fix: typing in contrib.bom.utils.BomDependencyGraphFlatMerger

[jkowalleck]

caused by #997 (comment)

[Copilot]

Pull request overview

This PR fixes a typing/runtime issue in cyclonedx.contrib.bom.utils.BomDependencyGraphFlatMerger by converting a local variable annotation to use forward references, aligning it with the module’s TYPE_CHECKING import pattern for BomRef.

Changes:

• Update _flatten_merge()’s local flat variable annotation to dict['BomRef', list['BomRef']] to avoid referencing BomRef at runtime when it is only imported under TYPE_CHECKING.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation
Diff coverage	✅ 100.00% diff coverage (80.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (78b8d8b)	6078	5728	94.24%
Head commit (7162f22)	6078 (+0)	5728 (+0)	94.24% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#998)	1	1	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.