Why doesn't the CLI support analyzing pom.xml directly for Maven projects?

Hi OWASP Dependency-Check team 👋,

First, thank you for maintaining such an important tool for ensuring supply chain security — it's been incredibly useful in our projects.

I'm using the CLI version of Dependency-Check with a Maven-based Java application. I noticed that the tool does not analyze the pom.xml file directly when it's the only file provided. Instead, it seems to rely on the presence of the target directory and the generated dependency-check-report.xml from a Maven build or expects a pom.xml to have already been resolved via mvn dependency:resolve or similar. This leads to the CLI ignoring the project altogether if only the pom.xml is present.

My question is:

> Why doesn't the CLI natively parse and resolve the pom.xml (like the Maven plugin does) to determine the list of dependencies?

Rationale:
It seems like the CLI could benefit from a feature where it detects a pom.xml and internally invokes Maven's dependency resolution (like mvn dependency:list or mvn dependency:tree) to generate the list of actual artifacts to scan, similar to what the Maven plugin does internally. This would:

Improve usability in CI/CD pipelines where users don’t want or can't run Maven manually

Make the CLI more self-contained and easier to automate for auditing purposes

Align the CLI feature set more closely with the Maven plugin

Possible implementation ideas:
Use an embedded Maven invoker (as in the plugin) to resolve dependencies from pom.xml

Optionally add a --resolve-pom flag to explicitly trigger this behavior, so users still have control

Is there a design or architectural reason for why this functionality isn't already part of the CLI? Is it something the maintainers would accept as a feature request or contribution?

Thanks again for your work!

Best regards,
Mohamad.