Breaking Changes
Version 2.0 of BOMnipotent is forced to break client-server communication and some CSAFs.
Mandatory test 6.1.11 of the CSAF standard states that a CWE entry must be tested for correctness. However, when the new CWE catalogue recently dropped, some names were changed. Specifically the example stated in the standard broke, because the “(‘Cross-site Scripting’)” part of the name was dropped.
The CSAF 2.1 standard addresses this issue and adds a “version” field to the CWE, but several CSAF 2.0 documents have been invalidated with this new release of BOMnipotent. Hence the breaking change.
Furthermore, the security researcher kta1kri found a security vulnerability in the communication between client and server. It was not possible to fix it without another breaking change, which is why authenticated communication between a 1.x client and a 2.x server, or vice versa, is not possible. This is also why the 1.x version is deprecated immediately. Many thanks to kta1kri for the finding!
The full changelog can, as always, be found in the documentation.
