Skip to content
Creates aggregate CycloneDX BOMs from Maven projects
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
src/main/java/org/cyclonedx/maven Limits the artifacts that a POM is extracted to type = jar. Fixes #9 Jan 2, 2019
LICENSE Initial commit Jun 4, 2017 bump Jan 2, 2019

Build Status Maven Central License Website Twitter

CycloneDX Maven Plugin

The CycloneDX Maven plugin creates an aggregate of all dependencies and transitive dependencies of a project and creates a valid CycloneDX bill-of-material document from the results. CycloneDX is a lightweight BOM specification that is easily created, human readable, and simple to parse. The resulting bom.xml can be used with tools such as OWASP Dependency-Track for the continuous analysis of components.

Maven Usage

<!-- uses default configuration -->

Default Values



The CycloneDX Maven plugin contains the following two goals:

  • makeBom
  • makeAggregateBom

makeBom and makeAggregateBom can optionally be skipped by setting cyclonedx.skip to true.

Copyright & License

CycloneDX Maven Plugin is Copyright (c) Steve Springett. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.

You can’t perform that action at this time.