Update cyclonedx-python-lib requirement from ~=8.5.0 to >=8.5,<11.7

[dependabot]

Updates the requirements on cyclonedx-python-lib to permit the latest version.

Release notes

Sourced from cyclonedx-python-lib's releases.

v11.6.0 (2025-12-02)

Features

• Moved non‑standard implementations to Contrib area (#916, 15a9023)
  • Added
    • New sub-package contrib.
  • Changed
    • Moved non‑standard implementations to Contrib area.
  • Deprecated
    • Certain exports have been deprecated; downstream imports should be updated to the new locations.
      Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.
    • Some (trivial) non-standard functionality was deprecated:
      • model.bom.Bom.get_component_by_purl()
      • model.bom.Bom.get_urn_uuid()
      • model.bom.Bom.has_component()
      • model.bom.Bom.get_vulnerabilities_for_bom_ref()
      • model.bom.Bom.has_vulnerabilities()
      • model.bom.Bom.urn()
  • Refactored
    • The following symbols were moved.
      The symbols are still import-able through their old location.
      • OLD -> NEW
      • builder.this.this_component() -> contrib.this.builders.this_component()
      • builder.this.this_tool() -> contrib.this.builders.this_tool()
      • exception.factory.* -> contrib.license.exceptions.*
      • factory.license.LicenseFactory -> contrib.license.factories.LicenseFactory
      • model.HashType.from_hashlib_alg() -> contrib.hash.factories.HashTypeFactory.from_hashlib_alg()
      • model.HashType.from_composite_str() -> contrib.hash.factories.HashTypeFactory.from_composite_str()
      • model.component.Component.for_file() -> contrib.component.builders.ComponentBuilder.make_for_file()
      • model.vulnerability.VulnerabilitySeverity.get_from_cvss_scores() -> contrib.vulnerability.cvss.vs_from_cvss_scores()

---

What's Changed

• chore(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#915
• chore(deps-dev): update mypy requirement from 1.18.2 to 1.19.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#918
• docs: update 1.7 by @​jkowalleck in CycloneDX/cyclonedx-python-lib#920
• feat: Moved non‑standard implementations to Contrib area by @​jkowalleck in CycloneDX/cyclonedx-python-lib#916

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.5.0...v11.6.0

Changelog

Sourced from cyclonedx-python-lib's changelog.

v11.6.0 (2025-12-02)

Documentation

• Update 1.7 (#920, 7e6771b)

Features

• Moved non‑standard implementations to Contrib area (#916, 15a9023)

v11.5.0 (2025-10-31)

Features

• Add support for DistributionConstraints in BOM metadata (#906, 70adb7c)

• Add support for properties in external references (#907, 73e7c1a)

v11.4.0 (2025-10-23)

Features

• Add support for CycloneDX 1.7 (basics) (#902, f35b9ee)

v11.3.0 (2025-10-22)

Bug Fixes

• Implement __lt__ for models still missing it (#899, bebda4f)

Features

• Deserialize single ComponentEvidence.identity (#900, 9425c67)

... (truncated)

Commits

• 095e7c5 chore(release): 11.6.0
• 15a9023 feat: Moved non‑standard implementations to Contrib area (#916)
• 7e6771b docs: update 1.7 (#920)
• 687818f chore(deps-dev): update mypy requirement from 1.18.2 to 1.19.0 (#918)
• 4f76c79 chore(deps): bump actions/checkout from 5 to 6 (#915)
• aff9636 chore(release): 11.5.0
• 73e7c1a feat: add support for properties in external references (#907)
• 70adb7c feat: add support for DistributionConstraints in BOM metadata (#906)
• 5d42b55 chore(deps): bump actions/download-artifact from 5 to 6 (#905)
• 649412c chore(deps): bump actions/upload-artifact from 4 to 5 (#904)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)