Question: include mvn plugins in the BOM?

Would it not make sense to have an option to include any mvn plugin found in the exported BOM?

In the end, these could also potentially have security issues to be checked.

For example if the maven-release-plugin or the maven-compiler-plugin gets breached or has a flaw, it can modify the payload of all jars/wars/ears/...

The issue names no files, tests, or configuration entry points. Start by tracing how this Maven plugin discovers dependencies and configures BOM export, then determine where an opt-in plugin inclusion option belongs; done means the exported BOM can include Maven plugins such as maven-release-plugin and maven-compiler-plugin.

Written by the indexing model from the issue text.