adityamparikh commented on issue #186:
URL: https://github.com/apache/solr-mcp/issues/186#issuecomment-5358534807
Checked, and the pin can be lifted — **cyclonedx 3.4.1 configures cleanly on
Gradle 9.4.1**.
`:cyclonedxDirectBom`, the task named in the original justification, now
runs without the
variant-mutation conflict.
Migration PR: adityamparikh/solr-mcp#100 (targets `sb4`, the head branch of
#23 — `main` runs
Boot 3.5.x where 2.4.1 is auto-configured normally, so this is Boot-4-only).
Two things the checklist above didn't anticipate, both worth recording here:
**1. The output path moved.** 3.x writes to
`build/reports/cyclonedx/application.cdx.json` —
one directory deeper than 2.x. `generateBinaryLicense` declares that as an
input, so removing
the pin alone fails the build immediately rather than silently producing a
wrong SBOM.
`buildSrc/.../license-notice.gradle.kts:96` needs updating.
**2. Spring Boot auto-configures the name but not the scope.** Step 3 of the
checklist
("confirm the SBOM lists the Spring Boot 4 modular jars and no stale Jackson
2") turned out to
be the wrong thing to check. Boot 4 does recognise 3.x and names the file
correctly. What it
doesn't set is `includeConfigs`, and unscoped the SBOM picks up test-only
dependencies:
| | shipped fat jar | unscoped SBOM | scoped |
|---|---|---|---|
| components | — | 246 | 141 |
| testcontainers artifacts | 0 | 6 | 0 |
Since the SBOM is embedded and served from `/actuator/sbom/application`,
unscoped it would
publish a bill of materials for artifacts the binary doesn't contain. The
LICENSE appendix is
*not* affected — `generateBinaryLicense` filters to the shipped classpath
itself — so this is
an SBOM-accuracy issue rather than a licensing-correctness one.
Also worth noting for anyone reading the old code: scoping moved onto the
**direct** task in
3.x (`cyclonedxDirectBom` / `CyclonedxDirectTask`), and the class renamed
from `CycloneDxTask`
to `CyclonedxDirectTask` — lowercase `d`.
Verified by building both ways and diffing: **141 components either way,
identical component
sets, identical generated LICENSE.**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
