fix(output): bump default CycloneDX output to 1.6

[AbdaullahAG]

Summary

Bumps the default CycloneDX SBOM output from 1.4 to 1.6, per the decision recorded on #1080.

Changes

• specVersion in the emitted BOM moves from 1.4 to 1.6
  (src/output/cyclonedx.ts)
• --cdx help text updated to reflect the new default version
  (src/cli/help.ts)
• Added tests asserting the emitted BOM satisfies the CycloneDX 1.6
  schema's required fields directly (bomFormat/specVersion,
  component.type/name, affects[].ref, rating.method enum) — no
  schema-validation dependency added, per the issue's request

Compatibility

• --cdx and --sbom cyclonedx keep working unchanged as flags;
  only the emitted specVersion value changes. This is a visible
  behavior change for anyone diffing SBOMs in CI, so it should be
  called out in the release notes.
• Version-qualified aliases (e.g. --sbom cyclonedx1.4) are
  intentionally out of scope, as noted in the issue.

Testing

• npm run lint:tests
• npm run build
• node dist/index.js advisories sync
• npm test (all cyclonedx tests pass; pre-existing unrelated
  failures in --check-overrides/audit-log tests are present on
  main as well, confirmed before and after this change)

Closes #1080

[sonukapoor]

The core of this is right and I verified it properly: I generated real BOMs from the built CLI and validated them against the actual CycloneDX 1.6 schema. --cdx, --sbom cyclonedx and --sbom-inventory-only all produce valid 1.6. Your claim that the existing shape needed no structural changes holds up.

Three things I particularly liked. You respected both prohibitions in the issue, no schema-validation dependency and no version-qualified aliases, and I checked that package.json and SBOM_FORMAT_ALIASES are untouched. You listed CVSSv4 and SSVC in the scoreMethod test, which are 1.6 additions absent from 1.4, so you clearly read the schema diff rather than doing a find and replace. And you correctly left CHANGELOG.md alone and flagged the behaviour change in the description instead. That last one is maintainer-managed here and contributors usually get it wrong in the other direction.

Two things before this can go in.

It needs a rebase. #1095 merged this morning and restructured src/output/cyclonedx.ts. The good news is that file auto-merges cleanly; only src/cli/help.ts conflicts. Resolve it by keeping main's new --sbom and --cdx lines and changing cyclonedx (1.4) to cyclonedx (1.6) there.

Six places still advertise 1.4, so after this the tool would emit 1.6 while its own docs say otherwise:

action.yml:63                    website/docs/cyclonedx.md:7
website/docs/cli-reference.md:41 website/docs/github-action.md:41
README.md:369                    website/docs/spdx.md:22

action.yml is the one I care most about, since that description is what every Action user reads.

Two small things: the trailing newlines were stripped from src/cli/help.ts and tests/cyclonedx.test.ts, and three of the four new tests pass unchanged at 1.4, so they are not actually pinning 1.6. The instinct to assert the schema's required fields was right, those particular fields just did not change between versions.

Also, the pre-existing test failures you mentioned do not reproduce here. Full suite is green on your branch and rebased on main, so nothing is broken upstream.

[AbdaullahAG]

Pushed all the requested fixes:

Rebased on main — resolved the src/cli/help.ts conflict by keeping main's --sbom/--cdx lines with the version bumped to 1.6.

Updated the six remaining 1.4 references — action.yml, README.md, and the four website/docs/*.md pages now say 1.6.

Tightened the three schema-conformance tests — each now asserts specVersion === "1.6" first, so a regression back to 1.4 would fail them for the right reason (previously they passed unchanged at either version since those particular fields didn't change between 1.4 and 1.6).

Trailing newlines — confirmed both files end with a newline; that was likely a diff-viewer artifact.

All 15 cyclonedx tests pass, and I re-validated a real BOM generated by the built CLI against the 1.6 requirements directly. Ready for another look whenever you get a chance.