New Features

Set failOnUnresolvedDependencies = true on a cyclonedxDirectBom task to fail when a selected configuration has an unresolved dependency or artifact. The failure reports affected dependencies and configurations. The option defaults to false. #949

Bug Fixes

Preserve licenses expressed as SPDX expressions in Maven POMs so they appear in the SBOM. #940
Release cached Maven models after Direct SBOM graph construction, including on failure, while preserving POM evidence for Gradle's task inputs. #963

Preserve expression-only licenses from Maven POMs by @ketan in #940
build(deps): bump org.cyclonedx:cyclonedx-core-java from 13.2.0 to 13.3.0 by @dependabot[bot] in #950
build(deps): bump gradle-wrapper from 9.8.0 to 9.8.1 by @dependabot[bot] in #942
build(deps): bump org.cyclonedx.bom from 3.4.1 to 3.5.1 by @dependabot[bot] in #941
build(deps): bump com.diffplug.spotless from 8.10.3 to 8.10.4 by @dependabot[bot] in #943
build(deps): bump gradle-wrapper from 9.8.1 to 9.8.2 by @dependabot[bot] in #951
feat: let a build opt into failing on unresolved dependencies by @afalhambra-hivemq in #949
build(deps): bump com.google.errorprone:error_prone_core from 2.50.0 to 2.52.0 by @dependabot[bot] in #959
build(deps): bump net.ltgt.errorprone from 5.1.1 to 5.2.0 by @dependabot[bot] in #957
build(deps): bump gradle/actions/dependency-submission from 6.4.0 to 6.4.1 by @dependabot[bot] in #956
build(deps): bump gradle/actions/setup-gradle from 6.4.0 to 6.4.1 by @dependabot[bot] in #955
build(deps): bump actions/setup-java from 6.0.1 to 6.1.0 by @dependabot[bot] in #948
build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #944
build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #945
fix: release Maven models after SBOM graph construction by @TimJ0212 in #963

Full Changelog · Changes since 3.5.1