v4 features

[jkowalleck]

v4.0.0-RC0

• find lowest boundaries, after implementation is done, so that the lowest reasonable versions of composer-api and dependencies can be specified
• have a proper reimplementation -
  • basics see basic reimplement #254
  • metadata.tool
  • see the demo data results and how they differ !
  • omit plugins
• reproducible output - or add creation date etc ...
• have all planned features implemented: https://github.com/CycloneDX/cyclonedx-php-composer/milestone/5
• have reasonable tests - besides the demos that are integration-test-like
• update the docs
• update the changelog
• pin the used version of the CDX php lib

---

• BREAKING changes
  • Removed support for PHP <8.0 (#91 via #250)
  • Removed support for PHP <8.1 (via #250)
  • Removed support for Composer <2.3 (#153 via #250)
  • CLI
    • Removed deprecated composer command make-bom, call composer CycloneDX:make-sbom instead (#293 via #309)
    • Changed option output-file to default to - now, which causes to print to STDOUT (via #250)
    • Removed option exclude-dev in favour of new option omit (via #250)
    • Removed option exclude-plugins in favour of new option omit (via #250)
    • Removed option no-version-normalization (#102 via #250)
  • SBOM results
    • Components' version is no longer artificially normalized (#102 via #250)
  • Dependencies
    • Requires cyclonedx/cyclonedx-library:^2.0, was :^1.4.2 (#128 via #250)
• Changed
  • Evidence analysis prefers actually installed packages over lock file (#122 via #250)
  • Root component's versions is unset, if version detection fails (#154 via #250)
  • Composer packages of type "composer-installer" are treated as composer plugins (via #250)
• Added
  • Evidence collection knows actually installed packages (#122 via #250)
  • SBOM results
    • Support for CycloneDX Spec v1.4 (via #250)
    • might have serialnumber populated (#279 via #250)
    • might have metadata.timestamp populated (#112 via #250)
    • might have metadata.tools[].tool.externalReferences populated (#171 via #250)
    • might have components[].component.author populated (#261 via #250)
    • might have components[].component.properties populated according to cdx:composer Namespace Taxonomy (via #250)
  • CLI
    • New option omit (via #250)
    • New switch validate to override no-validate (via #250)
    • New switches output-reproducible and no-output-reproducible (via #250)
• Misc
  • Added demo and reproducible continuous integration test "devReq" that is dedicated to composer's require-dev feature (via #250)
  • Reworked demo setups to be more global-install like (via #250)