Spdx is on version 3, but the codemeta one is on 2.3

Then we have https://cyclonedx.org/docs/1.7/json/, which should be compatible, but we have to verify.

Additional links: https://www.cisa.gov/topics/cyber-threats-and-advisories/sbom/sbomresourceslibrary