chore: update latest cyclonedx library (#1390)

syft/formats/common/cyclonedxhelpers/decoder.go

@@ -216,7 +216,7 @@ func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]int
 		}
 
 		for _, t := range *d.Dependencies {
-			to, toExists := idMap[t.Ref].(artifact.Identifiable)
+			to, toExists := idMap[t].(artifact.Identifiable)
 			if !toExists {
 				continue
 			}

syft/formats/common/cyclonedxhelpers/decoder_test.go

@@ -173,12 +173,8 @@ func Test_decode(t *testing.T) {
 				},
 				Dependencies: &[]cyclonedx.Dependency{
 					{
-						Ref: "p1",
-						Dependencies: &[]cyclonedx.Dependency{
-							{
-								Ref: "p2",
-							},
-						},
+						Ref:          "p1",
+						Dependencies: &[]string{"p2"},
 					},
 				},
 			},
@@ -263,8 +259,9 @@ func Test_decode(t *testing.T) {
 
 func Test_missingDataDecode(t *testing.T) {
 	bom := &cyclonedx.BOM{
-		Metadata:   nil,
-		Components: &[]cyclonedx.Component{},
+		Metadata:    nil,
+		Components:  &[]cyclonedx.Component{},
+		SpecVersion: cyclonedx.SpecVersion1_4,
 	}
 
 	_, err := ToSyftModel(bom)
@@ -287,7 +284,9 @@ func Test_missingDataDecode(t *testing.T) {
 }
 
 func Test_missingComponentsDecode(t *testing.T) {
-	bom := &cyclonedx.BOM{}
+	bom := &cyclonedx.BOM{
+		SpecVersion: cyclonedx.SpecVersion1_4,
+	}
 	bomBytes, _ := json.Marshal(&bom)
 	decode := GetDecoder(cyclonedx.BOMFileFormatJSON)
 

syft/formats/common/cyclonedxhelpers/format.go

@@ -157,8 +157,10 @@ func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependenc
 			continue
 		}
 
-		innerDeps := []cyclonedx.Dependency{}
-		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: deriveBomRef(*fromPkg)})
+		// ind dep
+
+		innerDeps := []string{}
+		innerDeps = append(innerDeps, deriveBomRef(*fromPkg))
 		result = append(result, cyclonedx.Dependency{
 			Ref:          deriveBomRef(*toPkg),
 			Dependencies: &innerDeps,