Niklas

I'll also see if I can improve the logging. Seems like currently we're swallowing the actual error message, which is not helpful.

Actually it *is* logged in debug mode (with `-verbose` flag): ``` $ docker run -it --rm -v "$(pwd):/work" cyclonedx/cyclonedx-gomod:v1.4.0 mod -verbose /work 4:00PM DBG executing command cmd="/usr/local/go/bin/go mod why -m...

There is nothing in cdx-gomod that relies on specific versions of Go, as it merely orchestrates calls to the `go` binary in the environment. To my understanding, merely listing modules...

@rkolesnev One thing about this solution is that it raises the baseline `kafka-clients` version to 3.7.0. Earlier versions will break, requiring users to enable the new `ignoreReflectiveAccessExceptionsForAutoCommitDisabledCheck` option. This should...

> [...] it should be possible to support both versions with reflection checks i recon. Yes it definitely is. However since certain classes only exist in one version and not...

Seems like a test is failing, but clicking on the *Details* link of the Semaphore check gives me a 404.

Thanks @rkolesnev! I also saw your message in the Confluent Slack, I can confirm the *Details* link works now. :) Will revise the PR to support both < 3.7.0 and...

The code now supports both versions of `kafka-clients`. I restructured it into multiple methods because the deep nesting got unbearable with the additional checks. The `PCMetricsTest` fails for both `3.6.0`...

@rkolesnev The rebalance protocol was a good hint! I checked the release notes but didn't find anything related. I ended up comparing stack dumps when using Kafka v3.5.x vs 3.6.x....

Raised #765. I think it would make sense to merge that one first, I can then rebase this PR, which should yield a clean test run.