spring-boot-demo/sbom/pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.2.0-RC1</version>
    <relativePath/>
  </parent>

  <groupId>com.ankurm</groupId>
  <artifactId>sbom</artifactId>
  <version>1.0.0</version>
  <name>sbom</name>
  <description>Spring Boot SBOMs: the 4.2 tools jar-mode command, CycloneDX, Actuator and scanning</description>

  <properties>
    <java.version>25</java.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-webmvc</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <profiles>
    <!-- Adds a library with a famous vulnerability so the scanner has something to find. Never ship this. -->
    <profile>
      <id>vulnerable</id>
      <dependencies>
        <dependency>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-core</artifactId>
          <version>2.14.1</version>
        </dependency>
      </dependencies>
    </profile>
  </profiles>

  <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.9.3</version>
        <executions>
          <execution>
            <phase>generate-resources</phase>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <outputFormat>json</outputFormat>
          <outputName>application.cdx</outputName>
          <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
          <projectType>application</projectType>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>