Merge pull request #116 from FasterXML/tatu/2.21/115-fix-cyclonedx-backport-in-2x

cowtowncoder · web-flow · commit 3001d78da41c · 2025-11-16T13:54:17.000-08:00
Backport #115 in 2.x for 2.21
diff --git a/base/pom.xml b/base/pom.xml
@@ -115,15 +115,15 @@ of Jackson: application code should only rely on `jackson-bom`
               </goals>
 -->
               <configuration>
-		<rules>
+                <rules>
                   <!-- Needed both for Replacer plug-in AND for Automatic Module Name -->
                   <requireProperty>
                     <property>packageVersion.package</property>
                   </requireProperty>
                   <requireProperty>
                     <property>packageVersion.dir</property>
                   </requireProperty>
-		</rules>
+                </rules>
               </configuration>
             </execution>
           </executions>
@@ -161,22 +161,25 @@ of Jackson: application code should only rely on `jackson-bom`
             </execution>
           </executions>
     </plugin>
-        <!-- 28-Apr-2025, tatu: Add SBOM generation support [JSTEP-14]
-          -->
+        <!-- 28-Apr-2025, tatu: Add SBOM generation support [JSTEP-14] -->
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
           <configuration>
-            <attach>true</attach>
             <classifier>sbom-cyclonedx</classifier>
-            <skipNotDeployed>true</skipNotDeployed>
+            <!-- 16-Nov-2025, tatu: Should not skip because new Deploy mechanism
+                   `central-publishing-maven-plugin` NOT consider "deploy" apparently
+              -->
+            <skipNotDeployed>false</skipNotDeployed>
           </configuration>
+          <!-- 16-Nov-2025, tatu: We will NOT need "makeAggregateBom" for
+              any projects since Jackson multi-module projects have
+              parent poms only, not true aggregation
+            -->
           <executions>
             <execution>
               <phase>package</phase>
-              <goals>
-                <goal>makeAggregateBom</goal>
-              </goals>
+              <goals><goal>makeBom</goal></goals>
             </execution>
           </executions>
         </plugin>
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -11,7 +11,7 @@ Jackson components (core, modules)
 
 2.21.0 (not yet released)
 
-- No changes since 2.20
+#115: Fix cycloneDX SBOM generation settings
 
 2.20.1 (30-Oct-2025)
 
