bom

See https://yarnpkg.com/features/pnp#fixing-node_modules

In this install mode (the default starting from Yarn 2.0), Yarn generates a single .pnp.cjs file instead of the usual node_modules folder containing copies of various packages. The .pnp.cjs file contains various maps: one linking package names and versions to their location on the disk and another one linking package names and versions

The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number

vcn n git://... is actually notarizing just the commit which HEAD is pointing to.

If there're untracked files or changes not staged, then both notarization and authentication will ignore them.

A simple solution would be to show a warning message when the working tree is not clean, so the user will be aware that pending modifications are not part of the notarization/authentication process.

The CLI tool should support automatic resolving and augmentation of license information, when it is missing, for components in an SBOM.

For components with an external reference to a GitHub repo it should be possible, in a lot of cases, to automatically resolve license information using the API.

This is already supported in the .NET implementation (https://github.com/CycloneDX/cyclonedx-dotn