CycloneDX/cyclonedx-maven-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

Stars: 385
Forks: 107
Open beginner issues: 0
Indexed issues: 86
Avg merge: 17h 31m
Merged PRs (30d): 7

Dominant language: Java
License: Apache-2.0
Last GitHub push: Aug 30, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Open All

86 open issues indexed

Creating BOM using cyclonedx for a project which uses OSGified a third party library Open

enhancement

CycloneDX/cyclonedx-maven-plugin#7 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Apache Karaf OSGi feature file support Open

CycloneDX/cyclonedx-maven-plugin#10 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Aggregate only specific files Open

question

CycloneDX/cyclonedx-maven-plugin#12 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Question: include mvn plugins in the BOM? Open

CycloneDX/cyclonedx-maven-plugin#53 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Missing dependency in 2.0.0 Open

question

CycloneDX/cyclonedx-maven-plugin#54 · 17 comments · 7 reactions · 0 assignees · Indexed Sep 15, 2026
top level component hashes are missing Open

enhancement

CycloneDX/cyclonedx-maven-plugin#57 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Running makeAggregateBom in a reactor POM leads to warnings Open

CycloneDX/cyclonedx-maven-plugin#85 · 3 comments · 5 reactions · 0 assignees · Indexed Sep 15, 2026
Support capability for a consumed dependency to declare effective dependencies in its pom Open

CycloneDX/cyclonedx-maven-plugin#129 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add support for properties (name-value pairs) Open

CycloneDX/cyclonedx-maven-plugin#131 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Skip unwanted component from the dependencies. Open

CycloneDX/cyclonedx-maven-plugin#136 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Cyclonedx sbom for tycho dependencies Open

enhancement help wanted

CycloneDX/cyclonedx-maven-plugin#137 · 45 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Multi-module projects slow to build due to makeAggregateBom trying to download reactor modules from repo Open

CycloneDX/cyclonedx-maven-plugin#138 · 3 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
When the plug-in of cyclonedx version 2.5.3 generates a BOM file, it prompts an unrecognized tag: "project"(position: START_TAG seen ...</dependencies>\n <project>... @35:14) Open

CycloneDX/cyclonedx-maven-plugin#146 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Include Parent in Materials List Open

CycloneDX/cyclonedx-maven-plugin#165 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Include Plugins in SBOM generation Open

enhancement

CycloneDX/cyclonedx-maven-plugin#166 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Add option to merge generated SBOM with pre-generated services SBOM Open

CycloneDX/cyclonedx-maven-plugin#177 · 0 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
I want to add several functionalities into this repo, but want to listen about your opinions first. Open

CycloneDX/cyclonedx-maven-plugin#182 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Running makeAggreagateBom on nested project fails due to empty bom file with schemaVersion 1.1 Open

CycloneDX/cyclonedx-maven-plugin#189 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
includeProvidedScope=false not working, Could not transfer artifact, status: 401 Open

CycloneDX/cyclonedx-maven-plugin#191 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
org.springframework.roo.annotations Open

CycloneDX/cyclonedx-maven-plugin#197 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
makeBom doesn't follow war and ear dependencies transitively Open

CycloneDX/cyclonedx-maven-plugin#199 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
"components" entries missing a few jars that are in WEB-INF/lib/ Open

CycloneDX/cyclonedx-maven-plugin#202 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
War retirejs Open

CycloneDX/cyclonedx-maven-plugin#219 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Hashes are missing in metadata component. Open

enhancement

CycloneDX/cyclonedx-maven-plugin#232 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Include mime types of components in the bom Open

enhancement

CycloneDX/cyclonedx-maven-plugin#236 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Evaluate makePackageBom for possible removal Open

CycloneDX/cyclonedx-maven-plugin#237 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
inspire from owasp dependency-check to include CPEs in BOM Open

CycloneDX/cyclonedx-maven-plugin#254 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
exclude dependencies with other goals than makeAggregateBom Open

CycloneDX/cyclonedx-maven-plugin#269 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Option to ignore optional dependencies Open

CycloneDX/cyclonedx-maven-plugin#276 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add option to omit all qualifiers from PackageURLs (--short-PURLs) Open

CycloneDX/cyclonedx-maven-plugin#286 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
"[WARNING] Unknown keyword additionalItems" when validating generated json Open

bug help wanted

CycloneDX/cyclonedx-maven-plugin#305 · 2 comments · 5 reactions · 0 assignees · Indexed Sep 15, 2026
Aggregate BOMs cannot handle components with differing dependency trees in different modules Open

CycloneDX/cyclonedx-maven-plugin#310 · 37 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add support for generating the SBOM as if the top level component were a dependency of another. Open

CycloneDX/cyclonedx-maven-plugin#312 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Java Maven multi module project, its SBOM and the Dependency-Track dependency graph Open

CycloneDX/cyclonedx-maven-plugin#315 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
2.7.6 json SBOM validation logs too much DEBUG content Open

bug

CycloneDX/cyclonedx-maven-plugin#325 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
makeAggregateBom includes provided and system scope dependencies when they are excluded Open

bug

CycloneDX/cyclonedx-maven-plugin#328 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
I still get the following error after executing the command with version 2.7.6： Open

CycloneDX/cyclonedx-maven-plugin#332 · 11 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Sort by artifactId Open

CycloneDX/cyclonedx-maven-plugin#372 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
SBOM generation for Maven BOM POM projects Open

CycloneDX/cyclonedx-maven-plugin#373 · 8 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Classification of test scope components in the BOM file Open

enhancement

CycloneDX/cyclonedx-maven-plugin#384 · 12 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Copyright detection would be amazing Open

enhancement

CycloneDX/cyclonedx-maven-plugin#389 · 10 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Component description misleadingly inherited Open

CycloneDX/cyclonedx-maven-plugin#394 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Is it possible to aggregate a bom generated from other tools? Open

enhancement help wanted

CycloneDX/cyclonedx-maven-plugin#395 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
"False positives" in SBOM when building OSGi bundle with maven-bundle-plugin Open

help wanted

CycloneDX/cyclonedx-maven-plugin#398 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
How can I generate SBOM in sub-module and get an aggregated SBOM? Regression with makeAggregateBom since 2.7.4 - outputReactorProjects has no effect Open

CycloneDX/cyclonedx-maven-plugin#403 · 7 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Snapshots being downloaded before modules are built Open

CycloneDX/cyclonedx-maven-plugin#410 · 7 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Possible to include commit identifier in BOM? Open

enhancement

CycloneDX/cyclonedx-maven-plugin#427 · 12 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Plugin does not use repositories specified in the project's pom Open

CycloneDX/cyclonedx-maven-plugin#436 · 14 comments · 8 reactions · 0 assignees · Indexed Sep 15, 2026
Support offline mode Open

CycloneDX/cyclonedx-maven-plugin#439 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support pedigree (for forks) Open

enhancement

CycloneDX/cyclonedx-maven-plugin#448 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026

A short digest of beginner-friendly GitHub issues.