Fixes JSTEP-14: SBOM generation (#290)

Author: cowtowncoder

pom.xml

@@ -78,9 +78,21 @@
     <plugins>
       <!-- First: no replacer plugin (no Packaversion.java.in) for this package -->
 
+      <!-- 28-Apr-2025, tatu: Will get these settings from `jackson-bom` in 3.x but
+	     2.x does not extend it so...
+        -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+        <configuration>
+          <skipNotDeployed>true</skipNotDeployed>
+          <classifier>sbom-cyclonedx</classifier>
+        </configuration>
+      </plugin>
+
       <plugin>
         <!-- 08-Mar-2019, tatu: Would get these settings from `jackson-bom` except we 
-              do not extend it so...
+              do not extend it (in 2.x) so...
           -->
         <groupId>org.moditect</groupId>
         <artifactId>moditect-maven-plugin</artifactId>

release-notes/VERSION-2.x

@@ -11,6 +11,10 @@ NOTE: Annotations module will never contain changes in patch versions,
 === Releases ===
 ------------------------------------------------------------------------
 
+2.20.0 (not yet released)
+
+- Generate SBOMs [JSTEP-14]
+
 2.19.0 (24-Apr-2025)
 
 #280: Minor change to `module-info.java`: use "open module"