CycloneDX / CycloneDX/cyclonedx-maven-plugin

Classification of test scope components in the BOM file

Open
#384 12 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

Hi,

I have been using this tool since sometime and it is really helpful for identifying maven packages. But there is one feature that would be really helpful.

Normally test scope components are considered as Development dependency and if i add them in the bom using the configuration
` true`
there is no way to distinguish from the direct dependency. Can any property be added for this purpose which will act as an indicator.? Could this feature be implemented?

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the includeTestScope configuration is handled and how dependencies are serialized into the BOM. Review the existing test coverage for test-scope and direct dependencies, then define the distinguishing property and verify that both dependency categories are represented correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.