CycloneDX / CycloneDX/cyclonedx-maven-plugin

Include Parent in Materials List

Open
#165 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

Is there currently a feature to include the parent and plugins in the bill of materials? Certain versions of a parent could be known to be an issue in generating projects and to be able to tell where the Parent is used via the BOM would be preferred. If in the BOM I would think it would be optimal to search in Dependency track for these tainted parents or plugins.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how this Maven plugin builds its CycloneDX BOM and how project parents and plugins are represented in the Maven model. Confirm the expected scope for including them, then verify that the generated BOM exposes enough information to search for affected parents or plugins in Dependency-Track.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.