Patches and hotfixes

[charterchap]

Is there a recommend way to list hotfixes. My specific example is Windows OS with their Quick Fix updates (example).

I was thinking I could use pedigree:variants or pedigree:descendants but those are both arrays of components and the "type enum" options don't really apply. Is anyone doing this already on their SBOMs?

[jkowalleck]

The CycloneDX way of documenting patches would be Pedigree's patches

[prabhu]

Often the hotfixes are based on edition and version numbers. So best to link these documents using external references rather than attempting to mimic the Windows update logic. Once the fixes are applied, the generated obom would include all patches, so it is possible to document the end state.