In a multi-module Maven build, transitive dependencies are not resolved correctly in the generated SBOM when a module POM depends on a war or ear module.
What makes this more confusing is that the same transitive dependencies also do not appear in mvn dependency:tree. From a user perspective, the resulting SBOM is incomplete because dependencies that are effectively part of the packaged application are missing.
To reproduce, you need:
Now call mvn package or mvn dependency:tree
Expected behaviour:
The sbom module should depend on the test-war module, which then transitively depends on the jakarta.json-api.jar
Actual behavior:
The generated SBOM is missing transitive dependencies from the war module completely, and the dependency tree shows that too.
It would be helpful to know:
- whether this is considered a limitation of the CycloneDX Maven Plugin,
- whether this is inherited from Maven dependency resolution behavior,
- and whether there is a recommended workaround for generating a complete SBOM in this kind of project layout.
Environment:
- CycloneDX Maven Plugin version: 2.9.1
- Maven version: 3.9.11
- Java version: 11.0.30
In a multi-module Maven build, transitive dependencies are not resolved correctly in the generated SBOM when a module POM depends on a war or ear module.
What makes this more confusing is that the same transitive dependencies also do not appear in
mvn dependency:tree. From a user perspective, the resulting SBOM is incomplete because dependencies that are effectively part of the packaged application are missing.To reproduce, you need:
Now call
mvn packageormvn dependency:treeExpected behaviour:
The sbom module should depend on the test-war module, which then transitively depends on the jakarta.json-api.jar
Actual behavior:
The generated SBOM is missing transitive dependencies from the war module completely, and the dependency tree shows that too.
It would be helpful to know:
Environment: