Adam Setch

Update my post above with an example of the different refs being generated

@natemoo-re - is there any help I could lend with this item?

Unlikely... This project seems to be unmaintained... For example, this is still open from 2 years ago https://github.com/thoughtworks/build-your-own-radar/pull/370

Related: https://github.com/CycloneDX/cdxgen/issues/711 The software architecture within [renovatebot/renovate](https://github.com/renovatebot/renovate) is a great role-model. They have really well defined interfaces, modules and manager/language specific implementations.

> [@setchy](https://github.com/setchy) I closed 'sbt/setup-sbt' because that version (1.1.9) has a bug. Currently there are already 2 new releases (both less than 3 days old though), but they don't appear...

This is the line that's important ``` Closed PR already exists. Skipping branch. (branch="renovate/sbt-setup-sbt-1.x") { "prTitle": "chore(deps): update sbt/setup-sbt action to v1.1.9" } ``` So yes, @malice00, closing the other...

My personal workflow with renovate is to _rarely_ decline the auto-PRs, otherwise it can limit visibility to subsequent updates. I much prefer to leave them open or convert them to...

It all depends on the package rules that you extend or define. It's incredibly configurable and can behave however you may want :)

I'm also having issues seeing a Dependency Graph in Dependency Track when using cdxgen version 9.3.1. I've tested across npm, maven and nuget repositories with the same outcome (no dependency...

> @setchy could you kindly share any test projects and generated sbom to reproduce the issue? If the projects are private, you can share them via discord. > > https://discord.gg/pF4BYWEJcS...