fix: tools serialization (for versions < 1.5) (#291)

E.g. after downgrading a bom, tools was null, and thus a null value was written. However, an empty array was expected.

Signed-off-by: andreas hilti <andreas.hilti@bluewin.ch>

src/CycloneDX.Core/Json/Converters/ToolChoicesConverter.cs

@@ -73,12 +73,15 @@ public override void Write(
             Contract.Requires(writer != null);
             Contract.Requires(value != null);
 
-            if (value.Tools != null)
+            if (value.Tools != null || value.SpecVersion < SpecificationVersion.v1_5)
             {
                 writer.WriteStartArray();
-                foreach (var tool in value.Tools)
+                if (value.Tools != null)
                 {
-                    JsonSerializer.Serialize(writer, tool, options);
+                    foreach (var tool in value.Tools)
+                    {
+                        JsonSerializer.Serialize(writer, tool, options);
+                    }
                 }
                 writer.WriteEndArray();
             }

tests/CycloneDX.Core.Tests/Json/v1.5/SerializationTests.cs

@@ -162,9 +162,7 @@ public async Task JsonRoundTripAsyncTest(string filename)
         [InlineData("valid-service-1.5.json")]
         [InlineData("valid-service-empty-objects-1.5.json")]
         [InlineData("valid-signatures-1.5.json")]
-        //TODO - I do not know why this particular one is failing
-        //Validating it with other tools works, maybe an obscure STJ bug???
-        //[InlineData("valid-vulnerability-1.5.json")]
+        [InlineData("valid-vulnerability-1.5.json")]
         public void JsonDowngradeTest(string filename)
         {
             var resourceFilename = Path.Join("Resources", "v1.5", filename);