cyclonedx-maven-plugin
cyclonedx-maven-plugin copied to clipboard
Option to ignore optional dependencies
The following dependency is not included in the produced artifact, and it would be nice if it was not included in the sbom. At least some way to disable that inclusion:
<dependency>
<groupId>sample.ProjectA</groupId>
<artifactId>Project-A</artifactId>
<version>1.0</version>
<scope>compile</scope>
<optional>true</optional>
</dependency>
On a related note: why aren't optional dependencies marked with a scope of optional in the generated SBOM?
On a related note: why aren't optional dependencies marked with a scope of optional in the generated SBOM?
IIUC, current SBOM scope is not taken from Maven POM but from project dependency used/unused analysis: see #65
FYI #314 should address the question about scope, shifting the determination to rely on the maven understanding of optional