CycloneDX SBOM dependency graph: no dependencies section is created for maven multimodule/npm project

[mawl]

We've got issues creating a cyclonedx sbom containing a dependency graph:

The analyser.yml file shows

    dependency_graphs:
      Maven:
        packages:
        - "Maven:antlr:antlr:x.x.x"
        - ...
      ...
      NPM:
        packages:
        - "NPM::abbrev:x.x.x"
        - ...   

But no dependencies section is created in cyclonedx sbom file:

...
   <component type="library">
      <group>com.sun.activation</group>
      <name>jakarta.activation</name>
      <version>x.x.x</version>
      <description>JavaBeans Activation Framework</description>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-1">8013606426a73d8ba6b568370877251e91a38b89</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <text content-type="plain/text" encoding="base64">...</text><ort:origin xmlns:ort="http://www.w3.org/1999/xhtml">declared license</ort:origin>
        </license>
      </licenses>
      <purl>pkg:maven/com.sun.activation/jakarta.activation@x.x.x</purl>
      <modified>false</modified>
      <externalReferences><reference type="website"><url>https://github.com/eclipse-ee4j/jaf/jakarta.activation</url></reference></externalReferences><ort:dependencyType xmlns:ort="http://www.w3.org/1999/xhtml">transitive</ort:dependencyType>
    </component>
...
  </components>
  <externalReferences><reference type="vcs"><url>...</url><comment>URL to the Git repository of the projects</comment></reference></externalReferences>
</bom>

and I wonder why there are ort:dependencyType entries in the component nodes

Any ideas how to to fix/debug it?

[sschuberth]

But no dependencies section is created in cyclonedx sbom file:

That's a known missing feature, see #3906. We're happily accepting PRs 😉

and I wonder why there are ort:dependencyType entries in the component nodes

That was a feature request from @CleanHit back then, see #2929. It was easy enough to implement, so we did for the fun of it 😀