Backport #115 in 2.x for 2.21

cowtowncoder · cowtowncoder · commit 3e4db580fa7b · 2025-11-16T13:50:42.000-08:00
diff --git a/base/pom.xml b/base/pom.xml
@@ -161,15 +161,16 @@ of Jackson: application code should only rely on `jackson-bom`
             </execution>
           </executions>
     </plugin>
-        <!-- 28-Apr-2025, tatu: Add SBOM generation support [JSTEP-14]
-          -->
+        <!-- 28-Apr-2025, tatu: Add SBOM generation support [JSTEP-14] -->
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
           <configuration>
-            <attach>true</attach>
             <classifier>sbom-cyclonedx</classifier>
-            <skipNotDeployed>true</skipNotDeployed>
+            <!-- 16-Nov-2025, tatu: Should not skip because new Deploy mechanism
+                   `central-publishing-maven-plugin` NOT consider "deploy" apparently
+              -->
+            <skipNotDeployed>false</skipNotDeployed>
           </configuration>
           <executions>
             <execution>
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -11,7 +11,7 @@ Jackson components (core, modules)
 
 2.21.0 (not yet released)
 
-- No changes since 2.20
+#115: Fix cycloneDX SBOM generation settings
 
 2.20.1 (30-Oct-2025)
 
