[python] Code comments are being injected into the SBOM field

[ivanasabi]

Hello,
I am using CDXGEN to generate SBOMs for different technologies. In a Python project using the Poetry package manager, I have added a comment (for clarity purposes) after the version property.:

version = "1.14.0-dev" # Don't touch. Auto-incremented by CI/CD Pipeline

When I use the following command::

 export FETCH_LICENSE=true
 cdxgen --profile license-compliance -o sbom.json

the SBOM properties is generated with the comment cocantenated with version property. For example:

"purl": "pkg:pypi/python@1.14.0-dev%20%23%20Dont%20touch.%20Auto-incremented%20by%20CI%2FCD%20Pipeline"

Is this behavior expected, or is it an error?

Thanks for your help

[ivanasabi]

May I try to help with this issue?

[prabhu]

Could you retest with 11.0.8 and let me know how it looks? Thank you so much!

[ivanasabi]

Thanks for your response. You're right. In version 11.0.8, the bug has been fixed.