Skip to content
Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Build Status Maven Central License Website Slack Invite Group Discussion Twitter

CycloneDX Maven Plugin

The CycloneDX Maven plugin creates an aggregate of all direct and transitive dependencies of a project and creates a valid CycloneDX SBOM. CycloneDX is a lightweight software bill of materials (SBOM) specification designed for use in application security contexts and supply chain component analysis.

Maven Usage

<!-- uses default configuration -->

Default Values


Excluding Projects

With makeAggregateBom goal it is possible to exclude certain Maven Projects (artifactId) from getting included in bom.

  • Pass -DexcludeTestProject=true to skip any maven project artifactId containing the word "test"
  • Pass -DexcludeArtifactId=comma separated id to skip based on artifactId


As of v2.5.0, the default CycloneDX BOM format is v1.3 and will produce both XML and JSON.


The CycloneDX Maven plugin contains the following three goals:

  • makeBom
  • makeAggregateBom
  • makePackageBom

By default, the BOM(s) will be attached as an additional artifacts during a Maven install or deploy.

  • ${project.artifactId}-${project.version}-cyclonedx.xml
  • ${project.artifactId}-${project.version}-cyclonedx.json

This may be switched off by setting cyclonedx.skipAttach to true.

makeBom and makeAggregateBom can optionally be skipped completely by setting cyclonedx.skip to true.

CycloneDX Schema Support

The following table provides information on the version of this node module, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this node module that is the compatible with the CycloneDX version supported by the target system.

Version Schema Version Format(s)
2.5.x CycloneDX v1.3 XML/JSON
2.0.x CycloneDX v1.2 XML/JSON
1.4.x CycloneDX v1.1 XML
1.0x CycloneDX v1.0 XML

Copyright & License

CycloneDX Maven Plugin is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.