CycloneDX/cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

Java

122

1,919 commits

updated Oct 9, 2026

See the code

README

Build Status Maven Central License Website Slack Invite Group Discussion Twitter

CycloneDX Core (Java)

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction

Maven Usage

<dependency>
    <groupId>org.cyclonedx</groupId>
    <artifactId>cyclonedx-core-java</artifactId>
    <version>13.1.0</version>
</dependency>

CycloneDX Schema Support

The following table provides information on the version of this library, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this library that is the compatible with the CycloneDX version supported by the target system.

VersionSchema VersionFormat(s)
13.xCycloneDX v1.7.1XML/JSON
12.xCycloneDX v1.6.1XML/JSON
11.xCycloneDX v1.6.1XML/JSON
10.xCycloneDX v1.6.1XML/JSON
9.xCycloneDX v1.6XML/JSON
8.xCycloneDX v1.5XML/JSON
7.xCycloneDX v1.4XML/JSON
6.xCycloneDX v1.4XML/JSON
5.xCycloneDX v1.3XML/JSON
4.xCycloneDX v1.2XML/JSON
3.xCycloneDX v1.2XML/JSON
2.xCycloneDX v1.1XML
1.xCycloneDX v1.0XML

Library API Documentation

The library API documentation can be viewed online at https://cyclonedx.github.io/cyclonedx-core-java/.

CycloneDX Core (Java) is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the License file for the full license.

bill-of-materials
bom
cyclonedx
library
mbom
obom
owasp
package-url
purl
saasbom
sbom
software-bill-of-materials
spdx
vex

CycloneDX/cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

Java

122

1,919 commits

updated Oct 9, 2026

See the code

README

Build Status Maven Central License Website Slack Invite Group Discussion Twitter

CycloneDX Core (Java)

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction

Maven Usage

<dependency>
    <groupId>org.cyclonedx</groupId>
    <artifactId>cyclonedx-core-java</artifactId>
    <version>13.1.0</version>
</dependency>

CycloneDX Schema Support

The following table provides information on the version of this library, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this library that is the compatible with the CycloneDX version supported by the target system.

VersionSchema VersionFormat(s)
13.xCycloneDX v1.7.1XML/JSON
12.xCycloneDX v1.6.1XML/JSON
11.xCycloneDX v1.6.1XML/JSON
10.xCycloneDX v1.6.1XML/JSON
9.xCycloneDX v1.6XML/JSON
8.xCycloneDX v1.5XML/JSON
7.xCycloneDX v1.4XML/JSON
6.xCycloneDX v1.4XML/JSON
5.xCycloneDX v1.3XML/JSON
4.xCycloneDX v1.2XML/JSON
3.xCycloneDX v1.2XML/JSON
2.xCycloneDX v1.1XML
1.xCycloneDX v1.0XML

Library API Documentation

The library API documentation can be viewed online at https://cyclonedx.github.io/cyclonedx-core-java/.

CycloneDX Core (Java) is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the License file for the full license.

bill-of-materials
bom
cyclonedx
library
mbom
obom
owasp
package-url
purl
saasbom
sbom
software-bill-of-materials
spdx
vex

Project health

Overall

8.6/10

Maintained

10/10

Code review

10/10
OpenSSF Scorecard

Latest release

13.2.0 · Aug 24, 2026

Releases this year

8

Significant stargazers

Brad Hards

65 followers · starred Jan 2022

Thomas Vitale

1,271 followers · starred Nov 2023

Spyros

95 followers · starred Jul 2023