feat: Add missing provides mapping to Dependency to comply with CycloneDX 1.6 spec

Author: vibe13

src/main/java/org/cyclonedx/model/Dependency.java

@@ -18,6 +18,7 @@
  */
 package org.cyclonedx.model;
 
+import org.cyclonedx.Version;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -36,6 +37,11 @@ public class Dependency extends BomReference {
     @JacksonXmlProperty(localName = "dependency")
     private List<Dependency> dependencies;
 
+    @VersionFilter(Version.VERSION_16)
+    @JsonProperty("provides")
+    @JacksonXmlProperty(localName = "provides")
+    private List<Dependency> provides;
+
     public Dependency(final String ref) {
         super(ref);
     }
@@ -60,6 +66,26 @@ public void addDependency(final Dependency dependency) {
         }
     }
 
+    @VersionFilter(Version.VERSION_16)
+    public List<Dependency> getProvides() {
+        return provides;
+    }
+
+    @VersionFilter(Version.VERSION_16)
+    public void setProvides(final List<Dependency> provides) {
+        this.provides = provides;
+    }
+
+    @VersionFilter(Version.VERSION_16)
+    public void addProvides(final Dependency dependency) {
+        if (provides == null) {
+            provides = new ArrayList<>();
+        }
+        boolean found = provides.stream().anyMatch(d -> d.getRef().equals(dependency.getRef()));
+        if (!found) {
+            provides.add(dependency);
+        }
+    }
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;

src/main/java/org/cyclonedx/util/serializer/DependencySerializer.java

@@ -97,6 +97,13 @@ private void writeJSONDependenciesWithGenerator(final JsonGenerator generator, f
             }
           }
           generator.writeEndArray();
+          if (CollectionUtils.isNotEmpty(dependency.getProvides())) {
+            generator.writeArrayFieldStart("provides");
+            for (Dependency subDependency : dependency.getProvides()) {
+              generator.writeString(subDependency.getRef());
+            }
+            generator.writeEndArray();
+          }
           generator.writeEndObject();
         }
       }
@@ -141,6 +148,12 @@ private void writeXMLDependency(final Dependency dependency, final ToXmlGenerato
       }
     }
 
+    if (CollectionUtils.isNotEmpty(dependency.getProvides())) {
+      for (Dependency subDependency : dependency.getProvides()) {
+        writeXMLDependency(subDependency, generator);
+      }
+    }
+
     if (CollectionUtils.isNotEmpty(dependency.getDependencies())) {
     generator.writeEndArray();
   }

src/test/resources/1.6/valid-dependency-1.6.json

@@ -22,6 +22,12 @@
       "type": "library",
       "name": "library-c",
       "version": "1.0.0"
+    },
+    {
+      "bom-ref": "library-d",
+      "type": "library",
+      "name": "library-d",
+      "version": "1.0.0"
     }
   ],
   "dependencies": [
@@ -34,6 +40,12 @@
       "dependsOn": [
         "library-c"
       ]
+    },
+    {
+      "ref": "library-c",
+      "provides": [
+        "library-d"
+      ]
     }
   ]
 }

src/test/resources/1.6/valid-dependency-1.6.textproto

@@ -22,6 +22,12 @@ components {
   name: "library-c"
   version: "1.0.0"
 }
+components {
+  type: CLASSIFICATION_LIBRARY
+  bom_ref: "library-d"
+  name: "library-d"
+  version: "1.0.0"
+}
 dependencies {
   ref: "library-a"
 }
@@ -31,3 +37,8 @@ dependencies {
     ref: "library-c"
   }
 }
+dependencies {
+    ref: "library-c"
+    provides: ["library-d"]
+  }
+}

src/test/resources/1.6/valid-dependency-1.6.xml

@@ -13,11 +13,18 @@
             <name>library-c</name>
             <version>1.0.0</version>
         </component>
+        <component type="library" bom-ref="library-d">
+            <name>library-d</name>
+            <version>1.0.0</version>
+        </component>
     </components>
     <dependencies>
         <dependency ref="library-a"/>
         <dependency ref="library-b">
             <dependency ref="library-c"/>
         </dependency>
+        <dependency ref="library-c">
+            <provides ref="library-d"/>
+        </dependency>
     </dependencies>
 </bom>