I found that, since I really care about the dependencies (including transitive dependencies) that will be on the classpath at runtime, and required by any consuming packages, the approach that actually works for me is to generate a Software Bill of Materials (SBOM) and run OSV-Scanner against that SBOM instead of the POM file.

I currently have the CycloneDX Maven plugin configured in a profile within my POM file:

<profile>
  <id>sbom</id>
  <build>
    <plugins>
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.7.9</version>
        <configuration>
          <includeCompileScope>true</includeCompileScope>
          <includeProvidedScope>false</includeProvidedScope>
          <includeRuntimeScope>true</includeRuntimeScope>
          <includeSystemScope>false</includeSystemScope>
          <includeTestScope>false</includeTestScope>
        </configuration>
        <executions>
          <execution>
            <phase>package</phase>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</profile>

I use this to generate the SBOM, then run OSV-Scanner run against the SBOM:

mvn --activate-profiles sbom -DskipTests install
osv-scanner --sbom=target/bom.json

If anyone has a better solution, I would really like to hear it.

Better support for transitive deps in Maven/Java (pom.xml) #35

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions