CycloneDX · coderpatros · Mar 31, 2026 · Mar 31, 2026 · Mar 31, 2026
diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v4.2.2
       - uses: actions/setup-dotnet@v4.3.1
         with:
-          dotnet-version: '8.0'
+          dotnet-version: '10.0'
 
       - name: Build
         run: dotnet build /WarnAsError
@@ -34,20 +34,20 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        runtime: [linux-x64, linux-musl-x64, linux-arm, linux-arm64, win-x64, win-x86, win-arm64, osx-x64, osx-arm64]
+        runtime: [linux-x64, linux-musl-x64, linux-arm, linux-arm64, linux-musl-arm, win-x64, win-x86, win-arm64, osx-x64, osx-arm64]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4.2.2
       - uses: actions/setup-dotnet@v4.3.1
         with:
-          dotnet-version: '8.0'
+          dotnet-version: '10.0'
 
       - name: Build
         run: dotnet build src/cyclonedx/cyclonedx.csproj -r ${{ matrix.runtime }}
 
   # Fail if there are any failed tests
   #
-  # We support .NET 8.0 on Windows, Mac and Linux.
+  # We support .NET 10.0 on Windows, Mac and Linux.
   #
   # To check for failing tests locally run `dotnet test`.
   test:
@@ -64,7 +64,7 @@ jobs:
     - uses: actions/checkout@v4.2.2
     - uses: actions/setup-dotnet@v4.3.1
       with:
-        dotnet-version: '8.0'
+        dotnet-version: '10.0'
 
     - name: SnapshooterHotfixSymlinkLinux    
       if: matrix.os == 'ubuntu-latest'
@@ -78,4 +78,4 @@ jobs:
     - name: Tests
       run: |
         dotnet restore
-        dotnet test --framework net8.0
+        dotnet test --framework net10.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
       - uses: actions/setup-dotnet@v4.3.1
         with:
-          dotnet-version: '8.0'
+          dotnet-version: '10.0'
       - name: SnapshooterHotfixSymlinkLinux    
         run: sudo ln -s "$GITHUB_WORKSPACE" /_
         shell: bash
@@ -62,7 +62,7 @@ jobs:
           REPO=cyclonedx/cyclonedx-cli
           dotnet build --configuration Release
           mkdir bin
-          for runtime in linux-x64 linux-musl-x64 linux-arm linux-arm64 win-x64 win-x86 win-arm64 osx-x64
+          for runtime in linux-x64 linux-musl-x64 linux-arm linux-arm64 linux-musl-arm win-x64 win-x86 win-arm64 osx-x64
           do
             dotnet publish src/cyclonedx/cyclonedx.csproj -r $runtime --configuration Release /p:Version=$VERSION --self-contained true /p:PublishSingleFile=true /p:IncludeNativeLibrariesInSingleFile=true /p:IncludeNativeLibrariesForSelfExtract=true --output bin/$runtime
           done
@@ -133,6 +133,16 @@ jobs:
           asset_name: cyclonedx-linux-arm64
           asset_content_type: application/octet-stream
 
+      - name: Upload binary to github release
+        uses: actions/upload-release-asset@v1.0.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: bin/linux-musl-arm/cyclonedx
+          asset_name: cyclonedx-linux-musl-arm
+          asset_content_type: application/octet-stream
+
       - name: Upload binary to github release
         uses: actions/upload-release-asset@v1.0.2
         env:
@@ -186,7 +196,7 @@ jobs:
       - uses: actions/checkout@v4.2.2
       - uses: actions/setup-dotnet@v4.3.1
         with:
-          dotnet-version: '8.0'
+          dotnet-version: '10.0'
 
       - name: Create binary
         run: |

diff --git a/src/cyclonedx/AssemblyInfo.cs b/src/cyclonedx/AssemblyInfo.cs
@@ -1 +1,2 @@
-[assembly:System.CLSCompliant(false)]
+[assembly:System.CLSCompliant(false)]
+[assembly:System.Runtime.CompilerServices.InternalsVisibleTo("cyclonedx.tests")]
diff --git a/src/cyclonedx/Commands/Add/AddFilesCommand.cs b/src/cyclonedx/Commands/Add/AddFilesCommand.cs
@@ -33,7 +33,7 @@
 
 namespace CycloneDX.Cli.Commands.Add
 {
-    public static class AddFilesCommand
+    internal static class AddFilesCommand
     {
         public static void Configure(System.CommandLine.Command rootCommand)
         {

diff --git a/src/cyclonedx/Commands/Add/AddFilesCommandOption.cs b/src/cyclonedx/Commands/Add/AddFilesCommandOption.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands.Add
 {
-    public class AddFilesCommandOptions
+    internal class AddFilesCommandOptions
     {
         public string InputFile { get; set; }
         public bool NoInput { get; set; }

diff --git a/src/cyclonedx/Commands/AddCommand.cs b/src/cyclonedx/Commands/AddCommand.cs
@@ -21,7 +21,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class AddCommand
+    internal static class AddCommand
     {
         public static void Configure(RootCommand rootCommand)
         {

diff --git a/src/cyclonedx/Commands/AnalyzeCommandOptions.cs b/src/cyclonedx/Commands/AnalyzeCommandOptions.cs
@@ -17,7 +17,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class AnalyzeCommandOptions
+    internal class AnalyzeCommandOptions
     {
         public string InputFile { get; set; }
         public CycloneDXBomFormat InputFormat { get; set; }

diff --git a/src/cyclonedx/Commands/CommandOutputFormat.cs b/src/cyclonedx/Commands/CommandOutputFormat.cs
@@ -16,7 +16,7 @@
 // Copyright (c) OWASP Foundation. All Rights Reserved.
 namespace CycloneDX.Cli.Commands
 {
-    public enum CommandOutputFormat
+    internal enum CommandOutputFormat
     {
         text,
         json

diff --git a/src/cyclonedx/Commands/ConvertCommand.cs b/src/cyclonedx/Commands/ConvertCommand.cs
@@ -24,7 +24,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class ConvertCommand
+    internal static class ConvertCommand
     {
         internal static void Configure(RootCommand rootCommand)
         {

diff --git a/src/cyclonedx/Commands/ConvertCommandOptions.cs b/src/cyclonedx/Commands/ConvertCommandOptions.cs
@@ -17,7 +17,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class ConvertCommandOptions
+    internal class ConvertCommandOptions
     {
         public string InputFile { get; set; }
         public string OutputFile { get; set; }

diff --git a/src/cyclonedx/Commands/ConvertFormat.cs b/src/cyclonedx/Commands/ConvertFormat.cs
@@ -17,6 +17,7 @@
 namespace CycloneDX.Cli.Commands
 {
     // WARNING: keep this in sync with BomFormat
+#pragma warning disable CA1515 // Used as public test method parameters
     public enum ConvertFormat
     {
         autodetect,
@@ -26,4 +27,5 @@ public enum ConvertFormat
         csv,
         spdxjson,
     }
+#pragma warning restore CA1515
 }
diff --git a/src/cyclonedx/Commands/CycloneDXBomFormat.cs b/src/cyclonedx/Commands/CycloneDXBomFormat.cs
@@ -16,11 +16,13 @@
 // Copyright (c) OWASP Foundation. All Rights Reserved.
 namespace CycloneDX.Cli.Commands
 {
+#pragma warning disable CA1515 // Used as public test method parameters
     public enum CycloneDXBomFormat
     {
         autodetect,
         xml,
         json,
         protobuf,
     }
+#pragma warning restore CA1515
 }
diff --git a/src/cyclonedx/Commands/DiffCommandOptions.cs b/src/cyclonedx/Commands/DiffCommandOptions.cs
@@ -17,7 +17,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class DiffCommandOptions
+    internal class DiffCommandOptions
     {
         public string FromFile { get; set; }
         public string ToFile { get; set; }

diff --git a/src/cyclonedx/Commands/KeyGenCommandOptions.cs b/src/cyclonedx/Commands/KeyGenCommandOptions.cs
@@ -17,7 +17,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class KeyGenCommandOptions
+    internal class KeyGenCommandOptions
     {
         public string PrivateKeyFile { get; set; }
         public string PublicKeyFile { get; set; }

diff --git a/src/cyclonedx/Commands/MergeCommand.cs b/src/cyclonedx/Commands/MergeCommand.cs
@@ -26,7 +26,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class MergeCommand
+    internal static class MergeCommand
     {
         public static void Configure(RootCommand rootCommand)
         {

diff --git a/src/cyclonedx/Commands/MergeCommandOptions.cs b/src/cyclonedx/Commands/MergeCommandOptions.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class MergeCommandOptions
+    internal class MergeCommandOptions
     {
         public IList<string> InputFiles { get; set; }
         public string OutputFile { get; set; }

diff --git a/src/cyclonedx/Commands/Sign/SignBomCommand.cs b/src/cyclonedx/Commands/Sign/SignBomCommand.cs
@@ -28,7 +28,7 @@
 
 namespace CycloneDX.Cli.Commands.Sign
 {
-    public static class SignBomCommand
+    internal static class SignBomCommand
     {
         public static void Configure(Command rootCommand)
         {

diff --git a/src/cyclonedx/Commands/Sign/SignBomCommandOption.cs b/src/cyclonedx/Commands/Sign/SignBomCommandOption.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands.Sign
 {
-    public class SignBomCommandOptions
+    internal class SignBomCommandOptions
     {
         public string BomFile { get; set; }
         public string KeyFile { get; set; }

diff --git a/src/cyclonedx/Commands/Sign/SignFileCommand.cs b/src/cyclonedx/Commands/Sign/SignFileCommand.cs
@@ -28,7 +28,7 @@
 
 namespace CycloneDX.Cli.Commands.Sign
 {
-    public static class SignFileCommand
+    internal static class SignFileCommand
     {
         public static void Configure(Command rootCommand)
         {

diff --git a/src/cyclonedx/Commands/Sign/SignFileCommandOption.cs b/src/cyclonedx/Commands/Sign/SignFileCommandOption.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands.Sign
 {
-    public class SignFileCommandOptions
+    internal class SignFileCommandOptions
     {
         public string File { get; set; }
         public string KeyFile { get; set; }

diff --git a/src/cyclonedx/Commands/SignCommand.cs b/src/cyclonedx/Commands/SignCommand.cs
@@ -21,7 +21,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class SignCommand
+    internal static class SignCommand
     {
         public static void Configure(RootCommand rootCommand)
         {

diff --git a/src/cyclonedx/Commands/ValidateCommand.cs b/src/cyclonedx/Commands/ValidateCommand.cs
@@ -28,7 +28,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class ValidateCommand
+    internal static class ValidateCommand
     {
 
         public static void Configure(RootCommand rootCommand)

diff --git a/src/cyclonedx/Commands/ValidateCommandOptions.cs b/src/cyclonedx/Commands/ValidateCommandOptions.cs
@@ -24,7 +24,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public class ValidateCommandOptions
+    internal class ValidateCommandOptions
     {
         public string InputFile { get; set; }
         public ValidationBomFormat InputFormat { get; set; }

diff --git a/src/cyclonedx/Commands/ValidationBomFormat.cs b/src/cyclonedx/Commands/ValidationBomFormat.cs
@@ -16,10 +16,12 @@
 // Copyright (c) OWASP Foundation. All Rights Reserved.
 namespace CycloneDX.Cli.Commands
 {
+#pragma warning disable CA1515 // Used as public test method parameters
     public enum ValidationBomFormat
     {
         autodetect,
         xml,
         json,
     }
+#pragma warning restore CA1515
 }
diff --git a/src/cyclonedx/Commands/Verify/VerifyAllCommand.cs b/src/cyclonedx/Commands/Verify/VerifyAllCommand.cs
@@ -28,7 +28,7 @@
 
 namespace CycloneDX.Cli.Commands.Verify
 {
-    public static class VerifyAllCommand
+    internal static class VerifyAllCommand
     {
         public static void Configure(Command rootCommand)
         {

diff --git a/src/cyclonedx/Commands/Verify/VerifyAllCommandOption.cs b/src/cyclonedx/Commands/Verify/VerifyAllCommandOption.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands.Verify
 {
-    public class VerifyAllCommandOptions
+    internal class VerifyAllCommandOptions
     {
         public string BomFile { get; set; }
         public string KeyFile { get; set; }

diff --git a/src/cyclonedx/Commands/Verify/VerifyFileCommand.cs b/src/cyclonedx/Commands/Verify/VerifyFileCommand.cs
@@ -25,7 +25,7 @@
 
 namespace CycloneDX.Cli.Commands.Verify
 {
-    public static class VerifyFileCommand
+    internal static class VerifyFileCommand
     {
         public static void Configure(Command rootCommand)
         {

diff --git a/src/cyclonedx/Commands/Verify/VerifyFileCommandOption.cs b/src/cyclonedx/Commands/Verify/VerifyFileCommandOption.cs
@@ -18,7 +18,7 @@
 
 namespace CycloneDX.Cli.Commands.Verify
 {
-    public class VerifyFileCommandOptions
+    internal class VerifyFileCommandOptions
     {
         public string File { get; set; }
         public string KeyFile { get; set; }

diff --git a/src/cyclonedx/Commands/VerifyCommand.cs b/src/cyclonedx/Commands/VerifyCommand.cs
@@ -21,7 +21,7 @@
 
 namespace CycloneDX.Cli.Commands
 {
-    public static class VerifyCommand
+    internal static class VerifyCommand
     {
         public static void Configure(RootCommand rootCommand)
         {

diff --git a/src/cyclonedx/ExitCode.cs b/src/cyclonedx/ExitCode.cs
@@ -17,7 +17,7 @@
 
 namespace CycloneDX.Cli
 {
-    public enum ExitCode
+    internal enum ExitCode
     {
         Ok,
         OkFail,

diff --git a/src/cyclonedx/Models/AnalyzeResult.cs b/src/cyclonedx/Models/AnalyzeResult.cs
@@ -19,7 +19,7 @@
 
 namespace CycloneDX.Cli.Models
 {
-    public class AnalyzeResult
+    internal class AnalyzeResult
     {
         public Dictionary<string,List<Component>> MultipleComponentVersions { get; set; } 
     }

diff --git a/src/cyclonedx/Models/DiffResult.cs b/src/cyclonedx/Models/DiffResult.cs
@@ -20,7 +20,7 @@
 
 namespace CycloneDX.Cli.Models
 {
-    public class DiffResult
+    internal class DiffResult
     {
         public Dictionary<string,DiffItem<Component>> ComponentVersions { get; set; }
     }

diff --git a/src/cyclonedx/Program.cs b/src/cyclonedx/Program.cs
@@ -21,7 +21,7 @@
 
 namespace CycloneDX.Cli
 {
-    public static class Program
+    internal static class Program
     {
         private const string CycloneDx = @"
    ______           __                 ____ _  __    ________    ____
-Original file line number
+Diff line change
@@ Expand Up / @@ -17,7 +17,7 @@ @@
     namespace CycloneDX.Cli
     {
-        public enum ExitCode
+        internal enum ExitCode
         {
             Ok,
             OkFail,
@@ Expand Down @@