLinkElementType]],
+        Union[RefLinkType, BomLinkElementType],
         Field(description="References an object by its bom-ref attribute", title="BOM Reference"),
-    ] = None
+    ]
     externalReference: Annotated[
         Optional[ExternalReference],
         Field(description="Reference to an externally accessible resource.", title="External reference"),
     ] = None
 
 
+class ResourceReferenceChoice2(CycloneDXBaseModel):
+    """
+    A reference to a locally defined resource (e.g., a bom-ref) or an externally accessible resource.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    ref: Annotated[
+        Optional[Union[RefLinkType, BomLinkElementType]],
+        Field(description="References an object by its bom-ref attribute", title="BOM Reference"),
+    ] = None
+    externalReference: Annotated[
+        ExternalReference,
+        Field(description="Reference to an externally accessible resource.", title="External reference"),
+    ]
+
+
 class Requirement(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
@@ -2913,7 +3477,7 @@ class Requirement(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -2942,7 +3506,7 @@ class Requirement(CycloneDXBaseModel):
         ),
     ] = None
     openCre: Annotated[
-        Optional[List[OpenCre]],
+        Optional[List[str]],
         Field(
             description=(
                 "The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized"
@@ -2950,6 +3514,7 @@ class Requirement(CycloneDXBaseModel):
                 " shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to"
                 " each other. Use of CRE promotes clear and unambiguous communication among stakeholders."
             ),
+            regex="^CRE:[0-9]+-[0-9]+$",
             title="OWASP OpenCRE Identifier(s)",
         ),
     ] = None
@@ -2973,7 +3538,7 @@ class Requirement(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -2995,7 +3560,7 @@ class Signer(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    algorithm: Union[AlgorithmEnum, AnyUrl]
+    algorithm: Union[Algorithm, AnyUrl]
     keyId: Annotated[
         Optional[str],
         Field(description="Optional. Application specific string identifying the signature key.", title="Key ID"),
@@ -3046,7 +3611,7 @@ class RelatedCryptoMaterialProperties(CycloneDXBaseModel):
         extra = Extra.forbid
 
     type: Annotated[
-        Optional[Type8],
+        Optional[Type10],
         Field(description="The type for the related cryptographic material", title="relatedCryptoMaterialType"),
     ] = None
     id: Annotated[
@@ -3110,30 +3675,34 @@ class RelatedCryptoMaterialProperties(CycloneDXBaseModel):
 
 class Ikev2TransformTypes(CycloneDXBaseModel):
     """
-    The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, and additional properties.
+    The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties.
     """
 
     class Config:
         extra = Extra.forbid
 
     encr: Annotated[
-        Optional[List[RefType]],
-        Field(description="Transform Type 1: encryption algorithms", title="Encryption Algorithm (ENCR)"),
+        Optional[List[str]],
+        Field(description="Transform Type 1: encryption algorithms", min_length=1, title="Encryption Algorithm (ENCR)"),
     ] = None
     prf: Annotated[
-        Optional[List[RefType]],
-        Field(description="Transform Type 2: pseudorandom functions", title="Pseudorandom Function (PRF)"),
+        Optional[List[str]],
+        Field(
+            description="Transform Type 2: pseudorandom functions", min_length=1, title="Pseudorandom Function (PRF)"
+        ),
     ] = None
     integ: Annotated[
-        Optional[List[RefType]],
-        Field(description="Transform Type 3: integrity algorithms", title="Integrity Algorithm (INTEG)"),
+        Optional[List[str]],
+        Field(description="Transform Type 3: integrity algorithms", min_length=1, title="Integrity Algorithm (INTEG)"),
     ] = None
     ke: Annotated[
-        Optional[List[RefType]],
+        Optional[List[str]],
         Field(
             description=(
-                "Transform Type 4: Key Exchange Method (KE) per RFC9370, formerly called Diffie-Hellman Group (D-H)"
+                "Transform Type 4: Key Exchange Method (KE) per [RFC 9370](https://www.ietf.org/rfc/rfc9370.html),"
+                " formerly called Diffie-Hellman Group (D-H)."
             ),
+            min_length=1,
             title="Key Exchange Method (KE)",
         ),
     ] = None
@@ -3145,7 +3714,8 @@ class Ikev2TransformTypes(CycloneDXBaseModel):
         ),
     ] = None
     auth: Annotated[
-        Optional[List[RefType]], Field(description="IKEv2 Authentication method", title="IKEv2 Authentication method")
+        Optional[List[str]],
+        Field(description="IKEv2 Authentication method", min_length=1, title="IKEv2 Authentication method"),
     ] = None
 
 
@@ -3157,7 +3727,7 @@ class ProtocolProperties(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    type: Annotated[Optional[Type9], Field(description="The concrete protocol type.", title="Type")] = None
+    type: Annotated[Optional[Type11], Field(description="The concrete protocol type.", title="Type")] = None
     version: Annotated[
         Optional[str],
         Field(description="The version of the protocol.", examples=["1.0", "1.2", "1.99"], title="Protocol Version"),
@@ -3170,15 +3740,19 @@ class ProtocolProperties(CycloneDXBaseModel):
         Optional[Ikev2TransformTypes],
         Field(
             description=(
-                "The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, and additional"
-                " properties."
+                "The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section"
+                " 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties."
             ),
             title="IKEv2 Transform Types",
         ),
     ] = None
     cryptoRefArray: Annotated[
-        Optional[List[RefType]],
-        Field(description="A list of protocol-related cryptographic assets", title="Cryptographic References"),
+        Optional[List[str]],
+        Field(
+            description="A list of protocol-related cryptographic assets",
+            min_length=1,
+            title="Cryptographic References",
+        ),
     ] = None
 
 
@@ -3245,7 +3819,7 @@ class Assessor(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -3333,21 +3907,21 @@ class DataGovernance(CycloneDXBaseModel):
         extra = Extra.forbid
 
     custodians: Annotated[
-        Optional[List[DataGovernanceResponsibleParty]],
+        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
         Field(
             description="Data custodians are responsible for the safe custody, transport, and storage of data.",
             title="Data Custodians",
         ),
     ] = None
     stewards: Annotated[
-        Optional[List[DataGovernanceResponsibleParty]],
+        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
         Field(
             description="Data stewards are responsible for data content, context, and associated business rules.",
             title="Data Stewards",
         ),
     ] = None
     owners: Annotated[
-        Optional[List[DataGovernanceResponsibleParty]],
+        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
         Field(description="Data owners are concerned with risk and appropriate access to data.", title="Data Owners"),
     ] = None
 
@@ -3393,7 +3967,20 @@ class EnergyConsumption(CycloneDXBaseModel):
         Optional[Co2Measure],
         Field(description="The CO2 offset (credit) for the CO2 equivalent cost.", title="CO2 Cost Offset"),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Workspace(CycloneDXBaseModel):
@@ -3410,7 +3997,7 @@ class Workspace(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the workspace elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -3432,93 +4019,341 @@ class Workspace(CycloneDXBaseModel):
                 "The names for the workspace as referenced by other workflow tasks. Effectively, a name mapping so"
                 " other tasks can use their own local name in their steps."
             ),
-            title="Aliases",
+            title="Aliases",
+        ),
+    ] = None
+    description: Annotated[
+        Optional[str], Field(description="A description of the resource instance.", title="Description")
+    ] = None
+    resourceReferences: Annotated[
+        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
+        Field(
+            description="References to component or service resources that are used to realize the resource instance.",
+            title="Resource references",
+        ),
+    ] = None
+    accessMode: Annotated[
+        Optional[AccessMode],
+        Field(
+            description=(
+                "Describes the read-write access control for the workspace relative to the owning resource instance."
+            ),
+            title="Access mode",
+        ),
+    ] = None
+    mountPath: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "A path to a location on disk where the workspace will be available to the associated task's steps."
+            ),
+            title="Mount path",
+        ),
+    ] = None
+    managedDataType: Annotated[
+        Optional[str],
+        Field(
+            description="The name of a domain-specific data type the workspace represents.",
+            examples=["ConfigMap", "Secret"],
+            title="Managed data type",
+        ),
+    ] = None
+    volumeRequest: Annotated[
+        Optional[str],
+        Field(
+            description="Identifies the reference to the request for a specific volume type and parameters.",
+            examples=["a kubernetes Persistent Volume Claim (PVC) name"],
+            title="Volume request",
+        ),
+    ] = None
+    volume: Annotated[
+        Optional[Volume],
+        Field(
+            description="Information about the actual volume instance allocated to the workspace.",
+            examples=["see https://kubernetes.io/docs/concepts/storage/persistent-volumes/"],
+            title="Volume",
+        ),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class Event(CycloneDXBaseModel):
+    """
+    Represents something that happened that may trigger a response.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    uid: Annotated[
+        Optional[str], Field(description="The unique identifier of the event.", title="Unique Identifier (UID)")
+    ] = None
+    description: Annotated[Optional[str], Field(description="A description of the event.", title="Description")] = None
+    timeReceived: Annotated[
+        Optional[datetime],
+        Field(description="The date and time (timestamp) when the event was received.", title="Time Received"),
+    ] = None
+    data: Annotated[Optional[Attachment], Field(description="Encoding of the raw event data.", title="Data")] = None
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(description="References the component or service that was the source of the event", title="Source"),
+    ] = None
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(description="References the component or service that was the target of the event", title="Target"),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class InputType1(CycloneDXBaseModel):
+    """
+    Type that represents various input data types and formats.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "A reference to the component or service that provided the input to the task (e.g., reference to a"
+                " service with data flow value of `inbound`)"
+            ),
+            examples=["source code repository", "database"],
+            title="Source",
+        ),
+    ] = None
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "A reference to the component or service that received or stored the input if not the task itself"
+                " (e.g., a local, named storage workspace)"
+            ),
+            examples=["workspace", "directory"],
+            title="Target",
+        ),
+    ] = None
+    resource: Annotated[
+        Union[ResourceReferenceChoice1, ResourceReferenceChoice2],
+        Field(
+            description=(
+                "A reference to an independent resource provided as an input to a task by the workflow runtime."
+            ),
+            examples=[
+                "a reference to a configuration file in a repository (i.e., a bom-ref)",
+                "a reference to a scanning service used in a task (i.e., a bom-ref)",
+            ],
+            title="Resource",
+        ),
+    ]
+    parameters: Annotated[
+        Optional[List[Parameter]],
+        Field(
+            description="Inputs that have the form of parameters with names and values.",
+            title="Parameters",
+        ),
+    ] = None
+    environmentVars: Annotated[
+        Optional[List[Union[Property, str]]],
+        Field(
+            description="Inputs that have the form of parameters with names and values.",
+            title="Environment variables",
+        ),
+    ] = None
+    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class InputType2(CycloneDXBaseModel):
+    """
+    Type that represents various input data types and formats.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "A reference to the component or service that provided the input to the task (e.g., reference to a"
+                " service with data flow value of `inbound`)"
+            ),
+            examples=["source code repository", "database"],
+            title="Source",
+        ),
+    ] = None
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "A reference to the component or service that received or stored the input if not the task itself"
+                " (e.g., a local, named storage workspace)"
+            ),
+            examples=["workspace", "directory"],
+            title="Target",
+        ),
+    ] = None
+    resource: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "A reference to an independent resource provided as an input to a task by the workflow runtime."
+            ),
+            examples=[
+                "a reference to a configuration file in a repository (i.e., a bom-ref)",
+                "a reference to a scanning service used in a task (i.e., a bom-ref)",
+            ],
+            title="Resource",
+        ),
+    ] = None
+    parameters: Annotated[
+        List[Parameter],
+        Field(
+            description="Inputs that have the form of parameters with names and values.",
+            title="Parameters",
+        ),
+    ]
+    environmentVars: Annotated[
+        Optional[List[Union[Property, str]]],
+        Field(
+            description="Inputs that have the form of parameters with names and values.",
+            title="Environment variables",
+        ),
+    ] = None
+    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
         ),
     ] = None
-    description: Annotated[
-        Optional[str], Field(description="A description of the resource instance.", title="Description")
-    ] = None
-    resourceReferences: Annotated[
-        Optional[List[ResourceReferenceChoice]],
+
+
+class InputType3(CycloneDXBaseModel):
+    """
+    Type that represents various input data types and formats.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
-            description="References to component or service resources that are used to realize the resource instance.",
-            title="Resource references",
+            description=(
+                "A reference to the component or service that provided the input to the task (e.g., reference to a"
+                " service with data flow value of `inbound`)"
+            ),
+            examples=["source code repository", "database"],
+            title="Source",
         ),
     ] = None
-    accessMode: Annotated[
-        Optional[AccessMode],
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
-                "Describes the read-write access control for the workspace relative to the owning resource instance."
+                "A reference to the component or service that received or stored the input if not the task itself"
+                " (e.g., a local, named storage workspace)"
             ),
-            title="Access mode",
+            examples=["workspace", "directory"],
+            title="Target",
         ),
     ] = None
-    mountPath: Annotated[
-        Optional[str],
+    resource: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
-                "A path to a location on disk where the workspace will be available to the associated task's steps."
+                "A reference to an independent resource provided as an input to a task by the workflow runtime."
             ),
-            title="Mount path",
+            examples=[
+                "a reference to a configuration file in a repository (i.e., a bom-ref)",
+                "a reference to a scanning service used in a task (i.e., a bom-ref)",
+            ],
+            title="Resource",
         ),
     ] = None
-    managedDataType: Annotated[
-        Optional[str],
+    parameters: Annotated[
+        Optional[List[Parameter]],
         Field(
-            description="The name of a domain-specific data type the workspace represents.",
-            examples=["ConfigMap", "Secret"],
-            title="Managed data type",
+            description="Inputs that have the form of parameters with names and values.",
+            title="Parameters",
         ),
     ] = None
-    volumeRequest: Annotated[
-        Optional[str],
+    environmentVars: Annotated[
+        List[Union[Property, str]],
         Field(
-            description="Identifies the reference to the request for a specific volume type and parameters.",
-            examples=["a kubernetes Persistent Volume Claim (PVC) name"],
-            title="Volume request",
+            description="Inputs that have the form of parameters with names and values.",
+            title="Environment variables",
         ),
-    ] = None
-    volume: Annotated[
-        Optional[Volume],
+    ]
+    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
+    properties: Annotated[
+        Optional[List[Property]],
         Field(
-            description="Information about the actual volume instance allocated to the workspace.",
-            examples=["see https://kubernetes.io/docs/concepts/storage/persistent-volumes/"],
-            title="Volume",
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
-
-
-class Event(CycloneDXBaseModel):
-    """
-    Represents something that happened that may trigger a response.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    uid: Annotated[
-        Optional[str], Field(description="The unique identifier of the event.", title="Unique Identifier (UID)")
-    ] = None
-    description: Annotated[Optional[str], Field(description="A description of the event.", title="Description")] = None
-    timeReceived: Annotated[
-        Optional[datetime],
-        Field(description="The date and time (timestamp) when the event was received.", title="Time Received"),
-    ] = None
-    data: Annotated[Optional[Attachment], Field(description="Encoding of the raw event data.", title="Data")] = None
-    source: Annotated[
-        Optional[ResourceReferenceChoice],
-        Field(description="References the component or service that was the source of the event", title="Source"),
-    ] = None
-    target: Annotated[
-        Optional[ResourceReferenceChoice],
-        Field(description="References the component or service that was the target of the event", title="Target"),
-    ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
-class InputType(CycloneDXBaseModel):
+class InputType4(CycloneDXBaseModel):
     """
     Type that represents various input data types and formats.
     """
@@ -3527,7 +4362,7 @@ class InputType(CycloneDXBaseModel):
         extra = Extra.forbid
 
     source: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
                 "A reference to the component or service that provided the input to the task (e.g., reference to a"
@@ -3538,7 +4373,7 @@ class InputType(CycloneDXBaseModel):
         ),
     ] = None
     target: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
                 "A reference to the component or service that received or stored the input if not the task itself"
@@ -3549,7 +4384,7 @@ class InputType(CycloneDXBaseModel):
         ),
     ] = None
     resource: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
                 "A reference to an independent resource provided as an input to a task by the workflow runtime."
@@ -3575,24 +4410,92 @@ class InputType(CycloneDXBaseModel):
             title="Environment variables",
         ),
     ] = None
-    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    data: Annotated[Attachment, Field(description="Inputs that have the form of data.", title="Data")]
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class OutputType1(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description="Component or service that generated or provided the output from the task (e.g., a build tool)",
+            title="Source",
+        ),
+    ] = None
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "Component or service that received the output from the task (e.g., reference to an artifactory service"
+                " with data flow value of `outbound`)"
+            ),
+            examples=["a log file described as an `externalReference` within its target domain."],
+            title="Target",
+        ),
+    ] = None
+    resource: Annotated[
+        Union[ResourceReferenceChoice1, ResourceReferenceChoice2],
+        Field(
+            description="A reference to an independent resource generated as output by the task.",
+            examples=["configuration file", "source code", "scanning service"],
+            title="Resource",
+        ),
+    ]
+    data: Annotated[Optional[Attachment], Field(description="Outputs that have the form of data.", title="Data")] = None
+    environmentVars: Annotated[
+        Optional[List[Union[Property, str]]],
+        Field(
+            description="Outputs that have the form of environment variables.",
+            title="Environment variables",
+        ),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
-class OutputType(CycloneDXBaseModel):
+class OutputType2(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
     type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
     source: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description="Component or service that generated or provided the output from the task (e.g., a build tool)",
             title="Source",
         ),
     ] = None
     target: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description=(
                 "Component or service that received the output from the task (e.g., reference to an artifactory service"
@@ -3603,7 +4506,7 @@ class OutputType(CycloneDXBaseModel):
         ),
     ] = None
     resource: Annotated[
-        Optional[ResourceReferenceChoice],
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
         Field(
             description="A reference to an independent resource generated as output by the task.",
             examples=["configuration file", "source code", "scanning service"],
@@ -3611,6 +4514,61 @@ class OutputType(CycloneDXBaseModel):
         ),
     ] = None
     data: Annotated[Optional[Attachment], Field(description="Outputs that have the form of data.", title="Data")] = None
+    environmentVars: Annotated[
+        List[Union[Property, str]],
+        Field(
+            description="Outputs that have the form of environment variables.",
+            title="Environment variables",
+        ),
+    ]
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
+
+
+class OutputType3(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
+    source: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description="Component or service that generated or provided the output from the task (e.g., a build tool)",
+            title="Source",
+        ),
+    ] = None
+    target: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description=(
+                "Component or service that received the output from the task (e.g., reference to an artifactory service"
+                " with data flow value of `outbound`)"
+            ),
+            examples=["a log file described as an `externalReference` within its target domain."],
+            title="Target",
+        ),
+    ] = None
+    resource: Annotated[
+        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Field(
+            description="A reference to an independent resource generated as output by the task.",
+            examples=["configuration file", "source code", "scanning service"],
+            title="Resource",
+        ),
+    ] = None
+    data: Annotated[Attachment, Field(description="Outputs that have the form of data.", title="Data")]
     environmentVars: Annotated[
         Optional[List[Union[Property, str]]],
         Field(
@@ -3618,7 +4576,20 @@ class OutputType(CycloneDXBaseModel):
             title="Environment variables",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Signature1(CycloneDXBaseModel):
@@ -3730,7 +4701,7 @@ class ComponentData(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the dataset elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -3793,7 +4764,20 @@ class EnvironmentalConsiderations(CycloneDXBaseModel):
             title="Energy Consumptions",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Trigger(CycloneDXBaseModel):
@@ -3810,7 +4794,7 @@ class Trigger(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the trigger elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -3829,7 +4813,7 @@ class Trigger(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[ResourceReferenceChoice]],
+        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -3845,6 +4829,7 @@ class Trigger(CycloneDXBaseModel):
     conditions: Annotated[
         Optional[List[Condition]],
         Field(
+            description="A list of conditions used to determine if a trigger should be activated.",
             title="Conditions",
         ),
     ] = None
@@ -3853,7 +4838,7 @@ class Trigger(CycloneDXBaseModel):
         Field(description="The date and time (timestamp) when the trigger was activated.", title="Time activated"),
     ] = None
     inputs: Annotated[
-        Optional[List[InputType]],
+        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -3861,14 +4846,27 @@ class Trigger(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[OutputType]],
+        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
             examples=["a log file or metrics data produced by the task"],
             title="Outputs",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Attestation(CycloneDXBaseModel):
@@ -3914,7 +4912,7 @@ class Claim(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -3935,12 +4933,13 @@ class Claim(CycloneDXBaseModel):
         Optional[str], Field(description="The specific statement or assertion about the target.", title="Predicate")
     ] = None
     mitigationStrategies: Annotated[
-        Optional[List[RefLinkType]],
+        Optional[List[str]],
         Field(
             description=(
                 "The list of  `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation"
                 " strategy should include an explanation of how any weaknesses in the evidence will be mitigated."
             ),
+            min_length=1,
             title="Mitigation Strategies",
         ),
     ] = None
@@ -3952,13 +4951,17 @@ class Claim(CycloneDXBaseModel):
         ),
     ] = None
     evidence: Annotated[
-        Optional[List[RefLinkType]],
-        Field(description="The list of `bom-ref` to evidence that supports this claim.", title="Evidence"),
+        Optional[List[str]],
+        Field(
+            description="The list of `bom-ref` to evidence that supports this claim.", min_length=1, title="Evidence"
+        ),
     ] = None
     counterEvidence: Annotated[
-        Optional[List[RefLinkType]],
+        Optional[List[str]],
         Field(
-            description="The list of `bom-ref` to counterEvidence that supports this claim.", title="Counter Evidence"
+            description="The list of `bom-ref` to counterEvidence that supports this claim.",
+            min_length=1,
+            title="Counter Evidence",
         ),
     ] = None
     externalReferences: Annotated[
@@ -3994,7 +4997,7 @@ class Evidence(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -4047,7 +5050,79 @@ class Evidence(CycloneDXBaseModel):
     ] = None
 
 
+class Signatories(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    name: Annotated[Optional[str], Field(description="The signatory's name.", title="Name")] = None
+    role: Annotated[
+        Optional[str], Field(description="The signatory's role within an organization.", title="Role")
+    ] = None
+    signature: Annotated[
+        Union[Signature1, Signature2, Signer],
+        Field(
+            description=(
+                "Enveloped signature in [JSON Signature Format"
+                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
+            ),
+            title="Signature",
+        ),
+    ]
+    organization: Annotated[
+        Optional[OrganizationalEntity], Field(description="The signatory's organization.", title="Organization")
+    ] = None
+    externalReference: Annotated[
+        Optional[ExternalReference],
+        Field(
+            description=(
+                "External references provide a way to document systems, sites, and information that may be relevant but"
+                " are not included with the BOM. They may also establish specific relationships within or external to"
+                " the BOM."
+            ),
+            title="External Reference",
+        ),
+    ] = None
+
+
+class Signatories1(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    name: Annotated[Optional[str], Field(description="The signatory's name.", title="Name")] = None
+    role: Annotated[
+        Optional[str], Field(description="The signatory's role within an organization.", title="Role")
+    ] = None
+    signature: Annotated[
+        Optional[Union[Signature1, Signature2, Signer]],
+        Field(
+            description=(
+                "Enveloped signature in [JSON Signature Format"
+                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
+            ),
+            title="Signature",
+        ),
+    ] = None
+    organization: Annotated[
+        OrganizationalEntity, Field(description="The signatory's organization.", title="Organization")
+    ]
+    externalReference: Annotated[
+        ExternalReference,
+        Field(
+            description=(
+                "External references provide a way to document systems, sites, and information that may be relevant but"
+                " are not included with the BOM. They may also establish specific relationships within or external to"
+                " the BOM."
+            ),
+            title="External Reference",
+        ),
+    ]
+
+
 class Affirmation(CycloneDXBaseModel):
+    """
+    A concise statement affirmed by an individual regarding all declarations, often used for third-party auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who assert the validity of the document on behalf of the organization.
+    """
+
     class Config:
         extra = Extra.forbid
 
@@ -4063,7 +5138,7 @@ class Affirmation(CycloneDXBaseModel):
         ),
     ] = None
     signatories: Annotated[
-        Optional[List],
+        Optional[List[Union[Signatories, Signatories1]]],
         Field(
             description=(
                 "The list of signatories authorized on behalf of an organization to assert validity of this document."
@@ -4093,7 +5168,7 @@ class Service(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4186,7 +5261,7 @@ class Service(CycloneDXBaseModel):
             description=(
                 "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)"
             ),
-            title="Component License(s)",
+            title="Service License(s)",
         ),
     ] = None
     externalReferences: Annotated[
@@ -4222,7 +5297,7 @@ class Service(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -4260,7 +5335,7 @@ class Compositions(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the composition elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4315,53 +5390,6 @@ class Compositions(CycloneDXBaseModel):
     ] = None
 
 
-class Annotations(CycloneDXBaseModel):
-    """
-    A comment, note, explanation, or similar textual content which provides additional context to the object(s) being annotated.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the annotation elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
-                " avoid conflicts with BOM-Links."
-            ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ] = None
-    subjects: Annotated[
-        List[Union[RefLinkType, BomLinkElementType]],
-        Field(
-            description=(
-                "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any"
-                " object type supporting bom-refs."
-            ),
-            title="Subjects",
-        ),
-    ]
-    timestamp: Annotated[
-        datetime, Field(description="The date and time (timestamp) when the annotation was created.", title="Timestamp")
-    ]
-    text: Annotated[str, Field(description="The textual content of the annotation.", title="Text")]
-    signature: Annotated[
-        Optional[Union[Signature1, Signature2, Signer]],
-        Field(
-            description=(
-                "Enveloped signature in [JSON Signature Format"
-                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
-            ),
-            title="Signature",
-        ),
-    ] = None
-
-
 class ModelParameters(CycloneDXBaseModel):
     """
     Hyper-parameters for construction of the model.
@@ -4402,7 +5430,7 @@ class ModelParameters(CycloneDXBaseModel):
         ),
     ] = None
     datasets: Annotated[
-        Optional[List[Union[ComponentData, Dataset]]],
+        Optional[List[Union[ComponentData, Datasets]]],
         Field(description="The datasets used to train and evaluate the model.", title="Datasets"),
     ] = None
     inputs: Annotated[
@@ -4476,7 +5504,7 @@ class Considerations(CycloneDXBaseModel):
 
 class ModelCard(CycloneDXBaseModel):
     """
-    A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and MUST NOT be specified for other component types.
+    A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.
     """
 
     class Config:
@@ -4488,7 +5516,7 @@ class ModelCard(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the model card elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4522,7 +5550,7 @@ class ModelCard(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -4543,7 +5571,7 @@ class Task(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the task elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4562,7 +5590,7 @@ class Task(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[ResourceReferenceChoice]],
+        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -4585,7 +5613,7 @@ class Task(CycloneDXBaseModel):
         ),
     ] = None
     inputs: Annotated[
-        Optional[List[InputType]],
+        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -4593,7 +5621,7 @@ class Task(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[OutputType]],
+        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
             examples=["a log file or metrics data produced by the task"],
@@ -4621,7 +5649,20 @@ class Task(CycloneDXBaseModel):
             title="Runtime topology",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Standard(CycloneDXBaseModel):
@@ -4638,7 +5679,7 @@ class Standard(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM."
+                " must be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -4730,7 +5771,7 @@ class Workflow(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the workflow elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4749,7 +5790,7 @@ class Workflow(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[ResourceReferenceChoice]],
+        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -4786,7 +5827,7 @@ class Workflow(CycloneDXBaseModel):
         ),
     ] = None
     inputs: Annotated[
-        Optional[List[InputType]],
+        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -4794,7 +5835,7 @@ class Workflow(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[OutputType]],
+        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
             examples=["a log file or metrics data produced by the task"],
@@ -4822,7 +5863,20 @@ class Workflow(CycloneDXBaseModel):
             title="Runtime topology",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 class Targets(CycloneDXBaseModel):
@@ -4877,7 +5931,17 @@ class Declarations(CycloneDXBaseModel):
     targets: Annotated[
         Optional[Targets], Field(description="The list of targets which claims are made against.", title="Targets")
     ] = None
-    affirmation: Annotated[Optional[Affirmation], Field(title="Affirmation")] = None
+    affirmation: Annotated[
+        Optional[Affirmation],
+        Field(
+            description=(
+                "A concise statement affirmed by an individual regarding all declarations, often used for third-party"
+                " auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who"
+                " assert the validity of the document on behalf of the organization."
+            ),
+            title="Affirmation",
+        ),
+    ] = None
     signature: Annotated[
         Optional[Union[Signature1, Signature2, Signer]],
         Field(
@@ -4900,7 +5964,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         Field(
             description=(
                 "Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOMs do not have a"
-                ' filename convention, nor does JSON schema support namespaces. This value MUST be "CycloneDX".'
+                ' filename convention, nor does JSON schema support namespaces. This value must be "CycloneDX".'
             ),
             title="BOM Format",
         ),
@@ -4909,7 +5973,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         str,
         Field(
             description="The version of the CycloneDX specification the BOM conforms to.",
-            examples=["1.6"],
+            examples=["1.6.1"],
             title="CycloneDX Specification Version",
         ),
     ]
@@ -4918,8 +5982,8 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         Field(
             description=(
                 "Every BOM generated SHOULD have a unique serial number, even if the contents of the BOM have not"
-                " changed over time. If specified, the serial number MUST conform to RFC-4122. Use of serial numbers is"
-                " RECOMMENDED."
+                " changed over time. If specified, the serial number must conform to [RFC"
+                " 4122](https://www.ietf.org/rfc/rfc4122.html). Use of serial numbers is recommended."
             ),
             examples=["urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"],
             regex="^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
@@ -5045,7 +6109,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -5062,7 +6126,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
     ] = None
 
 
-class ToolModel(CycloneDXBaseModel):
+class Tools(CycloneDXBaseModel):
     """
     The tool(s) used in the creation, enrichment, and validation of the BOM.
     """
@@ -5098,7 +6162,7 @@ class Metadata(CycloneDXBaseModel):
         Field(description="The date and time (timestamp) when the BOM was created.", title="Timestamp"),
     ] = None
     lifecycles: Annotated[
-        Optional[List[Union[Lifecycle, Lifecycle1]]],
+        Optional[List[Union[Lifecycles, Lifecycles1]]],
         Field(
             description=(
                 "Lifecycles communicate the stage(s) in which data in the BOM was captured. Different types of data may"
@@ -5110,7 +6174,7 @@ class Metadata(CycloneDXBaseModel):
         ),
     ] = None
     tools: Annotated[
-        Optional[Union[ToolModel, List[Tool]]],
+        Optional[Union[Tools, List[Tool]]],
         Field(description="The tool(s) used in the creation, enrichment, and validation of the BOM.", title="Tools"),
     ] = None
     manufacturer: Annotated[
@@ -5175,7 +6239,7 @@ class Metadata(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -5289,7 +6353,7 @@ class Component(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the component elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5432,7 +6496,7 @@ class Component(CycloneDXBaseModel):
         Optional[str],
         Field(
             description=(
-                "Asserts the identity of the component using package-url (purl). The purl, if specified, MUST be valid"
+                "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid"
                 " and conform to the specification defined at:"
                 " [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to"
                 " `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
@@ -5446,7 +6510,7 @@ class Component(CycloneDXBaseModel):
         Optional[List[str]],
         Field(
             description=(
-                "Asserts the identity of the component using the OmniBOR Artifact ID. The OmniBOR, if specified, MUST"
+                "Asserts the identity of the component using the OmniBOR Artifact ID. The OmniBOR, if specified, must"
                 " be valid and conform to the specification defined at:"
                 " [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)."
                 " Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
@@ -5464,13 +6528,13 @@ class Component(CycloneDXBaseModel):
         Field(
             description=(
                 "Asserts the identity of the component using the Software Heritage persistent identifier (SWHID). The"
-                " SWHID, if specified, MUST be valid and conform to the specification defined at:"
+                " SWHID, if specified, must be valid and conform to the specification defined at:"
                 " [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html)."
                 " Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
                 " component's identity."
             ),
             examples=["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"],
-            title="SoftWare Heritage Identifier",
+            title="Software Heritage Identifier",
         ),
     ] = None
     swid: Annotated[
@@ -5547,7 +6611,7 @@ class Component(CycloneDXBaseModel):
         Optional[List[ComponentData]],
         Field(
             description=(
-                "This object SHOULD be specified for any component of type `data` and MUST NOT be specified for other"
+                "This object SHOULD be specified for any component of type `data` and must not be specified for other"
                 " component types."
             ),
             title="Data",
@@ -5563,7 +6627,7 @@ class Component(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
@@ -5591,7 +6655,7 @@ class Component(CycloneDXBaseModel):
     ] = None
 
 
-class Tool1(CycloneDXBaseModel):
+class Tools1(CycloneDXBaseModel):
     """
     The tool(s) used to identify, confirm, or score the vulnerability.
     """
@@ -5632,7 +6696,7 @@ class Vulnerability(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the vulnerability elsewhere in the BOM. Every"
-                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5666,10 +6730,11 @@ class Vulnerability(CycloneDXBaseModel):
         Optional[List[Rating]], Field(description="List of vulnerability ratings", title="Ratings")
     ] = None
     cwes: Annotated[
-        Optional[List[Cwe]],
+        Optional[List[int]],
         Field(
             description="List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.",
             examples=[399],
+            ge=1,
             title="CWEs",
         ),
     ] = None
@@ -5749,7 +6814,7 @@ class Vulnerability(CycloneDXBaseModel):
         ),
     ] = None
     tools: Annotated[
-        Optional[Union[Tool1, List[Tool]]],
+        Optional[Union[Tools1, List[Tool]]],
         Field(description="The tool(s) used to identify, confirm, or score the vulnerability.", title="Tools"),
     ] = None
     analysis: Annotated[
@@ -5774,13 +6839,143 @@ class Vulnerability(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
             ),
             title="Properties",
         ),
     ] = None
 
 
+class Annotator(CycloneDXBaseModel):
+    """
+    The organization, person, component, or service which created the textual content of the annotation.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[OrganizationalEntity, Field(description="The organization that created the annotation")]
+    individual: Annotated[
+        Optional[OrganizationalContact], Field(description="The person that created the annotation")
+    ] = None
+    component: Annotated[
+        Optional[Component], Field(description="The tool or component that created the annotation")
+    ] = None
+    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
+
+
+class Annotator1(CycloneDXBaseModel):
+    """
+    The organization, person, component, or service which created the textual content of the annotation.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
+    ] = None
+    individual: Annotated[OrganizationalContact, Field(description="The person that created the annotation")]
+    component: Annotated[
+        Optional[Component], Field(description="The tool or component that created the annotation")
+    ] = None
+    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
+
+
+class Annotator2(CycloneDXBaseModel):
+    """
+    The organization, person, component, or service which created the textual content of the annotation.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
+    ] = None
+    individual: Annotated[
+        Optional[OrganizationalContact], Field(description="The person that created the annotation")
+    ] = None
+    component: Annotated[Component, Field(description="The tool or component that created the annotation")]
+    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
+
+
+class Annotator3(CycloneDXBaseModel):
+    """
+    The organization, person, component, or service which created the textual content of the annotation.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    organization: Annotated[
+        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
+    ] = None
+    individual: Annotated[
+        Optional[OrganizationalContact], Field(description="The person that created the annotation")
+    ] = None
+    component: Annotated[
+        Optional[Component], Field(description="The tool or component that created the annotation")
+    ] = None
+    service: Annotated[Service, Field(description="The service that created the annotation")]
+
+
+class Annotations(CycloneDXBaseModel):
+    """
+    A comment, note, explanation, or similar textual content which provides additional context to the object(s) being annotated.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    bom_ref: Annotated[
+        Optional[str],
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the annotation elsewhere in the BOM. Every"
+                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " avoid conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
+    ] = None
+    subjects: Annotated[
+        List[Union[RefLinkType, BomLinkElementType]],
+        Field(
+            description=(
+                "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any"
+                " object type supporting bom-refs."
+            ),
+            title="Subjects",
+        ),
+    ]
+    annotator: Annotated[
+        Union[Annotator, Annotator1, Annotator2, Annotator3],
+        Field(
+            description=(
+                "The organization, person, component, or service which created the textual content of the annotation."
+            ),
+            title="Annotator",
+        ),
+    ]
+    timestamp: Annotated[
+        datetime, Field(description="The date and time (timestamp) when the annotation was created.", title="Timestamp")
+    ]
+    text: Annotated[str, Field(description="The textual content of the annotation.", title="Text")]
+    signature: Annotated[
+        Optional[Union[Signature1, Signature2, Signer]],
+        Field(
+            description=(
+                "Enveloped signature in [JSON Signature Format"
+                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
+            ),
+            title="Signature",
+        ),
+    ] = None
+
+
 class Formula(CycloneDXBaseModel):
     """
     Describes workflows and resources that captures rules and other aspects of how the associated BOM component or service was formed.
@@ -5795,7 +6990,7 @@ class Formula(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the formula elsewhere in the BOM. Every bom-ref"
-                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5830,12 +7025,25 @@ class Formula(CycloneDXBaseModel):
             title="Workflows",
         ),
     ] = None
-    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
 
 Service.update_forward_refs()
 Targets.update_forward_refs()
 CyclonedxBillOfMaterialsStandard.update_forward_refs()
-ToolModel.update_forward_refs()
+Tools.update_forward_refs()
 Metadata.update_forward_refs()
 Pedigree.update_forward_refs()