CycloneDX / CycloneDX/cyclonedx-maven-plugin
Option to ignore optional dependencies
Open
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
The following dependency is not included in the produced artifact, and it would be nice if it was not included in the sbom. At least some way to disable that inclusion:
```xml
sample.ProjectA
Project-A
1.0
compile
true
```
Contributor guide
Research direction
Start by reviewing how the Maven plugin identifies dependencies for the produced SBOM, with attention to the optional dependency shown in the issue. Define a configurable way to exclude such dependencies and verify that the resulting SBOM omits them without affecting other dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100