Outputting a pom.xml from dependencies.yml

We'd like to improve the security of our application by scanning dependencies. The majority of tooling is only able to scan a Pom.xml file for dependencies to build up a BOM.

I have looked into this and it seems this would need changes to the play dependencies module. Does anyone know if this is possible directly within ivy settings without changes to Play?

Also it would be helpful to have dependency checking of Play framework itself as at the moment it's difficult to know if Play is using vulnerable dependencies.

The request concerns dependencies.yml, the Play dependencies module, and possible Ivy settings changes. Start by investigating whether Ivy can produce pom.xml directly and how Play framework dependencies are represented; done means generating a usable dependency description for application and Play framework dependencies, but no tests or concrete entry point are named.