{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:73b638ef-019d-4582-a827-cfb9f23588df","version":1,"metadata":{"timestamp":"2026-10-15T10:13:00+09:00","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.54.1"}]},"component":{"bom-ref":"4134f50fc6c0fe4e","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/java-maven"}},"components":[{"bom-ref":"pkg:maven/org.apache.commons/commons-lang3@3.17.0?package-id=abc3547ee053c86c","type":"library","group":"org.apache.commons","name":"commons-lang3","version":"3.17.0","cpe":"cpe:2.3:a:apache:commons-lang3:3.17.0:*:*:*:*:*:*:*","purl":"pkg:maven/org.apache.commons/commons-lang3@3.17.0","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:apache:commons_lang3:3.17.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:apache:commons:3.17.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"commons-lang3"},{"name":"syft:metadata:-:groupID","value":"org.apache.commons"}]},{"bom-ref":"pkg:maven/com.google.guava/guava@33.3.1-jre?package-id=782577d54b402f03","type":"library","group":"com.google.guava","name":"guava","version":"33.3.1-jre","cpe":"cpe:2.3:a:com.google.guava:guava:33.3.1-jre:*:*:*:*:*:*:*","purl":"pkg:maven/com.google.guava/guava@33.3.1-jre","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:google:guava:33.3.1-jre:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:guava:guava:33.3.1-jre:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"guava"},{"name":"syft:metadata:-:groupID","value":"com.google.guava"}]},{"bom-ref":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2?package-id=bb1253a85723d222","type":"library","group":"com.fasterxml.jackson.core","name":"jackson-databind","version":"2.18.2","cpe":"cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson-databind:jackson-databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson-databind:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson_databind:jackson-databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson_databind:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:fasterxml:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson-databind:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson:jackson-databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson_databind:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:core:jackson-databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:core:jackson_databind:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:fasterxml:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jackson:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:core:jackson:2.18.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"jackson-databind"},{"name":"syft:metadata:-:groupID","value":"com.fasterxml.jackson.core"}]},{"bom-ref":"pkg:maven/com.example/java-maven@1.0.0?package-id=0f609f92bdafb83f","type":"library","name":"java-maven","version":"1.0.0","cpe":"cpe:2.3:a:com.example:java-maven:1.0.0:*:*:*:*:*:*:*","purl":"pkg:maven/com.example/java-maven@1.0.0","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:com.example:java_maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java-maven:java-maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java-maven:java_maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java_maven:java-maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java_maven:java_maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:example:java-maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:example:java_maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java:java-maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:java:java_maven:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"}]},{"bom-ref":"pkg:maven/org.junit.jupiter/junit-jupiter@5.11.3?package-id=67f492d863decccc","type":"library","group":"org.junit.jupiter","name":"junit-jupiter","version":"5.11.3","cpe":"cpe:2.3:a:org.junit.jupiter:junit-jupiter:5.11.3:*:*:*:*:*:*:*","purl":"pkg:maven/org.junit.jupiter/junit-jupiter@5.11.3","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:org.junit.jupiter:junit_jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit-jupiter:junit-jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit-jupiter:junit_jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit_jupiter:junit-jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit_jupiter:junit_jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:org.junit.jupiter:jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit-jupiter:jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit_jupiter:jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jupiter:junit-jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jupiter:junit_jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit:junit-jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit:junit_jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:jupiter:jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:junit:jupiter:5.11.3:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"junit-jupiter"},{"name":"syft:metadata:-:groupID","value":"org.junit.jupiter"}]},{"bom-ref":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1?package-id=be8e187f9921950a","type":"library","group":"org.apache.logging.log4j","name":"log4j-core","version":"2.14.1","cpe":"cpe:2.3:a:apache:log4j-core:2.14.1:*:*:*:*:*:*:*","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:apache:log4j_core:2.14.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"log4j-core"},{"name":"syft:metadata:-:groupID","value":"org.apache.logging.log4j"}]},{"bom-ref":"pkg:maven/org.projectlombok/lombok@1.18.34?package-id=dcae2b4e216c58df","type":"library","group":"org.projectlombok","name":"lombok","version":"1.18.34","cpe":"cpe:2.3:a:org.projectlombok:lombok:1.18.34:*:*:*:*:*:*:*","purl":"pkg:maven/org.projectlombok/lombok@1.18.34","properties":[{"name":"syft:package:foundBy","value":"java-pom-cataloger"},{"name":"syft:package:language","value":"java"},{"name":"syft:package:type","value":"java-archive"},{"name":"syft:package:metadataType","value":"java-archive"},{"name":"syft:cpe23","value":"cpe:2.3:a:projectlombok:lombok:1.18.34:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:lombok:lombok:1.18.34:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/pom.xml"},{"name":"syft:metadata:-:artifactID","value":"lombok"},{"name":"syft:metadata:-:groupID","value":"org.projectlombok"}]},{"bom-ref":"0328106cb52bb1b0","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/java-maven/pom.xml","hashes":[{"alg":"SHA-1","content":"cebea2c7d318f3ea6654bc38e03295271752b32f"},{"alg":"SHA-256","content":"5a9c7e95736693cb54c62adea04e66b9763314559c1be3fdbce979f635c1f0ef"}]}],"dependencies":[{"ref":"pkg:maven/com.example/java-maven@1.0.0?package-id=0f609f92bdafb83f","dependsOn":["pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2?package-id=bb1253a85723d222","pkg:maven/com.google.guava/guava@33.3.1-jre?package-id=782577d54b402f03","pkg:maven/org.apache.commons/commons-lang3@3.17.0?package-id=abc3547ee053c86c","pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1?package-id=be8e187f9921950a","pkg:maven/org.junit.jupiter/junit-jupiter@5.11.3?package-id=67f492d863decccc","pkg:maven/org.projectlombok/lombok@1.18.34?package-id=dcae2b4e216c58df"]}]}