hoppr-cyclonedx-models 0.6.1__py3-none-any.whl → 0.6.2__py3-none-any.whl

hoppr_cyclonedx_models/cyclonedx_1_6.py

@@ -1,6 +1,6 @@
 """
 --------------------------------------------------------------------------------
-SPDX-FileCopyrightText: Copyright © 2025 Lockheed Martin <open.source@lmco.com>
+SPDX-FileCopyrightText: Copyright © 2024 Lockheed Martin <open.source@lmco.com>
 SPDX-FileName: hoppr_cyclonedx_models/cyclonedx_1_6.py
 SPDX-FileType: SOURCE
 SPDX-License-Identifier: MIT
@@ -25,15 +25,15 @@ THE SOFTWARE.
 --------------------------------------------------------------------------------
 This file was generated by datamodel-codegen:
   filename:  bom-1.6.schema.json
-  timestamp: 2025-09-17T19:02:47+00:00
-  version:   0.25.7
+  timestamp: 2024-07-15T17:53:40+00:00
+  version:   0.21.5
 """
 
 from __future__ import annotations
 
 from datetime import datetime
 from enum import Enum
-from typing import List, Optional, Union
+from typing import Any, List, Optional, Union
 
 from pydantic import AnyUrl, EmailStr, Extra, Field
 from typing_extensions import Annotated, Literal
@@ -65,6 +65,18 @@ class Confidence(CycloneDXBaseModel):
     ] = None
 
 
+RefType = Annotated[
+    str,
+    Field(
+        description=(
+            "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link"
+            " intro 'urn:cdx:' to avoid conflicts with BOM-Links."
+        ),
+        min_length=1,
+    ),
+]
+
+
 RefLinkType = Annotated[
     str,
     Field(
@@ -118,22 +130,14 @@ class Phase(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class Lifecycles(CycloneDXBaseModel):
-    """
-    The product lifecycle(s) that this BOM represents.
-    """
-
+class Lifecycle(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
     phase: Annotated[Phase, Field(description="A pre-defined phase in the product lifecycle.", title="Phase")]
 
 
-class Lifecycles1(CycloneDXBaseModel):
-    """
-    The product lifecycle(s) that this BOM represents.
-    """
-
+class Lifecycle1(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
@@ -153,7 +157,7 @@ class OrganizationalContact(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -231,15 +235,7 @@ class Attachment(CycloneDXBaseModel):
     contentType: Annotated[
         Optional[str],
         Field(
-            description=(
-                "Specifies the format and nature of the data being attached, helping systems correctly interpret and"
-                " process the content. Common content type examples include `application/json` for JSON data and"
-                " `text/plain` for plan text documents.\n [RFC 2045 section"
-                " 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content"
-                " types. For a comprehensive list of registered content types, refer to the [IANA media types"
-                " registry](https://www.iana.org/assignments/media-types/media-types.xhtml)."
-            ),
-            examples=["text/plain", "application/json", "image/png"],
+            description="Specifies the content type of the text. Defaults to text/plain if not specified.",
             title="Content-Type",
         ),
     ] = "text/plain"
@@ -311,54 +307,71 @@ class LicenseType(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class LicenseAcknowledgementEnumeration(Enum):
+class Licensing(CycloneDXBaseModel):
     """
-    Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
+    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
     """
 
-    DECLARED = declared = "declared"
-    CONCLUDED = concluded = "concluded"
-
-    def __str__(self) -> str:
-        return str(self.value)
-
-    @classmethod
-    def _missing_(cls, value: object):
-        return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
-
-
-class LicenseChoice21(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    expression: Annotated[
-        str,
+    altIds: Annotated[
+        Optional[List[str]],
+        Field(
+            description="License identifiers that may be used to manage licenses and their lifecycle",
+            title="Alternate License Identifiers",
+        ),
+    ] = None
+    purchaseOrder: Annotated[
+        Optional[str],
         Field(
             description=(
-                "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements"
+                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
             ),
-            examples=["Apache-2.0 AND (MIT OR GPL-2.0-only)", "GPL-3.0-only WITH Classpath-exception-2.0"],
-            title="SPDX License Expression",
+            title="Purchase Order",
         ),
-    ]
-    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
-    bom_ref: Annotated[
-        Optional[str],
+    ] = None
+    licenseTypes: Annotated[
+        Optional[List[LicenseType]],
+        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
+    ] = None
+    lastRenewal: Annotated[
+        Optional[datetime],
         Field(
-            alias="bom-ref",
             description=(
-                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
-                " conflicts with BOM-Links."
+                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
+                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
+                " when the license was last renewed."
             ),
-            min_length=1,
-            title="BOM Reference",
+            title="Last Renewal",
+        ),
+    ] = None
+    expiration: Annotated[
+        Optional[datetime],
+        Field(
+            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
         ),
     ] = None
 
 
+class LicenseAcknowledgementEnumeration(Enum):
+    """
+    Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
+    """
+
+    DECLARED = declared = "declared"
+    CONCLUDED = concluded = "concluded"
+
+    def __str__(self) -> str:
+        return str(self.value)
+
+    @classmethod
+    def _missing_(cls, value: object):
+        return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
+
+
 LicenseChoice2 = Annotated[
-    List[LicenseChoice21],
+    List[Any],
     Field(
         description="A tuple of exactly one SPDX License Expression.",
         max_items=1,
@@ -547,7 +560,7 @@ class Type3(Enum):
 
 class Dependency(CycloneDXBaseModel):
     """
-    Defines the direct dependencies of a component, service, or the components provided/implemented by a given component. Components or services that do not have their own dependencies must be declared as empty elements within the graph. Components or services that are not represented in the dependency graph may have unknown dependencies. It is recommended that implementations assume this to be opaque and not an indicator of an object being dependency-free. It is recommended to leverage compositions to indicate unknown dependency graphs.
+    Defines the direct dependencies of a component, service, or the components provided/implemented by a given component. Components or services that do not have their own dependencies MUST be declared as empty elements within the graph. Components or services that are not represented in the dependency graph MAY have unknown dependencies. It is RECOMMENDED that implementations assume this to be opaque and not an indicator of an object being dependency-free. It is RECOMMENDED to leverage compositions to indicate unknown dependency graphs.
     """
 
     class Config:
@@ -560,17 +573,16 @@ class Dependency(CycloneDXBaseModel):
         ),
     ]
     dependsOn: Annotated[
-        Optional[List[str]],
+        Optional[List[RefLinkType]],
         Field(
             description=(
                 "The bom-ref identifiers of the components or services that are dependencies of this dependency object."
             ),
-            min_length=1,
             title="Depends On",
         ),
     ] = None
     provides: Annotated[
-        Optional[List[str]],
+        Optional[List[RefLinkType]],
         Field(
             description=(
                 "The bom-ref identifiers of the components or services that define a given specification or standard,"
@@ -578,7 +590,6 @@ class Dependency(CycloneDXBaseModel):
                 " which implements a cryptographic algorithm. A component which implements another component does not"
                 " imply that the implementation is in use."
             ),
-            min_length=1,
             title="Provides",
         ),
     ] = None
@@ -603,14 +614,10 @@ class DataFlowDirection(Enum):
 
 
 class Copyright(CycloneDXBaseModel):
-    """
-    A copyright notice informing users of the underlying claims to copyright ownership in a published work.
-    """
-
     class Config:
         extra = Extra.forbid
 
-    text: Annotated[str, Field(description="The textual content of the copyright.", title="Copyright Text")]
+    text: Annotated[str, Field(title="Copyright Text")]
 
 
 class Occurrence(CycloneDXBaseModel):
@@ -623,7 +630,7 @@ class Occurrence(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the occurrence elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -738,7 +745,7 @@ class AggregateType(Enum):
 
 class Property(CycloneDXBaseModel):
     """
-    Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.
+    Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL.
     """
 
     class Config:
@@ -792,6 +799,19 @@ class Advisory(CycloneDXBaseModel):
     url: Annotated[str, Field(description="Location where the advisory can be obtained.", title="URL")]
 
 
+Cwe = Annotated[
+    int,
+    Field(
+        description=(
+            "Integer representation of a Common Weaknesses Enumerations (CWE). For example 399 (of"
+            " https://cwe.mitre.org/data/definitions/399.html)"
+        ),
+        ge=1,
+        title="CWE",
+    ),
+]
+
+
 class Severity(Enum):
     """
     Textual representation of the severity of the vulnerability adopted by the analysis method. If the analysis method uses values other than what is provided, the user is expected to translate appropriately.
@@ -999,6 +1019,19 @@ class Analysis(CycloneDXBaseModel):
     ] = None
 
 
+class Affect(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
+
+    ref: Annotated[
+        Union[RefLinkType, BomLinkElementType],
+        Field(description="References a component or service by the objects bom-ref", title="Reference"),
+    ]
+    versions: Annotated[
+        Optional[List], Field(description="Zero or more individual versions or range of versions.", title="Versions")
+    ] = None
+
+
 class AffectedStatus(Enum):
     """
     The vulnerability status of a given version or range of versions of a product. The statuses 'affected' and 'unaffected' indicate that the version is affected or unaffected by the vulnerability. The status 'unknown' indicates that it is unknown or unspecified whether the given version is affected. There can be many reasons for an 'unknown' status, including that an investigation has not been undertaken or that a vendor has not disclosed the status.
@@ -1069,7 +1102,7 @@ class Approach(CycloneDXBaseModel):
     ] = None
 
 
-class Datasets(CycloneDXBaseModel):
+class Dataset(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
@@ -1144,7 +1177,7 @@ class Graphic(CycloneDXBaseModel):
     image: Annotated[
         Optional[Attachment],
         Field(
-            description="The graphic (vector or raster). Base64 encoding must be specified for binary images.",
+            description="The graphic (vector or raster). Base64 encoding MUST be specified for binary images.",
             title="Graphic Image",
         ),
     ] = None
@@ -1313,7 +1346,7 @@ class PostalAddress(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the address elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -1349,20 +1382,7 @@ class Command(CycloneDXBaseModel):
     executed: Annotated[
         Optional[str], Field(description="A text representation of the executed command.", title="Executed")
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class AccessMode(Enum):
@@ -1444,20 +1464,7 @@ class Volume(CycloneDXBaseModel):
         Optional[bool],
         Field(description="Indicates if the volume is remotely (i.e., network) attached.", title="Remote"),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Type6(Enum):
@@ -1517,20 +1524,7 @@ class Condition(CycloneDXBaseModel):
             title="Expression",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class TaskType(Enum):
@@ -1685,6 +1679,9 @@ class ComponentIdentityEvidence(CycloneDXBaseModel):
     ] = None
 
 
+OpenCre = Annotated[str, Field(examples=["CRE:764-507"], regex="^CRE:[0-9]+-[0-9]+$")]
+
+
 class Level(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
@@ -1695,7 +1692,7 @@ class Level(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
+                " MUST be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -1710,16 +1707,12 @@ class Level(CycloneDXBaseModel):
         Optional[str], Field(description="The description of the level.", title="Description")
     ] = None
     requirements: Annotated[
-        Optional[List[str]],
-        Field(
-            description="The list of requirement `bom-ref`s that comprise the level.",
-            min_length=1,
-            title="Requirements",
-        ),
+        Optional[List[RefLinkType]],
+        Field(description="The list of requirement `bom-ref`s that comprise the level.", title="Requirements"),
     ] = None
 
 
-class Algorithm(Enum):
+class AlgorithmEnum(Enum):
     """
     Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".
     """
@@ -2039,7 +2032,7 @@ class AlgorithmProperties(CycloneDXBaseModel):
                 "The target platform for which the algorithm is implemented. The implementation can be 'generic',"
                 " running on any platform or for a specific platform."
             ),
-            title="Implementation platform",
+            title="implementation platform",
         ),
     ] = None
     certificationLevel: Annotated[
@@ -2154,7 +2147,7 @@ class CertificateProperties(CycloneDXBaseModel):
     ] = None
 
 
-class Type10(Enum):
+class Type8(Enum):
     """
     The type for the related cryptographic material
     """
@@ -2207,7 +2200,7 @@ class State(Enum):
         return next((member for member in cls if member.name in {str(value), str(value).upper()}), None)
 
 
-class Type11(Enum):
+class Type9(Enum):
     """
     The concrete protocol type.
     """
@@ -2246,10 +2239,8 @@ class CipherSuite(CycloneDXBaseModel):
         ),
     ] = None
     algorithms: Annotated[
-        Optional[List[str]],
-        Field(
-            description="A list of algorithms related to the cipher suite.", min_length=1, title="Related Algorithms"
-        ),
+        Optional[List[RefType]],
+        Field(description="A list of algorithms related to the cipher suite.", title="Related Algorithms"),
     ] = None
     identifiers: Annotated[
         Optional[List[str]],
@@ -2299,10 +2290,9 @@ class Conformance(CycloneDXBaseModel):
         Optional[str], Field(description="The rationale for the conformance score.", title="Rationale")
     ] = None
     mitigationStrategies: Annotated[
-        Optional[List[str]],
+        Optional[List[RefLinkType]],
         Field(
             description="The list of  `bom-ref` to the evidence provided describing the mitigation strategies.",
-            min_length=1,
             title="Mitigation Strategies",
         ),
     ] = None
@@ -2317,16 +2307,12 @@ class Map(CycloneDXBaseModel):
         Field(description="The `bom-ref` to the requirement being attested to.", min_length=1, title="Requirement"),
     ] = None
     claims: Annotated[
-        Optional[List[str]],
-        Field(description="The list of `bom-ref` to the claims being attested to.", min_length=1, title="Claims"),
+        Optional[List[RefLinkType]],
+        Field(description="The list of `bom-ref` to the claims being attested to.", title="Claims"),
     ] = None
     counterClaims: Annotated[
-        Optional[List[str]],
-        Field(
-            description="The list of  `bom-ref` to the counter claims being attested to.",
-            min_length=1,
-            title="Counter Claims",
-        ),
+        Optional[List[RefLinkType]],
+        Field(description="The list of  `bom-ref` to the counter claims being attested to.", title="Counter Claims"),
     ] = None
     conformance: Annotated[
         Optional[Conformance],
@@ -2365,7 +2351,7 @@ class OrganizationalEntity(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -2438,262 +2424,306 @@ class Hash(CycloneDXBaseModel):
     ]
 
 
-class Licensor(CycloneDXBaseModel):
-    """
-    The individual or organization that grants a license to another individual or organization
-    """
-
+class License(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[
-        OrganizationalEntity,
-        Field(description="The organization that granted the license", title="Licensor (Organization)"),
-    ]
-    individual: Annotated[
-        Optional[OrganizationalContact],
+    bom_ref: Annotated[
+        Optional[str],
         Field(
-            description="The individual, not associated with an organization, that granted the license",
-            title="Licensor (Individual)",
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
         ),
     ] = None
-
-
-class Licensor1(CycloneDXBaseModel):
-    """
-    The individual or organization that grants a license to another individual or organization
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        Optional[OrganizationalEntity],
-        Field(description="The organization that granted the license", title="Licensor (Organization)"),
+    id: Annotated[
+        Optional[spdx.LicenseID],
+        Field(description="A valid SPDX license ID", examples=["Apache-2.0"], title="License ID (SPDX)"),
     ] = None
-    individual: Annotated[
-        OrganizationalContact,
+    name: Annotated[
+        Optional[str],
         Field(
-            description="The individual, not associated with an organization, that granted the license",
-            title="Licensor (Individual)",
+            description="If SPDX does not define the license used, this field may be used to provide the license name",
+            examples=["Acme Software License"],
+            title="License Name",
         ),
-    ]
-
+    ] = None
+    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
+    text: Annotated[
+        Optional[Attachment],
+        Field(description="An optional way to include the textual content of a license.", title="License text"),
+    ] = None
+    url: Annotated[
+        Optional[str],
+        Field(
+            description=(
+                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
+                " completeness"
+            ),
+            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
+            title="License URL",
+        ),
+    ] = None
+    licensing: Annotated[
+        Optional[Licensing],
+        Field(
+            description=(
+                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
+                " other important metadata"
+            ),
+            title="Licensing information",
+        ),
+    ] = None
+    properties: Annotated[
+        Optional[List[Property]],
+        Field(
+            description=(
+                "Provides the ability to document properties in a name-value store. This provides flexibility to"
+                " include data not officially supported in the standard without having to use additional namespaces or"
+                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
+                " having different values. Property names of interest to the general public are encouraged to be"
+                " registered in the [CycloneDX Property"
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
+            ),
+            title="Properties",
+        ),
+    ] = None
 
-class Licensee(CycloneDXBaseModel):
-    """
-    The individual or organization for which a license was granted to
-    """
 
+class LicenseChoice1(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[
-        OrganizationalEntity,
-        Field(description="The organization that was granted the license", title="Licensee (Organization)"),
-    ]
-    individual: Annotated[
-        Optional[OrganizationalContact],
-        Field(
-            description="The individual, not associated with an organization, that was granted the license",
-            title="Licensee (Individual)",
-        ),
-    ] = None
+    license: License
 
 
-class Licensee1(CycloneDXBaseModel):
+class Commit(CycloneDXBaseModel):
     """
-    The individual or organization for which a license was granted to
+    Specifies an individual commit
     """
 
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[
-        Optional[OrganizationalEntity],
-        Field(description="The organization that was granted the license", title="Licensee (Organization)"),
-    ] = None
-    individual: Annotated[
-        OrganizationalContact,
+    uid: Annotated[
+        Optional[str],
         Field(
-            description="The individual, not associated with an organization, that was granted the license",
-            title="Licensee (Individual)",
-        ),
-    ]
+            description=(
+                "A unique identifier of the commit. This may be version control specific. For example, Subversion uses"
+                " revision numbers whereas git uses commit hashes."
+            ),
+            title="UID",
+        ),
+    ] = None
+    url: Annotated[
+        Optional[str],
+        Field(
+            description="The URL to the commit. This URL will typically point to a commit in a version control system.",
+            title="URL",
+        ),
+    ] = None
+    author: Annotated[
+        Optional[IdentifiableAction],
+        Field(description="The author who created the changes in the commit", title="Author"),
+    ] = None
+    committer: Annotated[
+        Optional[IdentifiableAction],
+        Field(description="The person who committed or pushed the commit", title="Committer"),
+    ] = None
+    message: Annotated[
+        Optional[str], Field(description="The text description of the contents of the commit", title="Message")
+    ] = None
 
 
-class Purchaser(CycloneDXBaseModel):
+class Patch(CycloneDXBaseModel):
     """
-    The individual or organization that purchased the license
+    Specifies an individual patch
     """
 
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[
-        OrganizationalEntity,
-        Field(description="The organization that purchased the license", title="Purchaser (Organization)"),
+    type: Annotated[
+        Type1,
+        Field(
+            description=(
+                "Specifies the purpose for the patch including the resolution of defects, security issues, or new"
+                " behavior or functionality."
+            ),
+            title="Patch Type",
+        ),
     ]
-    individual: Annotated[
-        Optional[OrganizationalContact],
+    diff: Annotated[
+        Optional[Diff],
         Field(
-            description="The individual, not associated with an organization, that purchased the license",
-            title="Purchaser (Individual)",
+            description=(
+                "The patch file (or diff) that shows changes. Refer to"
+                " [https://en.wikipedia.org/wiki/Diff](https://en.wikipedia.org/wiki/Diff)"
+            ),
+            title="Diff",
         ),
     ] = None
+    resolves: Annotated[
+        Optional[List[Issue]], Field(description="A collection of issues the patch resolves", title="Resolves")
+    ] = None
 
 
-class Purchaser1(CycloneDXBaseModel):
+class ExternalReference(CycloneDXBaseModel):
     """
-    The individual or organization that purchased the license
+    External references provide a way to document systems, sites, and information that may be relevant but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
     """
 
     class Config:
         extra = Extra.forbid
 
-    organization: Annotated[
-        Optional[OrganizationalEntity],
-        Field(description="The organization that purchased the license", title="Purchaser (Organization)"),
-    ] = None
-    individual: Annotated[
-        OrganizationalContact,
+    url: Annotated[
+        Union[str, Union[BomLinkDocumentType, BomLinkElementType]],
         Field(
-            description="The individual, not associated with an organization, that purchased the license",
-            title="Purchaser (Individual)",
+            description=(
+                "The URI (URL or URN) to the external reference. External references are URIs and therefore can accept"
+                " any URL scheme including https ([RFC-7230](https://www.ietf.org/rfc/rfc7230.txt)), mailto"
+                " ([RFC-2368](https://www.ietf.org/rfc/rfc2368.txt)), tel"
+                " ([RFC-3966](https://www.ietf.org/rfc/rfc3966.txt)), and dns"
+                " ([RFC-4501](https://www.ietf.org/rfc/rfc4501.txt)). External references may also include formally"
+                " registered URNs such as [CycloneDX BOM-Link](https://cyclonedx.org/capabilities/bomlink/) to"
+                " reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external"
+                " references into relationships that can be expressed in a BOM or across BOMs."
+            ),
+            title="URL",
         ),
     ]
+    comment: Annotated[
+        Optional[str], Field(description="An optional comment describing the external reference", title="Comment")
+    ] = None
+    type: Annotated[Type3, Field(description="Specifies the type of external reference.", title="Type")]
+    hashes: Annotated[
+        Optional[List[Hash]], Field(description="The hashes of the external reference (if applicable).", title="Hashes")
+    ] = None
 
 
-class Licensing(CycloneDXBaseModel):
+class ComponentEvidence(CycloneDXBaseModel):
     """
-    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
+    Provides the ability to document evidence collected through various forms of extraction or analysis.
     """
 
     class Config:
         extra = Extra.forbid
 
-    altIds: Annotated[
-        Optional[List[str]],
+    identity: Annotated[
+        Optional[Union[List[ComponentIdentityEvidence], ComponentIdentityEvidence]],
         Field(
-            description="License identifiers that may be used to manage licenses and their lifecycle",
-            title="Alternate License Identifiers",
+            description=(
+                "Evidence that substantiates the identity of a component. The identify may be an object or an array of"
+                " identity objects. Support for specifying identify as a single object was introduced in CycloneDX"
+                " v1.5. Arrays were introduced in v1.6. It is RECOMMENDED that all implementations use arrays, even if"
+                " only one identity object is specified."
+            ),
+            title="Identity Evidence",
         ),
     ] = None
-    licensor: Annotated[
-        Optional[Union[Licensor, Licensor1]],
+    occurrences: Annotated[
+        Optional[List[Occurrence]],
         Field(
-            description="The individual or organization that grants a license to another individual or organization",
-            title="Licensor",
+            description="Evidence of individual instances of a component spread across multiple locations.",
+            title="Occurrences",
         ),
     ] = None
-    licensee: Annotated[
-        Optional[Union[Licensee, Licensee1]],
-        Field(description="The individual or organization for which a license was granted to", title="Licensee"),
-    ] = None
-    purchaser: Annotated[
-        Optional[Union[Purchaser, Purchaser1]],
-        Field(description="The individual or organization that purchased the license", title="Purchaser"),
+    callstack: Annotated[
+        Optional[Callstack],
+        Field(description="Evidence of the components use through the callstack.", title="Call Stack"),
     ] = None
-    purchaseOrder: Annotated[
-        Optional[str],
+    licenses: Annotated[
+        Optional[Union[List[LicenseChoice1], LicenseChoice2]],
         Field(
             description=(
-                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
+                "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)"
             ),
-            title="Purchase Order",
+            title="License Evidence",
         ),
     ] = None
-    licenseTypes: Annotated[
-        Optional[List[LicenseType]],
-        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
-    ] = None
-    lastRenewal: Annotated[
-        Optional[datetime],
+    copyright: Annotated[
+        Optional[List[Copyright]],
         Field(
             description=(
-                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
-                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
-                " when the license was last renewed."
+                "Copyright evidence captures intellectual property assertions, providing evidence of possible ownership"
+                " and legal protection."
             ),
-            title="Last Renewal",
-        ),
-    ] = None
-    expiration: Annotated[
-        Optional[datetime],
-        Field(
-            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
+            title="Copyright Evidence",
         ),
     ] = None
 
 
-class License1(CycloneDXBaseModel):
-    """
-    Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
-    """
-
+class ReleaseNotes(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    bom_ref: Annotated[
+    type: Annotated[
+        str,
+        Field(
+            description="The software versioning type the release note describes.",
+            examples=["major", "minor", "patch", "pre-release", "internal"],
+            title="Type",
+        ),
+    ]
+    title: Annotated[Optional[str], Field(description="The title of the release.", title="Title")] = None
+    featuredImage: Annotated[
         Optional[str],
         Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
-                " conflicts with BOM-Links."
-            ),
-            min_length=1,
-            title="BOM Reference",
+            description="The URL to an image that may be prominently displayed with the release note.",
+            title="Featured image",
         ),
     ] = None
-    id: Annotated[
-        spdx.LicenseID,
+    socialImage: Annotated[
+        Optional[str],
         Field(
-            description=(
-                "A valid SPDX license identifier. If specified, this value must be one of the enumeration of valid SPDX"
-                " license identifiers defined in the spdx.schema.json (or spdx.xml) subschema which is synchronized"
-                " with the official SPDX license list."
-            ),
-            examples=["Apache-2.0"],
-            title="License ID (SPDX)",
+            description="The URL to an image that may be used in messaging on social media platforms.",
+            title="Social image",
         ),
-    ]
-    name: Annotated[
-        Optional[str],
+    ] = None
+    description: Annotated[
+        Optional[str], Field(description="A short description of the release.", title="Description")
+    ] = None
+    timestamp: Annotated[
+        Optional[datetime],
+        Field(description="The date and time (timestamp) when the release note was created.", title="Timestamp"),
+    ] = None
+    aliases: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "The name of the license. This may include the name of a commercial or proprietary license or an open"
-                " source license that may not be defined by SPDX."
+                "One or more alternate names the release may be referred to. This may include unofficial terms used by"
+                " development and marketing teams (e.g. code names)."
             ),
-            examples=["Acme Software License"],
-            title="License Name",
+            title="Aliases",
         ),
     ] = None
-    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
-    text: Annotated[
-        Optional[Attachment],
-        Field(description="An optional way to include the textual content of a license.", title="License text"),
-    ] = None
-    url: Annotated[
-        Optional[str],
+    tags: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
-                " completeness"
+                "Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often"
+                " serve as a way to group or categorize similar or related objects by various attributes."
             ),
-            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
-            title="License URL",
+            examples=["json-parser", "object-persistence", "text-to-image", "translation", "object-detection"],
+            title="Tags",
         ),
     ] = None
-    licensing: Annotated[
-        Optional[Licensing],
+    resolves: Annotated[
+        Optional[List[Issue]], Field(description="A collection of issues that have been resolved.", title="Resolves")
+    ] = None
+    notes: Annotated[
+        Optional[List[Note]],
         Field(
             description=(
-                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
-                " other important metadata"
+                "Zero or more release notes containing the locale and content. Multiple note objects may be specified"
+                " to support release notes in a wide variety of languages."
             ),
-            title="Licensing information",
+            title="Notes",
         ),
     ] = None
     properties: Annotated[
@@ -2705,116 +2735,175 @@ class License1(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
     ] = None
 
 
-class Licensor2(Licensor):
+class Rating(CycloneDXBaseModel):
     """
-    The individual or organization that grants a license to another individual or organization
+    Defines the severity or risk ratings of a vulnerability.
     """
 
+    class Config:
+        extra = Extra.forbid
 
-class Licensor3(Licensor1):
-    """
-    The individual or organization that grants a license to another individual or organization
-    """
+    source: Annotated[
+        Optional[VulnerabilitySource],
+        Field(description="The source that calculated the severity or risk rating of the vulnerability."),
+    ] = None
+    score: Annotated[Optional[float], Field(description="The numerical score of the rating.", title="Score")] = None
+    severity: Annotated[
+        Optional[Severity],
+        Field(
+            description="Textual representation of the severity that corresponds to the numerical score of the rating."
+        ),
+    ] = None
+    method: Optional[ScoreMethod] = None
+    vector: Annotated[
+        Optional[str],
+        Field(
+            description="Textual representation of the metric values used to score the vulnerability", title="Vector"
+        ),
+    ] = None
+    justification: Annotated[
+        Optional[str],
+        Field(description="An optional reason for rating the vulnerability as it was", title="Justification"),
+    ] = None
 
 
-class Licensee2(Licensee):
+class Credits(CycloneDXBaseModel):
     """
-    The individual or organization for which a license was granted to
+    Individuals or organizations credited with the discovery of the vulnerability.
     """
 
+    class Config:
+        extra = Extra.forbid
 
-class Licensee3(Licensee1):
-    """
-    The individual or organization for which a license was granted to
-    """
+    organizations: Annotated[
+        Optional[List[OrganizationalEntity]],
+        Field(description="The organizations credited with vulnerability discovery.", title="Organizations"),
+    ] = None
+    individuals: Annotated[
+        Optional[List[OrganizationalContact]],
+        Field(
+            description=(
+                "The individuals, not associated with organizations, that are credited with vulnerability discovery."
+            ),
+            title="Individuals",
+        ),
+    ] = None
 
 
-class Purchaser2(Purchaser):
-    """
-    The individual or organization that purchased the license
-    """
+class DataGovernanceResponsibleParty(CycloneDXBaseModel):
+    class Config:
+        extra = Extra.forbid
 
+    organization: Annotated[Optional[OrganizationalEntity], Field(title="Organization")] = None
+    contact: Annotated[Optional[OrganizationalContact], Field(title="Individual")] = None
 
-class Purchaser3(Purchaser1):
-    """
-    The individual or organization that purchased the license
-    """
 
-
-class Licensing1(CycloneDXBaseModel):
+class GraphicsCollection(CycloneDXBaseModel):
     """
-    Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
+    A collection of graphics that represent various measurements.
     """
 
     class Config:
         extra = Extra.forbid
 
-    altIds: Annotated[
-        Optional[List[str]],
-        Field(
-            description="License identifiers that may be used to manage licenses and their lifecycle",
-            title="Alternate License Identifiers",
-        ),
-    ] = None
-    licensor: Annotated[
-        Optional[Union[Licensor2, Licensor3]],
-        Field(
-            description="The individual or organization that grants a license to another individual or organization",
-            title="Licensor",
-        ),
-    ] = None
-    licensee: Annotated[
-        Optional[Union[Licensee2, Licensee3]],
-        Field(description="The individual or organization for which a license was granted to", title="Licensee"),
+    description: Annotated[
+        Optional[str], Field(description="A description of this collection of graphics.", title="Description")
     ] = None
-    purchaser: Annotated[
-        Optional[Union[Purchaser2, Purchaser3]],
-        Field(description="The individual or organization that purchased the license", title="Purchaser"),
+    collection: Annotated[
+        Optional[List[Graphic]], Field(description="A collection of graphics.", title="Collection")
     ] = None
-    purchaseOrder: Annotated[
+
+
+class EnergyProvider(CycloneDXBaseModel):
+    """
+    Describes the physical provider of energy used for model development or operations.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    bom_ref: Annotated[
         Optional[str],
         Field(
+            alias="bom-ref",
             description=(
-                "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
+                "An optional identifier which can be used to reference the energy provider elsewhere in the BOM. Every"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " avoid conflicts with BOM-Links."
             ),
-            title="Purchase Order",
+            min_length=1,
+            title="BOM Reference",
         ),
     ] = None
-    licenseTypes: Annotated[
-        Optional[List[LicenseType]],
-        Field(description="The type of license(s) that was granted to the licensee.", title="License Type"),
+    description: Annotated[
+        Optional[str], Field(description="A description of the energy provider.", title="Description")
     ] = None
-    lastRenewal: Annotated[
-        Optional[datetime],
+    organization: Annotated[OrganizationalEntity, Field(title="Organization")]
+    energySource: Annotated[
+        EnergySource, Field(description="The energy source for the energy provider.", title="Energy Source")
+    ]
+    energyProvided: Annotated[
+        EnergyMeasure,
+        Field(
+            description="The energy provided by the energy source for an associated activity.", title="Energy Provided"
+        ),
+    ]
+    externalReferences: Annotated[
+        Optional[List[ExternalReference]],
         Field(
             description=(
-                "The timestamp indicating when the license was last renewed. For new purchases, this is often the"
-                " purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of"
-                " when the license was last renewed."
+                "External references provide a way to document systems, sites, and information that may be relevant but"
+                " are not included with the BOM. They may also establish specific relationships within or external to"
+                " the BOM."
             ),
-            title="Last Renewal",
+            title="External References",
         ),
     ] = None
-    expiration: Annotated[
-        Optional[datetime],
-        Field(
-            description="The timestamp indicating when the current license expires (if applicable).", title="Expiration"
-        ),
+
+
+class Step(CycloneDXBaseModel):
+    """
+    Executes specific commands or tools in order to accomplish its owning task as part of a sequence.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    name: Annotated[Optional[str], Field(description="A name for the step.", title="Name")] = None
+    description: Annotated[Optional[str], Field(description="A description of the step.", title="Description")] = None
+    commands: Annotated[
+        Optional[List[Command]],
+        Field(description="Ordered list of commands or directives for the step", title="Commands"),
     ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
-class License2(CycloneDXBaseModel):
+class ResourceReferenceChoice(CycloneDXBaseModel):
     """
-    Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
+    A reference to a locally defined resource (e.g., a bom-ref) or an externally accessible resource.
     """
 
+    class Config:
+        extra = Extra.forbid
+
+    ref: Annotated[
+        Optional[Union[RefLinkType, BomLinkElementType]],
+        Field(description="References an object by its bom-ref attribute", title="BOM Reference"),
+    ] = None
+    externalReference: Annotated[
+        Optional[ExternalReference],
+        Field(description="Reference to an externally accessible resource.", title="External reference"),
+    ] = None
+
+
+class Requirement(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
@@ -2823,61 +2912,56 @@ class License2(CycloneDXBaseModel):
         Field(
             alias="bom-ref",
             description=(
-                "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
-                " conflicts with BOM-Links."
+                "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
+                " MUST be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
         ),
     ] = None
-    id: Annotated[
-        Optional[spdx.LicenseID],
+    identifier: Annotated[
+        Optional[str],
         Field(
             description=(
-                "A valid SPDX license identifier. If specified, this value must be one of the enumeration of valid SPDX"
-                " license identifiers defined in the spdx.schema.json (or spdx.xml) subschema which is synchronized"
-                " with the official SPDX license list."
+                "The unique identifier used in the standard to identify a specific requirement. This should match what"
+                " is in the standard and should not be the requirements bom-ref."
             ),
-            examples=["Apache-2.0"],
-            title="License ID (SPDX)",
+            title="Identifier",
         ),
     ] = None
-    name: Annotated[
-        str,
+    title: Annotated[Optional[str], Field(description="The title of the requirement.", title="Title")] = None
+    text: Annotated[Optional[str], Field(description="The textual content of the requirement.", title="Text")] = None
+    descriptions: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "The name of the license. This may include the name of a commercial or proprietary license or an open"
-                " source license that may not be defined by SPDX."
+                "The supplemental text that provides additional guidance or context to the requirement, but is not"
+                " directly part of the requirement."
             ),
-            examples=["Acme Software License"],
-            title="License Name",
+            title="Descriptions",
         ),
-    ]
-    acknowledgement: Optional[LicenseAcknowledgementEnumeration] = None
-    text: Annotated[
-        Optional[Attachment],
-        Field(description="An optional way to include the textual content of a license.", title="License text"),
     ] = None
-    url: Annotated[
-        Optional[str],
+    openCre: Annotated[
+        Optional[List[OpenCre]],
         Field(
             description=(
-                "The URL to the license file. If specified, a 'license' externalReference should also be specified for"
-                " completeness"
+                "The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized"
+                " framework for uniting security standards and guidelines. CRE links each section of a resource to a"
+                " shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to"
+                " each other. Use of CRE promotes clear and unambiguous communication among stakeholders."
             ),
-            examples=["https://www.apache.org/licenses/LICENSE-2.0.txt"],
-            title="License URL",
+            title="OWASP OpenCRE Identifier(s)",
         ),
     ] = None
-    licensing: Annotated[
-        Optional[Licensing1],
+    parent: Annotated[
+        Optional[str],
         Field(
             description=(
-                "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and"
-                " other important metadata"
+                "The optional `bom-ref` to a parent requirement. This establishes a hierarchy of requirements."
+                " Top-level requirements must not define a parent. Only child requirements should define parents."
             ),
-            title="Licensing information",
+            min_length=1,
+            title="Parent BOM Reference",
         ),
     ] = None
     properties: Annotated[
@@ -2889,1471 +2973,552 @@ class License2(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
     ] = None
-
-
-class LicenseChoice1(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    license: Annotated[
-        Union[License1, License2],
+    externalReferences: Annotated[
+        Optional[List[ExternalReference]],
         Field(
             description=(
-                "Specifies the details and attributes related to a software license. It can either include a valid SPDX"
-                " license identifier or a named license, along with additional properties such as license"
-                " acknowledgment, comprehensive commercial licensing information, and the full text of the license."
+                "External references provide a way to document systems, sites, and information that may be relevant,"
+                " but are not included with the BOM. They may also establish specific relationships within or external"
+                " to the BOM."
             ),
-            title="License",
+            title="External References",
         ),
-    ]
-
+    ] = None
 
-class Commit(CycloneDXBaseModel):
-    """
-    Specifies an individual commit
-    """
 
+class Signer(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
-    uid: Annotated[
+    algorithm: Union[AlgorithmEnum, AnyUrl]
+    keyId: Annotated[
         Optional[str],
+        Field(description="Optional. Application specific string identifying the signature key.", title="Key ID"),
+    ] = None
+    publicKey: Annotated[
+        Optional[PublicKey], Field(description="Optional. Public key object.", title="Public key")
+    ] = None
+    certificatePath: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "A unique identifier of the commit. This may be version control specific. For example, Subversion uses"
-                " revision numbers whereas git uses commit hashes."
+                "Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the"
+                " signature certificate. The certificate path must be contiguous but is not required to be complete."
             ),
-            title="UID",
-        ),
-    ] = None
-    url: Annotated[
-        Optional[str],
-        Field(
-            description="The URL to the commit. This URL will typically point to a commit in a version control system.",
-            title="URL",
+            title="Certificate path",
         ),
     ] = None
-    author: Annotated[
-        Optional[IdentifiableAction],
-        Field(description="The author who created the changes in the commit", title="Author"),
-    ] = None
-    committer: Annotated[
-        Optional[IdentifiableAction],
-        Field(description="The person who committed or pushed the commit", title="Committer"),
-    ] = None
-    message: Annotated[
-        Optional[str], Field(description="The text description of the contents of the commit", title="Message")
-    ] = None
-
-
-class Patch(CycloneDXBaseModel):
-    """
-    Specifies an individual patch
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[
-        Type1,
+    excludes: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "Specifies the purpose for the patch including the resolution of defects, security issues, or new"
-                " behavior or functionality."
+                "Optional. Array holding the names of one or more application level properties that must be excluded"
+                ' from the signature process. Note that the "excludes" property itself, must also be excluded from the'
+                ' signature process. Since both the "excludes" property and the associated data it points to are'
+                " unsigned, a conforming JSF implementation must provide options for specifying which properties to"
+                " accept."
             ),
-            title="Patch Type",
+            title="Excludes",
         ),
-    ]
-    diff: Annotated[
-        Optional[Diff],
+    ] = None
+    value: Annotated[
+        str,
         Field(
             description=(
-                "The patch file (or diff) that shows changes. Refer to"
-                " [https://en.wikipedia.org/wiki/Diff](https://en.wikipedia.org/wiki/Diff)"
+                "The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications."
             ),
-            title="Diff",
+            title="Signature",
         ),
-    ] = None
-    resolves: Annotated[
-        Optional[List[Issue]], Field(description="A collection of issues the patch resolves", title="Resolves")
-    ] = None
+    ]
 
 
-class ExternalReference(CycloneDXBaseModel):
+class RelatedCryptoMaterialProperties(CycloneDXBaseModel):
     """
-    External references provide a way to document systems, sites, and information that may be relevant but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
+    Properties for cryptographic assets of asset type: `related-crypto-material`
     """
 
     class Config:
         extra = Extra.forbid
 
-    url: Annotated[
-        Union[str, Union[BomLinkDocumentType, BomLinkElementType]],
+    type: Annotated[
+        Optional[Type8],
+        Field(description="The type for the related cryptographic material", title="relatedCryptoMaterialType"),
+    ] = None
+    id: Annotated[
+        Optional[str],
+        Field(description="The optional unique identifier for the related cryptographic material.", title="ID"),
+    ] = None
+    state: Annotated[
+        Optional[State], Field(description="The key state as defined by NIST SP 800-57.", title="State")
+    ] = None
+    algorithmRef: Annotated[
+        Optional[str],
         Field(
-            description=(
-                "The URI (URL or URN) to the external reference. External references are URIs and therefore can accept"
-                " any URL scheme including https ([RFC-7230](https://www.ietf.org/rfc/rfc7230.txt)), mailto"
-                " ([RFC-2368](https://www.ietf.org/rfc/rfc2368.txt)), tel"
-                " ([RFC-3966](https://www.ietf.org/rfc/rfc3966.txt)), and dns"
-                " ([RFC-4501](https://www.ietf.org/rfc/rfc4501.txt)). External references may also include formally"
-                " registered URNs such as [CycloneDX BOM-Link](https://cyclonedx.org/capabilities/bomlink/) to"
-                " reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external"
-                " references into relationships that can be expressed in a BOM or across BOMs."
-            ),
-            title="URL",
-        ),
-    ]
-    comment: Annotated[
-        Optional[str], Field(description="An optional comment describing the external reference", title="Comment")
-    ] = None
-    type: Annotated[Type3, Field(description="Specifies the type of external reference.", title="Type")]
-    hashes: Annotated[
-        Optional[List[Hash]], Field(description="The hashes of the external reference (if applicable).", title="Hashes")
-    ] = None
-
-
-class ComponentEvidence(CycloneDXBaseModel):
-    """
-    Provides the ability to document evidence collected through various forms of extraction or analysis.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    identity: Annotated[
-        Optional[Union[List[ComponentIdentityEvidence], ComponentIdentityEvidence]],
-        Field(
-            description=(
-                "Evidence that substantiates the identity of a component. The identity may be an object or an array of"
-                " identity objects. Support for specifying identity as a single object was introduced in CycloneDX"
-                " v1.5. Arrays were introduced in v1.6. It is recommended that all implementations use arrays, even if"
-                " only one identity object is specified."
-            ),
-            title="Identity Evidence",
-        ),
-    ] = None
-    occurrences: Annotated[
-        Optional[List[Occurrence]],
-        Field(
-            description="Evidence of individual instances of a component spread across multiple locations.",
-            title="Occurrences",
-        ),
-    ] = None
-    callstack: Annotated[
-        Optional[Callstack],
-        Field(description="Evidence of the components use through the callstack.", title="Call Stack"),
-    ] = None
-    licenses: Annotated[
-        Optional[Union[List[LicenseChoice1], LicenseChoice2]],
-        Field(
-            description=(
-                "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)"
-            ),
-            title="License Evidence",
-        ),
-    ] = None
-    copyright: Annotated[
-        Optional[List[Copyright]],
-        Field(
-            description=(
-                "Copyright evidence captures intellectual property assertions, providing evidence of possible ownership"
-                " and legal protection."
-            ),
-            title="Copyright Evidence",
-        ),
-    ] = None
-
-
-class ReleaseNotes(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[
-        str,
-        Field(
-            description="The software versioning type the release note describes.",
-            examples=["major", "minor", "patch", "pre-release", "internal"],
-            title="Type",
-        ),
-    ]
-    title: Annotated[Optional[str], Field(description="The title of the release.", title="Title")] = None
-    featuredImage: Annotated[
-        Optional[str],
-        Field(
-            description="The URL to an image that may be prominently displayed with the release note.",
-            title="Featured image",
-        ),
-    ] = None
-    socialImage: Annotated[
-        Optional[str],
-        Field(
-            description="The URL to an image that may be used in messaging on social media platforms.",
-            title="Social image",
-        ),
-    ] = None
-    description: Annotated[
-        Optional[str], Field(description="A short description of the release.", title="Description")
-    ] = None
-    timestamp: Annotated[
-        Optional[datetime],
-        Field(description="The date and time (timestamp) when the release note was created.", title="Timestamp"),
-    ] = None
-    aliases: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "One or more alternate names the release may be referred to. This may include unofficial terms used by"
-                " development and marketing teams (e.g. code names)."
-            ),
-            title="Aliases",
-        ),
-    ] = None
-    tags: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often"
-                " serve as a way to group or categorize similar or related objects by various attributes."
-            ),
-            examples=["json-parser", "object-persistence", "text-to-image", "translation", "object-detection"],
-            title="Tags",
-        ),
-    ] = None
-    resolves: Annotated[
-        Optional[List[Issue]], Field(description="A collection of issues that have been resolved.", title="Resolves")
-    ] = None
-    notes: Annotated[
-        Optional[List[Note]],
-        Field(
-            description=(
-                "Zero or more release notes containing the locale and content. Multiple note objects may be specified"
-                " to support release notes in a wide variety of languages."
-            ),
-            title="Notes",
-        ),
-    ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
-
-
-class Rating(CycloneDXBaseModel):
-    """
-    Defines the severity or risk ratings of a vulnerability.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    source: Annotated[
-        Optional[VulnerabilitySource],
-        Field(description="The source that calculated the severity or risk rating of the vulnerability."),
-    ] = None
-    score: Annotated[Optional[float], Field(description="The numerical score of the rating.", title="Score")] = None
-    severity: Annotated[
-        Optional[Severity],
-        Field(
-            description="Textual representation of the severity that corresponds to the numerical score of the rating."
-        ),
-    ] = None
-    method: Optional[ScoreMethod] = None
-    vector: Annotated[
-        Optional[str],
-        Field(
-            description="Textual representation of the metric values used to score the vulnerability", title="Vector"
-        ),
-    ] = None
-    justification: Annotated[
-        Optional[str],
-        Field(description="An optional reason for rating the vulnerability as it was", title="Justification"),
-    ] = None
-
-
-class Credits(CycloneDXBaseModel):
-    """
-    Individuals or organizations credited with the discovery of the vulnerability.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organizations: Annotated[
-        Optional[List[OrganizationalEntity]],
-        Field(description="The organizations credited with vulnerability discovery.", title="Organizations"),
-    ] = None
-    individuals: Annotated[
-        Optional[List[OrganizationalContact]],
-        Field(
-            description=(
-                "The individuals, not associated with organizations, that are credited with vulnerability discovery."
-            ),
-            title="Individuals",
-        ),
-    ] = None
-
-
-class Versions(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    version: Annotated[
-        str,
-        Field(
-            description="A single version of a component or service.",
-            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
-            max_length=1024,
-            title="Version",
-        ),
-    ]
-    range: Annotated[
-        Optional[str],
-        Field(
-            description=(
-                "A version range specified in Package URL Version Range syntax (vers) which is defined at"
-                " https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst"
-            ),
-            examples=[
-                "vers:cargo/9.0.14",
-                "vers:npm/1.2.3|>=2.0.0|<5.0.0",
-                "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1",
-                "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1",
-                "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0",
-            ],
-            max_length=4096,
-            min_length=1,
-            title="Version Range",
-        ),
-    ] = None
-    status: Annotated[
-        Optional[AffectedStatus],
-        Field(description="The vulnerability status for the version or range of versions.", title="Status"),
-    ] = AffectedStatus.affected
-
-
-class Versions1(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    version: Annotated[
-        Optional[str],
-        Field(
-            description="A single version of a component or service.",
-            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
-            max_length=1024,
-            title="Version",
-        ),
-    ] = None
-    range: Annotated[
-        str,
-        Field(
-            description=(
-                "A version range specified in Package URL Version Range syntax (vers) which is defined at"
-                " https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst"
-            ),
-            examples=[
-                "vers:cargo/9.0.14",
-                "vers:npm/1.2.3|>=2.0.0|<5.0.0",
-                "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1",
-                "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1",
-                "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0",
-            ],
-            max_length=4096,
-            min_length=1,
-            title="Version Range",
-        ),
-    ]
-    status: Annotated[
-        Optional[AffectedStatus],
-        Field(description="The vulnerability status for the version or range of versions.", title="Status"),
-    ] = AffectedStatus.affected
-
-
-class Affect(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    ref: Annotated[
-        Union[RefLinkType, BomLinkElementType],
-        Field(description="References a component or service by the objects bom-ref", title="Reference"),
-    ]
-    versions: Annotated[
-        Optional[List[Union[Versions, Versions1]]],
-        Field(description="Zero or more individual versions or range of versions.", title="Versions"),
-    ] = None
-
-
-class DataGovernanceResponsibleParty1(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        OrganizationalEntity,
-        Field(
-            description="The organization that is responsible for specific data governance role(s).",
-            title="Organization",
-        ),
-    ]
-    contact: Annotated[
-        Optional[OrganizationalContact],
-        Field(
-            description="The individual that is responsible for specific data governance role(s).", title="Individual"
-        ),
-    ] = None
-
-
-class DataGovernanceResponsibleParty2(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        Optional[OrganizationalEntity],
-        Field(
-            description="The organization that is responsible for specific data governance role(s).",
-            title="Organization",
-        ),
-    ] = None
-    contact: Annotated[
-        OrganizationalContact,
-        Field(
-            description="The individual that is responsible for specific data governance role(s).", title="Individual"
-        ),
-    ]
-
-
-class GraphicsCollection(CycloneDXBaseModel):
-    """
-    A collection of graphics that represent various measurements.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    description: Annotated[
-        Optional[str], Field(description="A description of this collection of graphics.", title="Description")
-    ] = None
-    collection: Annotated[
-        Optional[List[Graphic]], Field(description="A collection of graphics.", title="Collection")
-    ] = None
-
-
-class EnergyProvider(CycloneDXBaseModel):
-    """
-    Describes the physical provider of energy used for model development or operations.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the energy provider elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
-                " avoid conflicts with BOM-Links."
-            ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ] = None
-    description: Annotated[
-        Optional[str], Field(description="A description of the energy provider.", title="Description")
-    ] = None
-    organization: Annotated[
-        OrganizationalEntity, Field(description="The organization that provides energy.", title="Organization")
-    ]
-    energySource: Annotated[
-        EnergySource, Field(description="The energy source for the energy provider.", title="Energy Source")
-    ]
-    energyProvided: Annotated[
-        EnergyMeasure,
-        Field(
-            description="The energy provided by the energy source for an associated activity.", title="Energy Provided"
-        ),
-    ]
-    externalReferences: Annotated[
-        Optional[List[ExternalReference]],
-        Field(
-            description=(
-                "External references provide a way to document systems, sites, and information that may be relevant but"
-                " are not included with the BOM. They may also establish specific relationships within or external to"
-                " the BOM."
-            ),
-            title="External References",
-        ),
-    ] = None
-
-
-class Step(CycloneDXBaseModel):
-    """
-    Executes specific commands or tools in order to accomplish its owning task as part of a sequence.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    name: Annotated[Optional[str], Field(description="A name for the step.", title="Name")] = None
-    description: Annotated[Optional[str], Field(description="A description of the step.", title="Description")] = None
-    commands: Annotated[
-        Optional[List[Command]],
-        Field(description="Ordered list of commands or directives for the step", title="Commands"),
-    ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
-
-
-class ResourceReferenceChoice1(CycloneDXBaseModel):
-    """
-    A reference to a locally defined resource (e.g., a bom-ref) or an externally accessible resource.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    ref: Annotated[
-        Union[RefLinkType, BomLinkElementType],
-        Field(description="References an object by its bom-ref attribute", title="BOM Reference"),
-    ]
-    externalReference: Annotated[
-        Optional[ExternalReference],
-        Field(description="Reference to an externally accessible resource.", title="External reference"),
-    ] = None
-
-
-class ResourceReferenceChoice2(CycloneDXBaseModel):
-    """
-    A reference to a locally defined resource (e.g., a bom-ref) or an externally accessible resource.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    ref: Annotated[
-        Optional[Union[RefLinkType, BomLinkElementType]],
-        Field(description="References an object by its bom-ref attribute", title="BOM Reference"),
-    ] = None
-    externalReference: Annotated[
-        ExternalReference,
-        Field(description="Reference to an externally accessible resource.", title="External reference"),
-    ]
-
-
-class Requirement(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
-            ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ] = None
-    identifier: Annotated[
-        Optional[str],
-        Field(
-            description=(
-                "The unique identifier used in the standard to identify a specific requirement. This should match what"
-                " is in the standard and should not be the requirements bom-ref."
-            ),
-            title="Identifier",
-        ),
-    ] = None
-    title: Annotated[Optional[str], Field(description="The title of the requirement.", title="Title")] = None
-    text: Annotated[Optional[str], Field(description="The textual content of the requirement.", title="Text")] = None
-    descriptions: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "The supplemental text that provides additional guidance or context to the requirement, but is not"
-                " directly part of the requirement."
-            ),
-            title="Descriptions",
-        ),
-    ] = None
-    openCre: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized"
-                " framework for uniting security standards and guidelines. CRE links each section of a resource to a"
-                " shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to"
-                " each other. Use of CRE promotes clear and unambiguous communication among stakeholders."
-            ),
-            regex="^CRE:[0-9]+-[0-9]+$",
-            title="OWASP OpenCRE Identifier(s)",
-        ),
-    ] = None
-    parent: Annotated[
-        Optional[str],
-        Field(
-            description=(
-                "The optional `bom-ref` to a parent requirement. This establishes a hierarchy of requirements."
-                " Top-level requirements must not define a parent. Only child requirements should define parents."
-            ),
-            min_length=1,
-            title="Parent BOM Reference",
-        ),
-    ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
-    externalReferences: Annotated[
-        Optional[List[ExternalReference]],
-        Field(
-            description=(
-                "External references provide a way to document systems, sites, and information that may be relevant,"
-                " but are not included with the BOM. They may also establish specific relationships within or external"
-                " to the BOM."
-            ),
-            title="External References",
-        ),
-    ] = None
-
-
-class Signer(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    algorithm: Union[Algorithm, AnyUrl]
-    keyId: Annotated[
-        Optional[str],
-        Field(description="Optional. Application specific string identifying the signature key.", title="Key ID"),
-    ] = None
-    publicKey: Annotated[
-        Optional[PublicKey], Field(description="Optional. Public key object.", title="Public key")
-    ] = None
-    certificatePath: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the"
-                " signature certificate. The certificate path must be contiguous but is not required to be complete."
-            ),
-            title="Certificate path",
-        ),
-    ] = None
-    excludes: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "Optional. Array holding the names of one or more application level properties that must be excluded"
-                ' from the signature process. Note that the "excludes" property itself, must also be excluded from the'
-                ' signature process. Since both the "excludes" property and the associated data it points to are'
-                " unsigned, a conforming JSF implementation must provide options for specifying which properties to"
-                " accept."
-            ),
-            title="Excludes",
-        ),
-    ] = None
-    value: Annotated[
-        str,
-        Field(
-            description=(
-                "The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications."
-            ),
-            title="Signature",
-        ),
-    ]
-
-
-class RelatedCryptoMaterialProperties(CycloneDXBaseModel):
-    """
-    Properties for cryptographic assets of asset type: `related-crypto-material`
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[
-        Optional[Type10],
-        Field(description="The type for the related cryptographic material", title="relatedCryptoMaterialType"),
-    ] = None
-    id: Annotated[
-        Optional[str],
-        Field(description="The optional unique identifier for the related cryptographic material.", title="ID"),
-    ] = None
-    state: Annotated[
-        Optional[State], Field(description="The key state as defined by NIST SP 800-57.", title="State")
-    ] = None
-    algorithmRef: Annotated[
-        Optional[str],
-        Field(
-            description="The bom-ref to the algorithm used to generate the related cryptographic material.",
-            min_length=1,
-            title="Algorithm Reference",
-        ),
-    ] = None
-    creationDate: Annotated[
-        Optional[datetime],
-        Field(
-            description="The date and time (timestamp) when the related cryptographic material was created.",
-            title="Creation Date",
-        ),
-    ] = None
-    activationDate: Annotated[
-        Optional[datetime],
-        Field(
-            description="The date and time (timestamp) when the related cryptographic material was activated.",
-            title="Activation Date",
-        ),
-    ] = None
-    updateDate: Annotated[
-        Optional[datetime],
-        Field(
-            description="The date and time (timestamp) when the related cryptographic material was updated.",
-            title="Update Date",
-        ),
-    ] = None
-    expirationDate: Annotated[
-        Optional[datetime],
-        Field(
-            description="The date and time (timestamp) when the related cryptographic material expires.",
-            title="Expiration Date",
-        ),
-    ] = None
-    value: Annotated[
-        Optional[str], Field(description="The associated value of the cryptographic material.", title="Value")
-    ] = None
-    size: Annotated[
-        Optional[int], Field(description="The size of the cryptographic asset (in bits).", title="Size")
-    ] = None
-    format: Annotated[
-        Optional[str],
-        Field(description="The format of the related cryptographic material (e.g. P8, PEM, DER).", title="Format"),
-    ] = None
-    securedBy: Annotated[
-        Optional[SecuredBy],
-        Field(description="The mechanism by which the cryptographic asset is secured by.", title="Secured By"),
-    ] = None
-
-
-class Ikev2TransformTypes(CycloneDXBaseModel):
-    """
-    The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    encr: Annotated[
-        Optional[List[str]],
-        Field(description="Transform Type 1: encryption algorithms", min_length=1, title="Encryption Algorithm (ENCR)"),
-    ] = None
-    prf: Annotated[
-        Optional[List[str]],
-        Field(
-            description="Transform Type 2: pseudorandom functions", min_length=1, title="Pseudorandom Function (PRF)"
-        ),
-    ] = None
-    integ: Annotated[
-        Optional[List[str]],
-        Field(description="Transform Type 3: integrity algorithms", min_length=1, title="Integrity Algorithm (INTEG)"),
-    ] = None
-    ke: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "Transform Type 4: Key Exchange Method (KE) per [RFC 9370](https://www.ietf.org/rfc/rfc9370.html),"
-                " formerly called Diffie-Hellman Group (D-H)."
-            ),
-            min_length=1,
-            title="Key Exchange Method (KE)",
-        ),
-    ] = None
-    esn: Annotated[
-        Optional[bool],
-        Field(
-            description="Specifies if an Extended Sequence Number (ESN) is used.",
-            title="Extended Sequence Numbers (ESN)",
-        ),
-    ] = None
-    auth: Annotated[
-        Optional[List[str]],
-        Field(description="IKEv2 Authentication method", min_length=1, title="IKEv2 Authentication method"),
-    ] = None
-
-
-class ProtocolProperties(CycloneDXBaseModel):
-    """
-    Properties specific to cryptographic assets of type: `protocol`.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[Optional[Type11], Field(description="The concrete protocol type.", title="Type")] = None
-    version: Annotated[
-        Optional[str],
-        Field(description="The version of the protocol.", examples=["1.0", "1.2", "1.99"], title="Protocol Version"),
-    ] = None
-    cipherSuites: Annotated[
-        Optional[List[CipherSuite]],
-        Field(description="A list of cipher suites related to the protocol.", title="Cipher Suites"),
-    ] = None
-    ikev2TransformTypes: Annotated[
-        Optional[Ikev2TransformTypes],
-        Field(
-            description=(
-                "The IKEv2 transform types supported (types 1-4), defined in [RFC 7296 section"
-                " 3.3.2](https://www.ietf.org/rfc/rfc7296.html#section-3.3.2), and additional properties."
-            ),
-            title="IKEv2 Transform Types",
-        ),
-    ] = None
-    cryptoRefArray: Annotated[
-        Optional[List[str]],
-        Field(
-            description="A list of protocol-related cryptographic assets",
-            min_length=1,
-            title="Cryptographic References",
-        ),
-    ] = None
-
-
-class CryptoProperties(CycloneDXBaseModel):
-    """
-    Cryptographic assets have properties that uniquely define them and that make them actionable for further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the algorithm primitive (authenticated encryption) are only defined by the definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    assetType: Annotated[
-        AssetType,
-        Field(
-            description=(
-                "Cryptographic assets occur in several forms. Algorithms and protocols are most commonly implemented in"
-                " specialized cryptographic libraries. They may, however, also be 'hardcoded' in software components."
-                " Certificates and related cryptographic material like keys, tokens, secrets or passwords are other"
-                " cryptographic assets to be modelled."
-            ),
-            title="Asset Type",
-        ),
-    ]
-    algorithmProperties: Annotated[
-        Optional[AlgorithmProperties],
-        Field(description="Additional properties specific to a cryptographic algorithm.", title="Algorithm Properties"),
-    ] = None
-    certificateProperties: Annotated[
-        Optional[CertificateProperties],
-        Field(
-            description="Properties for cryptographic assets of asset type 'certificate'",
-            title="Certificate Properties",
-        ),
-    ] = None
-    relatedCryptoMaterialProperties: Annotated[
-        Optional[RelatedCryptoMaterialProperties],
-        Field(
-            description="Properties for cryptographic assets of asset type: `related-crypto-material`",
-            title="Related Cryptographic Material Properties",
-        ),
-    ] = None
-    protocolProperties: Annotated[
-        Optional[ProtocolProperties],
-        Field(
-            description="Properties specific to cryptographic assets of type: `protocol`.", title="Protocol Properties"
-        ),
-    ] = None
-    oid: Annotated[
-        Optional[str], Field(description="The object identifier (OID) of the cryptographic asset.", title="OID")
-    ] = None
-
-
-class Assessor(CycloneDXBaseModel):
-    """
-    The assessor who evaluates claims and determines conformance to requirements and confidence in that assessment.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
-            ),
+            description="The bom-ref to the algorithm used to generate the related cryptographic material.",
             min_length=1,
-            title="BOM Reference",
+            title="Algorithm Reference",
         ),
     ] = None
-    thirdParty: Annotated[
-        Optional[bool],
+    creationDate: Annotated[
+        Optional[datetime],
         Field(
-            description=(
-                "The boolean indicating if the assessor is outside the organization generating claims. A value of false"
-                " indicates a self assessor."
-            ),
-            title="Third Party",
+            description="The date and time (timestamp) when the related cryptographic material was created.",
+            title="Creation Date",
         ),
     ] = None
-    organization: Annotated[
-        Optional[OrganizationalEntity], Field(description="The entity issuing the assessment.", title="Organization")
-    ] = None
-
-
-class Tool(CycloneDXBaseModel):
-    """
-    [Deprecated] This will be removed in a future version. Use component or service instead. Information about the automated or manual tool used
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    vendor: Annotated[
-        Optional[str], Field(description="The name of the vendor who created the tool", title="Tool Vendor")
-    ] = None
-    name: Annotated[Optional[str], Field(description="The name of the tool", title="Tool Name")] = None
-    version: Annotated[
-        Optional[str],
+    activationDate: Annotated[
+        Optional[datetime],
         Field(
-            description="The version of the tool",
-            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
-            max_length=1024,
-            title="Tool Version",
+            description="The date and time (timestamp) when the related cryptographic material was activated.",
+            title="Activation Date",
         ),
     ] = None
-    hashes: Annotated[
-        Optional[List[Hash]], Field(description="The hashes of the tool (if applicable).", title="Hashes")
-    ] = None
-    externalReferences: Annotated[
-        Optional[List[ExternalReference]],
+    updateDate: Annotated[
+        Optional[datetime],
         Field(
-            description=(
-                "External references provide a way to document systems, sites, and information that may be relevant,"
-                " but are not included with the BOM. They may also establish specific relationships within or external"
-                " to the BOM."
-            ),
-            title="External References",
+            description="The date and time (timestamp) when the related cryptographic material was updated.",
+            title="Update Date",
         ),
     ] = None
-
-
-class QuantitativeAnalysis(CycloneDXBaseModel):
-    """
-    A quantitative analysis of the model
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    performanceMetrics: Annotated[
-        Optional[List[PerformanceMetric]],
+    expirationDate: Annotated[
+        Optional[datetime],
         Field(
-            description=(
-                "The model performance metrics being reported. Examples may include accuracy, F1 score, precision,"
-                " top-3 error rates, MSC, etc."
-            ),
-            title="Performance Metrics",
+            description="The date and time (timestamp) when the related cryptographic material expires.",
+            title="Expiration Date",
         ),
     ] = None
-    graphics: Optional[GraphicsCollection] = None
+    value: Annotated[
+        Optional[str], Field(description="The associated value of the cryptographic material.", title="Value")
+    ] = None
+    size: Annotated[
+        Optional[int], Field(description="The size of the cryptographic asset (in bits).", title="Size")
+    ] = None
+    format: Annotated[
+        Optional[str],
+        Field(description="The format of the related cryptographic material (e.g. P8, PEM, DER).", title="Format"),
+    ] = None
+    securedBy: Annotated[
+        Optional[SecuredBy],
+        Field(description="The mechanism by which the cryptographic asset is secured by.", title="Secured By"),
+    ] = None
 
 
-class DataGovernance(CycloneDXBaseModel):
+class Ikev2TransformTypes(CycloneDXBaseModel):
     """
-    Data governance captures information regarding data ownership, stewardship, and custodianship, providing insights into the individuals or entities responsible for managing, overseeing, and safeguarding the data throughout its lifecycle.
+    The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, and additional properties.
     """
 
     class Config:
         extra = Extra.forbid
 
-    custodians: Annotated[
-        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
+    encr: Annotated[
+        Optional[List[RefType]],
+        Field(description="Transform Type 1: encryption algorithms", title="Encryption Algorithm (ENCR)"),
+    ] = None
+    prf: Annotated[
+        Optional[List[RefType]],
+        Field(description="Transform Type 2: pseudorandom functions", title="Pseudorandom Function (PRF)"),
+    ] = None
+    integ: Annotated[
+        Optional[List[RefType]],
+        Field(description="Transform Type 3: integrity algorithms", title="Integrity Algorithm (INTEG)"),
+    ] = None
+    ke: Annotated[
+        Optional[List[RefType]],
         Field(
-            description="Data custodians are responsible for the safe custody, transport, and storage of data.",
-            title="Data Custodians",
+            description=(
+                "Transform Type 4: Key Exchange Method (KE) per RFC9370, formerly called Diffie-Hellman Group (D-H)"
+            ),
+            title="Key Exchange Method (KE)",
         ),
     ] = None
-    stewards: Annotated[
-        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
+    esn: Annotated[
+        Optional[bool],
         Field(
-            description="Data stewards are responsible for data content, context, and associated business rules.",
-            title="Data Stewards",
+            description="Specifies if an Extended Sequence Number (ESN) is used.",
+            title="Extended Sequence Numbers (ESN)",
         ),
     ] = None
-    owners: Annotated[
-        Optional[List[Union[DataGovernanceResponsibleParty1, DataGovernanceResponsibleParty2]]],
-        Field(description="Data owners are concerned with risk and appropriate access to data.", title="Data Owners"),
+    auth: Annotated[
+        Optional[List[RefType]], Field(description="IKEv2 Authentication method", title="IKEv2 Authentication method")
     ] = None
 
 
-class EnergyConsumption(CycloneDXBaseModel):
+class ProtocolProperties(CycloneDXBaseModel):
     """
-    Describes energy consumption information incurred for the specified lifecycle activity.
+    Properties specific to cryptographic assets of type: `protocol`.
     """
 
     class Config:
         extra = Extra.forbid
 
-    activity: Annotated[
-        Activity,
-        Field(
-            description=(
-                "The type of activity that is part of a machine learning model development or operational lifecycle."
-            ),
-            title="Activity",
-        ),
-    ]
-    energyProviders: Annotated[
-        List[EnergyProvider],
-        Field(
-            description=(
-                "The provider(s) of the energy consumed by the associated model development lifecycle activity."
-            ),
-            title="Energy Providers",
-        ),
-    ]
-    activityEnergyCost: Annotated[
-        EnergyMeasure,
-        Field(
-            description="The total energy cost associated with the model lifecycle activity.",
-            title="Activity Energy Cost",
-        ),
-    ]
-    co2CostEquivalent: Annotated[
-        Optional[Co2Measure],
-        Field(description="The CO2 cost (debit) equivalent to the total energy cost.", title="CO2 Equivalent Cost"),
+    type: Annotated[Optional[Type9], Field(description="The concrete protocol type.", title="Type")] = None
+    version: Annotated[
+        Optional[str],
+        Field(description="The version of the protocol.", examples=["1.0", "1.2", "1.99"], title="Protocol Version"),
     ] = None
-    co2CostOffset: Annotated[
-        Optional[Co2Measure],
-        Field(description="The CO2 offset (credit) for the CO2 equivalent cost.", title="CO2 Cost Offset"),
+    cipherSuites: Annotated[
+        Optional[List[CipherSuite]],
+        Field(description="A list of cipher suites related to the protocol.", title="Cipher Suites"),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    ikev2TransformTypes: Annotated[
+        Optional[Ikev2TransformTypes],
         Field(
             description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                "The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, and additional"
+                " properties."
             ),
-            title="Properties",
+            title="IKEv2 Transform Types",
         ),
     ] = None
+    cryptoRefArray: Annotated[
+        Optional[List[RefType]],
+        Field(description="A list of protocol-related cryptographic assets", title="Cryptographic References"),
+    ] = None
 
 
-class Workspace(CycloneDXBaseModel):
+class CryptoProperties(CycloneDXBaseModel):
     """
-    A named filesystem or data resource shareable by workflow tasks.
+    Cryptographic assets have properties that uniquely define them and that make them actionable for further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the algorithm primitive (authenticated encryption) are only defined by the definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference.
     """
 
     class Config:
         extra = Extra.forbid
 
-    bom_ref: Annotated[
-        str,
+    assetType: Annotated[
+        AssetType,
         Field(
-            alias="bom-ref",
             description=(
-                "An optional identifier which can be used to reference the workspace elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
-                " avoid conflicts with BOM-Links."
+                "Cryptographic assets occur in several forms. Algorithms and protocols are most commonly implemented in"
+                " specialized cryptographic libraries. They may, however, also be 'hardcoded' in software components."
+                " Certificates and related cryptographic material like keys, tokens, secrets or passwords are other"
+                " cryptographic assets to be modelled."
             ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ]
-    uid: Annotated[
-        str,
-        Field(
-            description="The unique identifier for the resource instance within its deployment context.",
-            title="Unique Identifier (UID)",
+            title="Asset Type",
         ),
     ]
-    name: Annotated[Optional[str], Field(description="The name of the resource instance.", title="Name")] = None
-    aliases: Annotated[
-        Optional[List[str]],
-        Field(
-            description=(
-                "The names for the workspace as referenced by other workflow tasks. Effectively, a name mapping so"
-                " other tasks can use their own local name in their steps."
-            ),
-            title="Aliases",
-        ),
-    ] = None
-    description: Annotated[
-        Optional[str], Field(description="A description of the resource instance.", title="Description")
-    ] = None
-    resourceReferences: Annotated[
-        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
-        Field(
-            description="References to component or service resources that are used to realize the resource instance.",
-            title="Resource references",
-        ),
-    ] = None
-    accessMode: Annotated[
-        Optional[AccessMode],
-        Field(
-            description=(
-                "Describes the read-write access control for the workspace relative to the owning resource instance."
-            ),
-            title="Access mode",
-        ),
-    ] = None
-    mountPath: Annotated[
-        Optional[str],
-        Field(
-            description=(
-                "A path to a location on disk where the workspace will be available to the associated task's steps."
-            ),
-            title="Mount path",
-        ),
-    ] = None
-    managedDataType: Annotated[
-        Optional[str],
-        Field(
-            description="The name of a domain-specific data type the workspace represents.",
-            examples=["ConfigMap", "Secret"],
-            title="Managed data type",
-        ),
+    algorithmProperties: Annotated[
+        Optional[AlgorithmProperties],
+        Field(description="Additional properties specific to a cryptographic algorithm.", title="Algorithm Properties"),
     ] = None
-    volumeRequest: Annotated[
-        Optional[str],
+    certificateProperties: Annotated[
+        Optional[CertificateProperties],
         Field(
-            description="Identifies the reference to the request for a specific volume type and parameters.",
-            examples=["a kubernetes Persistent Volume Claim (PVC) name"],
-            title="Volume request",
+            description="Properties for cryptographic assets of asset type 'certificate'",
+            title="Certificate Properties",
         ),
     ] = None
-    volume: Annotated[
-        Optional[Volume],
+    relatedCryptoMaterialProperties: Annotated[
+        Optional[RelatedCryptoMaterialProperties],
         Field(
-            description="Information about the actual volume instance allocated to the workspace.",
-            examples=["see https://kubernetes.io/docs/concepts/storage/persistent-volumes/"],
-            title="Volume",
+            description="Properties for cryptographic assets of asset type: `related-crypto-material`",
+            title="Related Cryptographic Material Properties",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    protocolProperties: Annotated[
+        Optional[ProtocolProperties],
         Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
+            description="Properties specific to cryptographic assets of type: `protocol`.", title="Protocol Properties"
         ),
     ] = None
+    oid: Annotated[
+        Optional[str], Field(description="The object identifier (OID) of the cryptographic asset.", title="OID")
+    ] = None
 
 
-class Event(CycloneDXBaseModel):
+class Assessor(CycloneDXBaseModel):
     """
-    Represents something that happened that may trigger a response.
+    The assessor who evaluates claims and determines conformance to requirements and confidence in that assessment.
     """
 
     class Config:
         extra = Extra.forbid
 
-    uid: Annotated[
-        Optional[str], Field(description="The unique identifier of the event.", title="Unique Identifier (UID)")
-    ] = None
-    description: Annotated[Optional[str], Field(description="A description of the event.", title="Description")] = None
-    timeReceived: Annotated[
-        Optional[datetime],
-        Field(description="The date and time (timestamp) when the event was received.", title="Time Received"),
-    ] = None
-    data: Annotated[Optional[Attachment], Field(description="Encoding of the raw event data.", title="Data")] = None
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(description="References the component or service that was the source of the event", title="Source"),
-    ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(description="References the component or service that was the target of the event", title="Target"),
+    bom_ref: Annotated[
+        Optional[str],
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
+                " MUST be unique within the BOM."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    thirdParty: Annotated[
+        Optional[bool],
         Field(
             description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                "The boolean indicating if the assessor is outside the organization generating claims. A value of false"
+                " indicates a self assessor."
             ),
-            title="Properties",
+            title="Third Party",
         ),
     ] = None
+    organization: Annotated[
+        Optional[OrganizationalEntity], Field(description="The entity issuing the assessment.", title="Organization")
+    ] = None
 
 
-class InputType1(CycloneDXBaseModel):
+class Tool(CycloneDXBaseModel):
     """
-    Type that represents various input data types and formats.
+    [Deprecated] This will be removed in a future version. Use component or service instead. Information about the automated or manual tool used
     """
 
     class Config:
         extra = Extra.forbid
 
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    vendor: Annotated[
+        Optional[str], Field(description="The name of the vendor who created the tool", title="Tool Vendor")
+    ] = None
+    name: Annotated[Optional[str], Field(description="The name of the tool", title="Tool Name")] = None
+    version: Annotated[
+        Optional[str],
         Field(
-            description=(
-                "A reference to the component or service that provided the input to the task (e.g., reference to a"
-                " service with data flow value of `inbound`)"
-            ),
-            examples=["source code repository", "database"],
-            title="Source",
+            description="The version of the tool",
+            examples=["9.0.14", "v1.33.7", "7.0.0-M1", "2.0pre1", "1.0.0-beta1", "0.8.15"],
+            max_length=1024,
+            title="Tool Version",
         ),
     ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    hashes: Annotated[
+        Optional[List[Hash]], Field(description="The hashes of the tool (if applicable).", title="Hashes")
+    ] = None
+    externalReferences: Annotated[
+        Optional[List[ExternalReference]],
         Field(
             description=(
-                "A reference to the component or service that received or stored the input if not the task itself"
-                " (e.g., a local, named storage workspace)"
+                "External references provide a way to document systems, sites, and information that may be relevant,"
+                " but are not included with the BOM. They may also establish specific relationships within or external"
+                " to the BOM."
             ),
-            examples=["workspace", "directory"],
-            title="Target",
+            title="External References",
         ),
     ] = None
-    resource: Annotated[
-        Union[ResourceReferenceChoice1, ResourceReferenceChoice2],
+
+
+class QuantitativeAnalysis(CycloneDXBaseModel):
+    """
+    A quantitative analysis of the model
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    performanceMetrics: Annotated[
+        Optional[List[PerformanceMetric]],
         Field(
             description=(
-                "A reference to an independent resource provided as an input to a task by the workflow runtime."
+                "The model performance metrics being reported. Examples may include accuracy, F1 score, precision,"
+                " top-3 error rates, MSC, etc."
             ),
-            examples=[
-                "a reference to a configuration file in a repository (i.e., a bom-ref)",
-                "a reference to a scanning service used in a task (i.e., a bom-ref)",
-            ],
-            title="Resource",
-        ),
-    ]
-    parameters: Annotated[
-        Optional[List[Parameter]],
-        Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Parameters",
+            title="Performance Metrics",
         ),
     ] = None
-    environmentVars: Annotated[
-        Optional[List[Union[Property, str]]],
+    graphics: Optional[GraphicsCollection] = None
+
+
+class DataGovernance(CycloneDXBaseModel):
+    """
+    Data governance captures information regarding data ownership, stewardship, and custodianship, providing insights into the individuals or entities responsible for managing, overseeing, and safeguarding the data throughout its lifecycle.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    custodians: Annotated[
+        Optional[List[DataGovernanceResponsibleParty]],
         Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Environment variables",
+            description="Data custodians are responsible for the safe custody, transport, and storage of data.",
+            title="Data Custodians",
         ),
     ] = None
-    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    stewards: Annotated[
+        Optional[List[DataGovernanceResponsibleParty]],
         Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
+            description="Data stewards are responsible for data content, context, and associated business rules.",
+            title="Data Stewards",
         ),
     ] = None
+    owners: Annotated[
+        Optional[List[DataGovernanceResponsibleParty]],
+        Field(description="Data owners are concerned with risk and appropriate access to data.", title="Data Owners"),
+    ] = None
 
 
-class InputType2(CycloneDXBaseModel):
+class EnergyConsumption(CycloneDXBaseModel):
     """
-    Type that represents various input data types and formats.
+    Describes energy consumption information incurred for the specified lifecycle activity.
     """
 
     class Config:
         extra = Extra.forbid
 
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description=(
-                "A reference to the component or service that provided the input to the task (e.g., reference to a"
-                " service with data flow value of `inbound`)"
-            ),
-            examples=["source code repository", "database"],
-            title="Source",
-        ),
-    ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    activity: Annotated[
+        Activity,
         Field(
             description=(
-                "A reference to the component or service that received or stored the input if not the task itself"
-                " (e.g., a local, named storage workspace)"
+                "The type of activity that is part of a machine learning model development or operational lifecycle."
             ),
-            examples=["workspace", "directory"],
-            title="Target",
+            title="Activity",
         ),
-    ] = None
-    resource: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    ]
+    energyProviders: Annotated[
+        List[EnergyProvider],
         Field(
             description=(
-                "A reference to an independent resource provided as an input to a task by the workflow runtime."
+                "The provider(s) of the energy consumed by the associated model development lifecycle activity."
             ),
-            examples=[
-                "a reference to a configuration file in a repository (i.e., a bom-ref)",
-                "a reference to a scanning service used in a task (i.e., a bom-ref)",
-            ],
-            title="Resource",
-        ),
-    ] = None
-    parameters: Annotated[
-        List[Parameter],
-        Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Parameters",
+            title="Energy Providers",
         ),
     ]
-    environmentVars: Annotated[
-        Optional[List[Union[Property, str]]],
+    activityEnergyCost: Annotated[
+        EnergyMeasure,
         Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Environment variables",
+            description="The total energy cost associated with the model lifecycle activity.",
+            title="Activity Energy Cost",
         ),
+    ]
+    co2CostEquivalent: Annotated[
+        Optional[Co2Measure],
+        Field(description="The CO2 cost (debit) equivalent to the total energy cost.", title="CO2 Equivalent Cost"),
     ] = None
-    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
+    co2CostOffset: Annotated[
+        Optional[Co2Measure],
+        Field(description="The CO2 offset (credit) for the CO2 equivalent cost.", title="CO2 Cost Offset"),
     ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
-class InputType3(CycloneDXBaseModel):
+class Workspace(CycloneDXBaseModel):
     """
-    Type that represents various input data types and formats.
+    A named filesystem or data resource shareable by workflow tasks.
     """
 
     class Config:
         extra = Extra.forbid
 
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    bom_ref: Annotated[
+        str,
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the workspace elsewhere in the BOM. Every"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " avoid conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
+    ]
+    uid: Annotated[
+        str,
+        Field(
+            description="The unique identifier for the resource instance within its deployment context.",
+            title="Unique Identifier (UID)",
+        ),
+    ]
+    name: Annotated[Optional[str], Field(description="The name of the resource instance.", title="Name")] = None
+    aliases: Annotated[
+        Optional[List[str]],
         Field(
             description=(
-                "A reference to the component or service that provided the input to the task (e.g., reference to a"
-                " service with data flow value of `inbound`)"
+                "The names for the workspace as referenced by other workflow tasks. Effectively, a name mapping so"
+                " other tasks can use their own local name in their steps."
             ),
-            examples=["source code repository", "database"],
-            title="Source",
+            title="Aliases",
         ),
     ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    description: Annotated[
+        Optional[str], Field(description="A description of the resource instance.", title="Description")
+    ] = None
+    resourceReferences: Annotated[
+        Optional[List[ResourceReferenceChoice]],
+        Field(
+            description="References to component or service resources that are used to realize the resource instance.",
+            title="Resource references",
+        ),
+    ] = None
+    accessMode: Annotated[
+        Optional[AccessMode],
         Field(
             description=(
-                "A reference to the component or service that received or stored the input if not the task itself"
-                " (e.g., a local, named storage workspace)"
+                "Describes the read-write access control for the workspace relative to the owning resource instance."
             ),
-            examples=["workspace", "directory"],
-            title="Target",
+            title="Access mode",
         ),
     ] = None
-    resource: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+    mountPath: Annotated[
+        Optional[str],
         Field(
             description=(
-                "A reference to an independent resource provided as an input to a task by the workflow runtime."
+                "A path to a location on disk where the workspace will be available to the associated task's steps."
             ),
-            examples=[
-                "a reference to a configuration file in a repository (i.e., a bom-ref)",
-                "a reference to a scanning service used in a task (i.e., a bom-ref)",
-            ],
-            title="Resource",
+            title="Mount path",
         ),
     ] = None
-    parameters: Annotated[
-        Optional[List[Parameter]],
+    managedDataType: Annotated[
+        Optional[str],
         Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Parameters",
+            description="The name of a domain-specific data type the workspace represents.",
+            examples=["ConfigMap", "Secret"],
+            title="Managed data type",
         ),
     ] = None
-    environmentVars: Annotated[
-        List[Union[Property, str]],
+    volumeRequest: Annotated[
+        Optional[str],
         Field(
-            description="Inputs that have the form of parameters with names and values.",
-            title="Environment variables",
+            description="Identifies the reference to the request for a specific volume type and parameters.",
+            examples=["a kubernetes Persistent Volume Claim (PVC) name"],
+            title="Volume request",
         ),
-    ]
-    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
-    properties: Annotated[
-        Optional[List[Property]],
+    ] = None
+    volume: Annotated[
+        Optional[Volume],
         Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
+            description="Information about the actual volume instance allocated to the workspace.",
+            examples=["see https://kubernetes.io/docs/concepts/storage/persistent-volumes/"],
+            title="Volume",
         ),
     ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
+
+
+class Event(CycloneDXBaseModel):
+    """
+    Represents something that happened that may trigger a response.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    uid: Annotated[
+        Optional[str], Field(description="The unique identifier of the event.", title="Unique Identifier (UID)")
+    ] = None
+    description: Annotated[Optional[str], Field(description="A description of the event.", title="Description")] = None
+    timeReceived: Annotated[
+        Optional[datetime],
+        Field(description="The date and time (timestamp) when the event was received.", title="Time Received"),
+    ] = None
+    data: Annotated[Optional[Attachment], Field(description="Encoding of the raw event data.", title="Data")] = None
+    source: Annotated[
+        Optional[ResourceReferenceChoice],
+        Field(description="References the component or service that was the source of the event", title="Source"),
+    ] = None
+    target: Annotated[
+        Optional[ResourceReferenceChoice],
+        Field(description="References the component or service that was the target of the event", title="Target"),
+    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
-class InputType4(CycloneDXBaseModel):
+class InputType(CycloneDXBaseModel):
     """
     Type that represents various input data types and formats.
     """
@@ -4362,7 +3527,7 @@ class InputType4(CycloneDXBaseModel):
         extra = Extra.forbid
 
     source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description=(
                 "A reference to the component or service that provided the input to the task (e.g., reference to a"
@@ -4373,7 +3538,7 @@ class InputType4(CycloneDXBaseModel):
         ),
     ] = None
     target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description=(
                 "A reference to the component or service that received or stored the input if not the task itself"
@@ -4384,7 +3549,7 @@ class InputType4(CycloneDXBaseModel):
         ),
     ] = None
     resource: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description=(
                 "A reference to an independent resource provided as an input to a task by the workflow runtime."
@@ -4410,92 +3575,24 @@ class InputType4(CycloneDXBaseModel):
             title="Environment variables",
         ),
     ] = None
-    data: Annotated[Attachment, Field(description="Inputs that have the form of data.", title="Data")]
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
-
-
-class OutputType1(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description="Component or service that generated or provided the output from the task (e.g., a build tool)",
-            title="Source",
-        ),
-    ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description=(
-                "Component or service that received the output from the task (e.g., reference to an artifactory service"
-                " with data flow value of `outbound`)"
-            ),
-            examples=["a log file described as an `externalReference` within its target domain."],
-            title="Target",
-        ),
-    ] = None
-    resource: Annotated[
-        Union[ResourceReferenceChoice1, ResourceReferenceChoice2],
-        Field(
-            description="A reference to an independent resource generated as output by the task.",
-            examples=["configuration file", "source code", "scanning service"],
-            title="Resource",
-        ),
-    ]
-    data: Annotated[Optional[Attachment], Field(description="Outputs that have the form of data.", title="Data")] = None
-    environmentVars: Annotated[
-        Optional[List[Union[Property, str]]],
-        Field(
-            description="Outputs that have the form of environment variables.",
-            title="Environment variables",
-        ),
-    ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    data: Annotated[Optional[Attachment], Field(description="Inputs that have the form of data.", title="Data")] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
-class OutputType2(CycloneDXBaseModel):
+class OutputType(CycloneDXBaseModel):
     class Config:
         extra = Extra.forbid
 
     type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
     source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description="Component or service that generated or provided the output from the task (e.g., a build tool)",
             title="Source",
         ),
     ] = None
     target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description=(
                 "Component or service that received the output from the task (e.g., reference to an artifactory service"
@@ -4506,7 +3603,7 @@ class OutputType2(CycloneDXBaseModel):
         ),
     ] = None
     resource: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
+        Optional[ResourceReferenceChoice],
         Field(
             description="A reference to an independent resource generated as output by the task.",
             examples=["configuration file", "source code", "scanning service"],
@@ -4514,61 +3611,6 @@ class OutputType2(CycloneDXBaseModel):
         ),
     ] = None
     data: Annotated[Optional[Attachment], Field(description="Outputs that have the form of data.", title="Data")] = None
-    environmentVars: Annotated[
-        List[Union[Property, str]],
-        Field(
-            description="Outputs that have the form of environment variables.",
-            title="Environment variables",
-        ),
-    ]
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
-
-
-class OutputType3(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    type: Annotated[Optional[Type7], Field(description="Describes the type of data output.", title="Type")] = None
-    source: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description="Component or service that generated or provided the output from the task (e.g., a build tool)",
-            title="Source",
-        ),
-    ] = None
-    target: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description=(
-                "Component or service that received the output from the task (e.g., reference to an artifactory service"
-                " with data flow value of `outbound`)"
-            ),
-            examples=["a log file described as an `externalReference` within its target domain."],
-            title="Target",
-        ),
-    ] = None
-    resource: Annotated[
-        Optional[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]],
-        Field(
-            description="A reference to an independent resource generated as output by the task.",
-            examples=["configuration file", "source code", "scanning service"],
-            title="Resource",
-        ),
-    ] = None
-    data: Annotated[Attachment, Field(description="Outputs that have the form of data.", title="Data")]
     environmentVars: Annotated[
         Optional[List[Union[Property, str]]],
         Field(
@@ -4576,20 +3618,7 @@ class OutputType3(CycloneDXBaseModel):
             title="Environment variables",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Signature1(CycloneDXBaseModel):
@@ -4701,7 +3730,7 @@ class ComponentData(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the dataset elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4764,20 +3793,7 @@ class EnvironmentalConsiderations(CycloneDXBaseModel):
             title="Energy Consumptions",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Trigger(CycloneDXBaseModel):
@@ -4794,7 +3810,7 @@ class Trigger(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the trigger elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -4813,7 +3829,7 @@ class Trigger(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
+        Optional[List[ResourceReferenceChoice]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -4829,7 +3845,6 @@ class Trigger(CycloneDXBaseModel):
     conditions: Annotated[
         Optional[List[Condition]],
         Field(
-            description="A list of conditions used to determine if a trigger should be activated.",
             title="Conditions",
         ),
     ] = None
@@ -4838,7 +3853,7 @@ class Trigger(CycloneDXBaseModel):
         Field(description="The date and time (timestamp) when the trigger was activated.", title="Time activated"),
     ] = None
     inputs: Annotated[
-        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
+        Optional[List[InputType]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -4846,27 +3861,14 @@ class Trigger(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
+        Optional[List[OutputType]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
-            examples=["a log file or metrics data produced by the task"],
-            title="Outputs",
-        ),
-    ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
+            examples=["a log file or metrics data produced by the task"],
+            title="Outputs",
         ),
     ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Attestation(CycloneDXBaseModel):
@@ -4912,7 +3914,7 @@ class Claim(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
+                " MUST be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -4933,13 +3935,12 @@ class Claim(CycloneDXBaseModel):
         Optional[str], Field(description="The specific statement or assertion about the target.", title="Predicate")
     ] = None
     mitigationStrategies: Annotated[
-        Optional[List[str]],
+        Optional[List[RefLinkType]],
         Field(
             description=(
                 "The list of  `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation"
                 " strategy should include an explanation of how any weaknesses in the evidence will be mitigated."
             ),
-            min_length=1,
             title="Mitigation Strategies",
         ),
     ] = None
@@ -4951,17 +3952,13 @@ class Claim(CycloneDXBaseModel):
         ),
     ] = None
     evidence: Annotated[
-        Optional[List[str]],
-        Field(
-            description="The list of `bom-ref` to evidence that supports this claim.", min_length=1, title="Evidence"
-        ),
+        Optional[List[RefLinkType]],
+        Field(description="The list of `bom-ref` to evidence that supports this claim.", title="Evidence"),
     ] = None
     counterEvidence: Annotated[
-        Optional[List[str]],
+        Optional[List[RefLinkType]],
         Field(
-            description="The list of `bom-ref` to counterEvidence that supports this claim.",
-            min_length=1,
-            title="Counter Evidence",
+            description="The list of `bom-ref` to counterEvidence that supports this claim.", title="Counter Evidence"
         ),
     ] = None
     externalReferences: Annotated[
@@ -4997,7 +3994,7 @@ class Evidence(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
+                " MUST be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -5050,79 +4047,7 @@ class Evidence(CycloneDXBaseModel):
     ] = None
 
 
-class Signatories(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    name: Annotated[Optional[str], Field(description="The signatory's name.", title="Name")] = None
-    role: Annotated[
-        Optional[str], Field(description="The signatory's role within an organization.", title="Role")
-    ] = None
-    signature: Annotated[
-        Union[Signature1, Signature2, Signer],
-        Field(
-            description=(
-                "Enveloped signature in [JSON Signature Format"
-                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
-            ),
-            title="Signature",
-        ),
-    ]
-    organization: Annotated[
-        Optional[OrganizationalEntity], Field(description="The signatory's organization.", title="Organization")
-    ] = None
-    externalReference: Annotated[
-        Optional[ExternalReference],
-        Field(
-            description=(
-                "External references provide a way to document systems, sites, and information that may be relevant but"
-                " are not included with the BOM. They may also establish specific relationships within or external to"
-                " the BOM."
-            ),
-            title="External Reference",
-        ),
-    ] = None
-
-
-class Signatories1(CycloneDXBaseModel):
-    class Config:
-        extra = Extra.forbid
-
-    name: Annotated[Optional[str], Field(description="The signatory's name.", title="Name")] = None
-    role: Annotated[
-        Optional[str], Field(description="The signatory's role within an organization.", title="Role")
-    ] = None
-    signature: Annotated[
-        Optional[Union[Signature1, Signature2, Signer]],
-        Field(
-            description=(
-                "Enveloped signature in [JSON Signature Format"
-                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
-            ),
-            title="Signature",
-        ),
-    ] = None
-    organization: Annotated[
-        OrganizationalEntity, Field(description="The signatory's organization.", title="Organization")
-    ]
-    externalReference: Annotated[
-        ExternalReference,
-        Field(
-            description=(
-                "External references provide a way to document systems, sites, and information that may be relevant but"
-                " are not included with the BOM. They may also establish specific relationships within or external to"
-                " the BOM."
-            ),
-            title="External Reference",
-        ),
-    ]
-
-
 class Affirmation(CycloneDXBaseModel):
-    """
-    A concise statement affirmed by an individual regarding all declarations, often used for third-party auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who assert the validity of the document on behalf of the organization.
-    """
-
     class Config:
         extra = Extra.forbid
 
@@ -5138,7 +4063,7 @@ class Affirmation(CycloneDXBaseModel):
         ),
     ] = None
     signatories: Annotated[
-        Optional[List[Union[Signatories, Signatories1]]],
+        Optional[List],
         Field(
             description=(
                 "The list of signatories authorized on behalf of an organization to assert validity of this document."
@@ -5168,7 +4093,7 @@ class Service(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5261,7 +4186,7 @@ class Service(CycloneDXBaseModel):
             description=(
                 "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)"
             ),
-            title="Service License(s)",
+            title="Component License(s)",
         ),
     ] = None
     externalReferences: Annotated[
@@ -5297,7 +4222,7 @@ class Service(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
@@ -5335,7 +4260,7 @@ class Compositions(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the composition elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5390,6 +4315,53 @@ class Compositions(CycloneDXBaseModel):
     ] = None
 
 
+class Annotations(CycloneDXBaseModel):
+    """
+    A comment, note, explanation, or similar textual content which provides additional context to the object(s) being annotated.
+    """
+
+    class Config:
+        extra = Extra.forbid
+
+    bom_ref: Annotated[
+        Optional[str],
+        Field(
+            alias="bom-ref",
+            description=(
+                "An optional identifier which can be used to reference the annotation elsewhere in the BOM. Every"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " avoid conflicts with BOM-Links."
+            ),
+            min_length=1,
+            title="BOM Reference",
+        ),
+    ] = None
+    subjects: Annotated[
+        List[Union[RefLinkType, BomLinkElementType]],
+        Field(
+            description=(
+                "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any"
+                " object type supporting bom-refs."
+            ),
+            title="Subjects",
+        ),
+    ]
+    timestamp: Annotated[
+        datetime, Field(description="The date and time (timestamp) when the annotation was created.", title="Timestamp")
+    ]
+    text: Annotated[str, Field(description="The textual content of the annotation.", title="Text")]
+    signature: Annotated[
+        Optional[Union[Signature1, Signature2, Signer]],
+        Field(
+            description=(
+                "Enveloped signature in [JSON Signature Format"
+                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
+            ),
+            title="Signature",
+        ),
+    ] = None
+
+
 class ModelParameters(CycloneDXBaseModel):
     """
     Hyper-parameters for construction of the model.
@@ -5430,7 +4402,7 @@ class ModelParameters(CycloneDXBaseModel):
         ),
     ] = None
     datasets: Annotated[
-        Optional[List[Union[ComponentData, Datasets]]],
+        Optional[List[Union[ComponentData, Dataset]]],
         Field(description="The datasets used to train and evaluate the model.", title="Datasets"),
     ] = None
     inputs: Annotated[
@@ -5504,7 +4476,7 @@ class Considerations(CycloneDXBaseModel):
 
 class ModelCard(CycloneDXBaseModel):
     """
-    A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.
+    A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and MUST NOT be specified for other component types.
     """
 
     class Config:
@@ -5516,7 +4488,7 @@ class ModelCard(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the model card elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5550,7 +4522,7 @@ class ModelCard(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
@@ -5571,7 +4543,7 @@ class Task(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the task elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5590,7 +4562,7 @@ class Task(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
+        Optional[List[ResourceReferenceChoice]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -5613,7 +4585,7 @@ class Task(CycloneDXBaseModel):
         ),
     ] = None
     inputs: Annotated[
-        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
+        Optional[List[InputType]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -5621,7 +4593,7 @@ class Task(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
+        Optional[List[OutputType]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
             examples=["a log file or metrics data produced by the task"],
@@ -5649,20 +4621,7 @@ class Task(CycloneDXBaseModel):
             title="Runtime topology",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Standard(CycloneDXBaseModel):
@@ -5679,7 +4638,7 @@ class Standard(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM."
+                " MUST be unique within the BOM."
             ),
             min_length=1,
             title="BOM Reference",
@@ -5771,7 +4730,7 @@ class Workflow(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the workflow elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -5790,7 +4749,7 @@ class Workflow(CycloneDXBaseModel):
         Optional[str], Field(description="A description of the resource instance.", title="Description")
     ] = None
     resourceReferences: Annotated[
-        Optional[List[Union[ResourceReferenceChoice1, ResourceReferenceChoice2]]],
+        Optional[List[ResourceReferenceChoice]],
         Field(
             description="References to component or service resources that are used to realize the resource instance.",
             title="Resource references",
@@ -5827,7 +4786,7 @@ class Workflow(CycloneDXBaseModel):
         ),
     ] = None
     inputs: Annotated[
-        Optional[List[Union[InputType1, InputType2, InputType3, InputType4]]],
+        Optional[List[InputType]],
         Field(
             description="Represents resources and data brought into a task at runtime by executor or task commands",
             examples=["a `configuration` file which was declared as a local `component` or `externalReference`"],
@@ -5835,7 +4794,7 @@ class Workflow(CycloneDXBaseModel):
         ),
     ] = None
     outputs: Annotated[
-        Optional[List[Union[OutputType1, OutputType2, OutputType3]]],
+        Optional[List[OutputType]],
         Field(
             description="Represents resources and data output from a task at runtime by executor or task commands",
             examples=["a log file or metrics data produced by the task"],
@@ -5863,20 +4822,7 @@ class Workflow(CycloneDXBaseModel):
             title="Runtime topology",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 class Targets(CycloneDXBaseModel):
@@ -5931,17 +4877,7 @@ class Declarations(CycloneDXBaseModel):
     targets: Annotated[
         Optional[Targets], Field(description="The list of targets which claims are made against.", title="Targets")
     ] = None
-    affirmation: Annotated[
-        Optional[Affirmation],
-        Field(
-            description=(
-                "A concise statement affirmed by an individual regarding all declarations, often used for third-party"
-                " auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who"
-                " assert the validity of the document on behalf of the organization."
-            ),
-            title="Affirmation",
-        ),
-    ] = None
+    affirmation: Annotated[Optional[Affirmation], Field(title="Affirmation")] = None
     signature: Annotated[
         Optional[Union[Signature1, Signature2, Signer]],
         Field(
@@ -5964,7 +4900,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         Field(
             description=(
                 "Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOMs do not have a"
-                ' filename convention, nor does JSON schema support namespaces. This value must be "CycloneDX".'
+                ' filename convention, nor does JSON schema support namespaces. This value MUST be "CycloneDX".'
             ),
             title="BOM Format",
         ),
@@ -5973,7 +4909,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         str,
         Field(
             description="The version of the CycloneDX specification the BOM conforms to.",
-            examples=["1.6.1"],
+            examples=["1.6"],
             title="CycloneDX Specification Version",
         ),
     ]
@@ -5982,8 +4918,8 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
         Field(
             description=(
                 "Every BOM generated SHOULD have a unique serial number, even if the contents of the BOM have not"
-                " changed over time. If specified, the serial number must conform to [RFC"
-                " 4122](https://www.ietf.org/rfc/rfc4122.html). Use of serial numbers is recommended."
+                " changed over time. If specified, the serial number MUST conform to RFC-4122. Use of serial numbers is"
+                " RECOMMENDED."
             ),
             examples=["urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"],
             regex="^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
@@ -6109,7 +5045,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
@@ -6126,7 +5062,7 @@ class CyclonedxBillOfMaterialsStandard(CycloneDXBaseModel):
     ] = None
 
 
-class Tools(CycloneDXBaseModel):
+class ToolModel(CycloneDXBaseModel):
     """
     The tool(s) used in the creation, enrichment, and validation of the BOM.
     """
@@ -6162,7 +5098,7 @@ class Metadata(CycloneDXBaseModel):
         Field(description="The date and time (timestamp) when the BOM was created.", title="Timestamp"),
     ] = None
     lifecycles: Annotated[
-        Optional[List[Union[Lifecycles, Lifecycles1]]],
+        Optional[List[Union[Lifecycle, Lifecycle1]]],
         Field(
             description=(
                 "Lifecycles communicate the stage(s) in which data in the BOM was captured. Different types of data may"
@@ -6174,7 +5110,7 @@ class Metadata(CycloneDXBaseModel):
         ),
     ] = None
     tools: Annotated[
-        Optional[Union[Tools, List[Tool]]],
+        Optional[Union[ToolModel, List[Tool]]],
         Field(description="The tool(s) used in the creation, enrichment, and validation of the BOM.", title="Tools"),
     ] = None
     manufacturer: Annotated[
@@ -6239,7 +5175,7 @@ class Metadata(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
@@ -6353,7 +5289,7 @@ class Component(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the component elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -6496,7 +5432,7 @@ class Component(CycloneDXBaseModel):
         Optional[str],
         Field(
             description=(
-                "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid"
+                "Asserts the identity of the component using package-url (purl). The purl, if specified, MUST be valid"
                 " and conform to the specification defined at:"
                 " [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to"
                 " `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
@@ -6510,7 +5446,7 @@ class Component(CycloneDXBaseModel):
         Optional[List[str]],
         Field(
             description=(
-                "Asserts the identity of the component using the OmniBOR Artifact ID. The OmniBOR, if specified, must"
+                "Asserts the identity of the component using the OmniBOR Artifact ID. The OmniBOR, if specified, MUST"
                 " be valid and conform to the specification defined at:"
                 " [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)."
                 " Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
@@ -6528,13 +5464,13 @@ class Component(CycloneDXBaseModel):
         Field(
             description=(
                 "Asserts the identity of the component using the Software Heritage persistent identifier (SWHID). The"
-                " SWHID, if specified, must be valid and conform to the specification defined at:"
+                " SWHID, if specified, MUST be valid and conform to the specification defined at:"
                 " [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html)."
                 " Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the"
                 " component's identity."
             ),
             examples=["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"],
-            title="Software Heritage Identifier",
+            title="SoftWare Heritage Identifier",
         ),
     ] = None
     swid: Annotated[
@@ -6611,7 +5547,7 @@ class Component(CycloneDXBaseModel):
         Optional[List[ComponentData]],
         Field(
             description=(
-                "This object SHOULD be specified for any component of type `data` and must not be specified for other"
+                "This object SHOULD be specified for any component of type `data` and MUST NOT be specified for other"
                 " component types."
             ),
             title="Data",
@@ -6627,7 +5563,7 @@ class Component(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
@@ -6655,7 +5591,7 @@ class Component(CycloneDXBaseModel):
     ] = None
 
 
-class Tools1(CycloneDXBaseModel):
+class Tool1(CycloneDXBaseModel):
     """
     The tool(s) used to identify, confirm, or score the vulnerability.
     """
@@ -6696,7 +5632,7 @@ class Vulnerability(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the vulnerability elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
+                " bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
                 " avoid conflicts with BOM-Links."
             ),
             min_length=1,
@@ -6730,11 +5666,10 @@ class Vulnerability(CycloneDXBaseModel):
         Optional[List[Rating]], Field(description="List of vulnerability ratings", title="Ratings")
     ] = None
     cwes: Annotated[
-        Optional[List[int]],
+        Optional[List[Cwe]],
         Field(
             description="List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.",
             examples=[399],
-            ge=1,
             title="CWEs",
         ),
     ] = None
@@ -6814,7 +5749,7 @@ class Vulnerability(CycloneDXBaseModel):
         ),
     ] = None
     tools: Annotated[
-        Optional[Union[Tools1, List[Tool]]],
+        Optional[Union[Tool1, List[Tool]]],
         Field(description="The tool(s) used to identify, confirm, or score the vulnerability.", title="Tools"),
     ] = None
     analysis: Annotated[
@@ -6839,143 +5774,13 @@ class Vulnerability(CycloneDXBaseModel):
                 " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
                 " having different values. Property names of interest to the general public are encouraged to be"
                 " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
+                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is OPTIONAL."
             ),
             title="Properties",
         ),
     ] = None
 
 
-class Annotator(CycloneDXBaseModel):
-    """
-    The organization, person, component, or service which created the textual content of the annotation.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[OrganizationalEntity, Field(description="The organization that created the annotation")]
-    individual: Annotated[
-        Optional[OrganizationalContact], Field(description="The person that created the annotation")
-    ] = None
-    component: Annotated[
-        Optional[Component], Field(description="The tool or component that created the annotation")
-    ] = None
-    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
-
-
-class Annotator1(CycloneDXBaseModel):
-    """
-    The organization, person, component, or service which created the textual content of the annotation.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
-    ] = None
-    individual: Annotated[OrganizationalContact, Field(description="The person that created the annotation")]
-    component: Annotated[
-        Optional[Component], Field(description="The tool or component that created the annotation")
-    ] = None
-    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
-
-
-class Annotator2(CycloneDXBaseModel):
-    """
-    The organization, person, component, or service which created the textual content of the annotation.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
-    ] = None
-    individual: Annotated[
-        Optional[OrganizationalContact], Field(description="The person that created the annotation")
-    ] = None
-    component: Annotated[Component, Field(description="The tool or component that created the annotation")]
-    service: Annotated[Optional[Service], Field(description="The service that created the annotation")] = None
-
-
-class Annotator3(CycloneDXBaseModel):
-    """
-    The organization, person, component, or service which created the textual content of the annotation.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    organization: Annotated[
-        Optional[OrganizationalEntity], Field(description="The organization that created the annotation")
-    ] = None
-    individual: Annotated[
-        Optional[OrganizationalContact], Field(description="The person that created the annotation")
-    ] = None
-    component: Annotated[
-        Optional[Component], Field(description="The tool or component that created the annotation")
-    ] = None
-    service: Annotated[Service, Field(description="The service that created the annotation")]
-
-
-class Annotations(CycloneDXBaseModel):
-    """
-    A comment, note, explanation, or similar textual content which provides additional context to the object(s) being annotated.
-    """
-
-    class Config:
-        extra = Extra.forbid
-
-    bom_ref: Annotated[
-        Optional[str],
-        Field(
-            alias="bom-ref",
-            description=(
-                "An optional identifier which can be used to reference the annotation elsewhere in the BOM. Every"
-                " bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to"
-                " avoid conflicts with BOM-Links."
-            ),
-            min_length=1,
-            title="BOM Reference",
-        ),
-    ] = None
-    subjects: Annotated[
-        List[Union[RefLinkType, BomLinkElementType]],
-        Field(
-            description=(
-                "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any"
-                " object type supporting bom-refs."
-            ),
-            title="Subjects",
-        ),
-    ]
-    annotator: Annotated[
-        Union[Annotator, Annotator1, Annotator2, Annotator3],
-        Field(
-            description=(
-                "The organization, person, component, or service which created the textual content of the annotation."
-            ),
-            title="Annotator",
-        ),
-    ]
-    timestamp: Annotated[
-        datetime, Field(description="The date and time (timestamp) when the annotation was created.", title="Timestamp")
-    ]
-    text: Annotated[str, Field(description="The textual content of the annotation.", title="Text")]
-    signature: Annotated[
-        Optional[Union[Signature1, Signature2, Signer]],
-        Field(
-            description=(
-                "Enveloped signature in [JSON Signature Format"
-                " (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
-            ),
-            title="Signature",
-        ),
-    ] = None
-
-
 class Formula(CycloneDXBaseModel):
     """
     Describes workflows and resources that captures rules and other aspects of how the associated BOM component or service was formed.
@@ -6990,7 +5795,7 @@ class Formula(CycloneDXBaseModel):
             alias="bom-ref",
             description=(
                 "An optional identifier which can be used to reference the formula elsewhere in the BOM. Every bom-ref"
-                " must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
+                " MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid"
                 " conflicts with BOM-Links."
             ),
             min_length=1,
@@ -7025,25 +5830,12 @@ class Formula(CycloneDXBaseModel):
             title="Workflows",
         ),
     ] = None
-    properties: Annotated[
-        Optional[List[Property]],
-        Field(
-            description=(
-                "Provides the ability to document properties in a name-value store. This provides flexibility to"
-                " include data not officially supported in the standard without having to use additional namespaces or"
-                " create extensions. Unlike key-value stores, properties support duplicate names, each potentially"
-                " having different values. Property names of interest to the general public are encouraged to be"
-                " registered in the [CycloneDX Property"
-                " Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional."
-            ),
-            title="Properties",
-        ),
-    ] = None
+    properties: Annotated[Optional[List[Property]], Field(title="Properties")] = None
 
 
 Service.update_forward_refs()
 Targets.update_forward_refs()
 CyclonedxBillOfMaterialsStandard.update_forward_refs()
-Tools.update_forward_refs()
+ToolModel.update_forward_refs()
 Metadata.update_forward_refs()
 Pedigree.update_forward_refs()