Transitive dependencies missing in SBOM for multi-module build when Module depends on WAR module #641

In a multi-module Maven build, transitive dependencies are not resolved correctly in the generated SBOM when a module POM depends on a war or ear module.

What makes this more confusing is that the same transitive dependencies also do not appear in mvn dependency:tree. From a user perspective, the resulting SBOM is incomplete because dependencies that are effectively part of the packaged application are missing.

To reproduce, you need:

• root module pom.xml
• sbom submodule pom.xml
• war submodule pom.xml

Now call mvn package or mvn dependency:tree

Expected behaviour:

The sbom module should depend on the test-war module, which then transitively depends on the jakarta.json-api.jar

Actual behavior:

The generated SBOM is missing transitive dependencies from the war module completely, and the dependency tree shows that too.

It would be helpful to know:

• whether this is considered a limitation of the CycloneDX Maven Plugin,
• whether this is inherited from Maven dependency resolution behavior,
• and whether there is a recommended workaround for generating a complete SBOM in this kind of project layout.

Environment:

• CycloneDX Maven Plugin version: 2.9.1
• Maven version: 3.9.11
• Java version: 11.0.30