From 4ab9ea055922eea6272953bdd93dda7d9ed2990b Mon Sep 17 00:00:00 2001
From: Christopher Kolstad <chriswk@getunleash.io>
Date: Tue, 16 Jun 2026 11:09:37 +0200
Subject: [PATCH 1/5] chore: added an sbom task for attaching sboms to github
 releases

---
 .github/workflows/release_jreleaser.yml |  8 +++
 pom.xml                                 | 86 +++++++++++++++++++------
 2 files changed, 75 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release_jreleaser.yml b/.github/workflows/release_jreleaser.yml
index c9c6878ca..c13c74a7c 100644
--- a/.github/workflows/release_jreleaser.yml
+++ b/.github/workflows/release_jreleaser.yml
@@ -54,6 +54,14 @@ jobs:
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
           JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.JRELEASER_MAVENCENTRAL_USERNAME }}
           JRELEASER_MAVENCENTRAL_TOKEN: ${{ secrets.JRELEASER_MAVENCENTRAL_TOKEN }}
+      - name: Generate SBOM
+        run: |
+          mvn --no-transfer-progress --batch-mode org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
+      - name: Attach SBOM to GitHub release
+        run: |
+          gh release upload "v${{ github.event.inputs.version }}" target/unleash-client-java-sbom.json --clobber
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
       - name: Set next version
         run: |
           mvn --no-transfer-progress --batch-mode versions:set -DnewVersion=${{ github.event.inputs.nextVersion }}-SNAPSHOT
diff --git a/pom.xml b/pom.xml
index 20fa19b23..a7e826edc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,5 +1,9 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<?xml version="1.0" encoding="UTF-8" ?>
+<project
+    xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+>
     <modelVersion>4.0.0</modelVersion>
     <groupId>io.getunleash</groupId>
     <artifactId>unleash-client-java</artifactId>
@@ -53,8 +57,10 @@
 
     <scm>
         <url>https://github.com/Unleash/unleash-java-sdk</url>
-        <connection>scm:git:https://github.com/Unleash/unleash-java-sdk.git</connection>
-        <developerConnection>scm:git:https://github.com/Unleash/unleash-java-sdk.git</developerConnection>
+        <connection
+        >scm:git:https://github.com/Unleash/unleash-java-sdk.git</connection>
+        <developerConnection
+        >scm:git:https://github.com/Unleash/unleash-java-sdk.git</developerConnection>
     </scm>
 
     <dependencies>
@@ -156,6 +162,33 @@
             </resource>
         </resources>
         <plugins>
+            <plugin>
+            <groupId>org.cyclonedx</groupId>
+            <artifactId>cyclonedx-maven-plugin</artifactId>
+            <version>2.7.9</version>
+            <executions>
+                <execution>
+                <phase>package</phase>
+                <goals>
+                    <goal>makeAggregateBom</goal>
+                </goals>
+                </execution>
+            </executions>
+            <configuration>
+                <projectType>application</projectType>
+                <schemaVersion>1.7</schemaVersion>
+                <includeBomSerialNumber>true</includeBomSerialNumber>
+                <includeCompileScope>true</includeCompileScope>
+                <includeProvidedScope>true</includeProvidedScope>
+                <includeRuntimeScope>true</includeRuntimeScope>
+                <includeSystemScope>true</includeSystemScope>
+                <includeTestScope>false</includeTestScope>
+                <includeLicenseText>true</includeLicenseText>
+                <outputReactorProjects>true</outputReactorProjects>
+                <outputFormat>all</outputFormat>
+                <outputName>unleash-client-java-sbom</outputName>
+            </configuration>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-dependency-plugin</artifactId>
@@ -188,7 +221,8 @@
                 <version>3.5.2</version>
                 <configuration>
                     <forkCount>1</forkCount>
-                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
+                    <argLine
+                    >@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                 </configuration>
             </plugin>
             <plugin>
@@ -198,8 +232,10 @@
                 <configuration>
                     <archive>
                         <manifest>
-                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
-                            <addDefaultSpecificationEntries>true</addDefaultSpecificationEntries>
+                            <addDefaultImplementationEntries
+                            >true</addDefaultImplementationEntries>
+                            <addDefaultSpecificationEntries
+                            >true</addDefaultSpecificationEntries>
                         </manifest>
                     </archive>
                 </configuration>
@@ -235,9 +271,11 @@
                         </goals>
                         <configuration>
                             <url>https://github.com</url>
-                            <fromFile>Unleash/client-specification/archive/v${version.unleash.specification}.zip
+                            <fromFile
+                            >Unleash/client-specification/archive/v${version.unleash.specification}.zip
                             </fromFile>
-                            <toDir>${project.build.directory}/client-specification</toDir>
+                            <toDir
+                            >${project.build.directory}/client-specification</toDir>
                         </configuration>
                     </execution>
                 </executions>
@@ -261,7 +299,8 @@
                                 <directory>
                                     ${project.build.directory}/client-specification/v${version.unleash.specification}.zip
                                 </directory>
-                                <outputDirectory>${project.build.directory}/client-specification/</outputDirectory>
+                                <outputDirectory
+                                >${project.build.directory}/client-specification/</outputDirectory>
                             </fileset>
                         </configuration>
                     </execution>
@@ -281,7 +320,8 @@
                             <goal>copy-resources</goal>
                         </goals>
                         <configuration>
-                            <outputDirectory>${project.build.testOutputDirectory}/client-specification</outputDirectory>
+                            <outputDirectory
+                            >${project.build.testOutputDirectory}/client-specification</outputDirectory>
                             <resources>
                                 <resource>
                                     <directory>
@@ -325,8 +365,10 @@
                      <mavenCentral>
                        <sonatype>
                          <active>ALWAYS</active>
-                         <url>https://central.sonatype.com/api/v1/publisher</url>
-                         <stagingRepositories>target/staging-deploy</stagingRepositories>
+                         <url
+                                        >https://central.sonatype.com/api/v1/publisher</url>
+                         <stagingRepositories
+                                        >target/staging-deploy</stagingRepositories>
                            <retryDelay>60</retryDelay>
                            <maxRetries>40</maxRetries>
                       </sonatype>
@@ -402,7 +444,8 @@
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.5.2</version>
                 <configuration>
-                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
+                    <argLine
+                    >@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                 </configuration>
             </plugin>
         </plugins>
@@ -414,13 +457,15 @@
                 <activeByDefault>false</activeByDefault>
             </activation>
             <properties>
-                <sonatypeOssDistMgmtSnapshotsUrl>https://s01.oss.sonatype.org/content/repositories/snapshots</sonatypeOssDistMgmtSnapshotsUrl>
+                <sonatypeOssDistMgmtSnapshotsUrl
+                >https://s01.oss.sonatype.org/content/repositories/snapshots</sonatypeOssDistMgmtSnapshotsUrl>
             </properties>
             <repositories>
                 <repository>
                     <id>sonatype-nexus-snapshots</id>
                     <name>Sonatype Nexus Snapshots</name>
-                    <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+                    <url
+                    >https://oss.sonatype.org/content/repositories/snapshots</url>
                     <releases>
                         <enabled>false</enabled>
                     </releases>
@@ -438,7 +483,8 @@
                 <repository>
                     <id>sonatype-nexus-staging</id>
                     <name>Nexus Release Repository</name>
-                    <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+                    <url
+                    >https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
                 </repository>
             </distributionManagement>
             <build>
@@ -507,7 +553,8 @@
         <profile>
             <id>publication</id>
             <properties>
-                <altDeploymentRepository>local::file:./target/staging-deploy</altDeploymentRepository>
+                <altDeploymentRepository
+                >local::file:./target/staging-deploy</altDeploymentRepository>
             </properties>
             <build>
                 <defaultGoal>deploy</defaultGoal>
@@ -553,7 +600,8 @@
                 <repository>
                     <id>sonatype-nexus-staging</id>
                     <name>Nexus Release Repository</name>
-                    <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+                    <url
+                    >https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
                 </repository>
             </distributionManagement>
         </profile>

From 84268b0ab8737041703572aed3edc6137c17921d Mon Sep 17 00:00:00 2001
From: Christopher Kolstad <chriswk@getunleash.io>
Date: Tue, 16 Jun 2026 12:06:54 +0200
Subject: [PATCH 2/5] chore: avoid unnecessary line changes

---
 pom.xml | 55 ++++++++++++++++++++++---------------------------------
 1 file changed, 22 insertions(+), 33 deletions(-)

diff --git a/pom.xml b/pom.xml
index a7e826edc..b701ff6a8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,10 +57,8 @@
 
     <scm>
         <url>https://github.com/Unleash/unleash-java-sdk</url>
-        <connection
-        >scm:git:https://github.com/Unleash/unleash-java-sdk.git</connection>
-        <developerConnection
-        >scm:git:https://github.com/Unleash/unleash-java-sdk.git</developerConnection>
+        <connection>scm:git:https://github.com/Unleash/unleash-java-sdk.git</connection>
+        <developerConnection>scm:git:https://github.com/Unleash/unleash-java-sdk.git</developerConnection>
     </scm>
 
     <dependencies>
@@ -299,8 +297,7 @@
                                 <directory>
                                     ${project.build.directory}/client-specification/v${version.unleash.specification}.zip
                                 </directory>
-                                <outputDirectory
-                                >${project.build.directory}/client-specification/</outputDirectory>
+                                <outputDirectory>${project.build.directory}/client-specification/</outputDirectory>
                             </fileset>
                         </configuration>
                     </execution>
@@ -365,10 +362,8 @@
                      <mavenCentral>
                        <sonatype>
                          <active>ALWAYS</active>
-                         <url
-                                        >https://central.sonatype.com/api/v1/publisher</url>
-                         <stagingRepositories
-                                        >target/staging-deploy</stagingRepositories>
+                         <url>https://central.sonatype.com/api/v1/publisher</url>
+                         <stagingRepositories>target/staging-deploy</stagingRepositories>
                            <retryDelay>60</retryDelay>
                            <maxRetries>40</maxRetries>
                       </sonatype>
@@ -444,8 +439,7 @@
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.5.2</version>
                 <configuration>
-                    <argLine
-                    >@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
+                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                 </configuration>
             </plugin>
         </plugins>
@@ -457,15 +451,13 @@
                 <activeByDefault>false</activeByDefault>
             </activation>
             <properties>
-                <sonatypeOssDistMgmtSnapshotsUrl
-                >https://s01.oss.sonatype.org/content/repositories/snapshots</sonatypeOssDistMgmtSnapshotsUrl>
+                <sonatypeOssDistMgmtSnapshotsUrl>https://s01.oss.sonatype.org/content/repositories/snapshots</sonatypeOssDistMgmtSnapshotsUrl>
             </properties>
             <repositories>
                 <repository>
                     <id>sonatype-nexus-snapshots</id>
                     <name>Sonatype Nexus Snapshots</name>
-                    <url
-                    >https://oss.sonatype.org/content/repositories/snapshots</url>
+                    <url>https://oss.sonatype.org/content/repositories/snapshots</url>
                     <releases>
                         <enabled>false</enabled>
                     </releases>
@@ -483,8 +475,7 @@
                 <repository>
                     <id>sonatype-nexus-staging</id>
                     <name>Nexus Release Repository</name>
-                    <url
-                    >https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+                    <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
                 </repository>
             </distributionManagement>
             <build>
@@ -535,17 +526,17 @@
                             </gpgArguments>
                           </configuration>
                     </plugin>
-                                <plugin>
-                <groupId>org.sonatype.plugins</groupId>
-                <artifactId>nexus-staging-maven-plugin</artifactId>
-                <version>1.7.0</version>
-                <extensions>true</extensions>
-                <configuration>
-                    <serverId>ossrh</serverId>
-                    <nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
-                    <autoReleaseAfterClose>true</autoReleaseAfterClose>
-                </configuration>
-            </plugin>
+                    <plugin>
+                        <groupId>org.sonatype.plugins</groupId>
+                        <artifactId>nexus-staging-maven-plugin</artifactId>
+                        <version>1.7.0</version>
+                        <extensions>true</extensions>
+                        <configuration>
+                            <serverId>ossrh</serverId>
+                            <nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
+                            <autoReleaseAfterClose>true</autoReleaseAfterClose>
+                        </configuration>
+                    </plugin>
                 </plugins>
 
             </build>
@@ -553,8 +544,7 @@
         <profile>
             <id>publication</id>
             <properties>
-                <altDeploymentRepository
-                >local::file:./target/staging-deploy</altDeploymentRepository>
+                <altDeploymentRepository>local::file:./target/staging-deploy</altDeploymentRepository>
             </properties>
             <build>
                 <defaultGoal>deploy</defaultGoal>
@@ -600,8 +590,7 @@
                 <repository>
                     <id>sonatype-nexus-staging</id>
                     <name>Nexus Release Repository</name>
-                    <url
-                    >https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+                    <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
                 </repository>
             </distributionManagement>
         </profile>

From 4f45e8604b54574594a2c89a8e1aada9e2887c01 Mon Sep 17 00:00:00 2001
From: Christopher Kolstad <chriswk@getunleash.io>
Date: Tue, 16 Jun 2026 12:54:25 +0200
Subject: [PATCH 3/5] chore: more xml format tweaking

---
 pom.xml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index b701ff6a8..e3054652b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -230,10 +230,8 @@
                 <configuration>
                     <archive>
                         <manifest>
-                            <addDefaultImplementationEntries
-                            >true</addDefaultImplementationEntries>
-                            <addDefaultSpecificationEntries
-                            >true</addDefaultSpecificationEntries>
+                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
+                            <addDefaultSpecificationEntries>true</addDefaultSpecificationEntries>
                         </manifest>
                     </archive>
                 </configuration>

From a1719914b862269b335314d0f98c655456a77005 Mon Sep 17 00:00:00 2001
From: Christopher Kolstad <chriswk@getunleash.io>
Date: Tue, 16 Jun 2026 12:54:55 +0200
Subject: [PATCH 4/5] chore: argLine formatting

---
 pom.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index e3054652b..508b701fe 100644
--- a/pom.xml
+++ b/pom.xml
@@ -219,8 +219,7 @@
                 <version>3.5.2</version>
                 <configuration>
                     <forkCount>1</forkCount>
-                    <argLine
-                    >@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
+                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                 </configuration>
             </plugin>
             <plugin>

From 537ed54d5ce6e89cd45feef10e187a729be89418 Mon Sep 17 00:00:00 2001
From: Christopher Kolstad <chriswk@getunleash.io>
Date: Tue, 16 Jun 2026 12:56:12 +0200
Subject: [PATCH 5/5] chore: formatting

---
 pom.xml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 508b701fe..4ecc0dd26 100644
--- a/pom.xml
+++ b/pom.xml
@@ -266,11 +266,8 @@
                         </goals>
                         <configuration>
                             <url>https://github.com</url>
-                            <fromFile
-                            >Unleash/client-specification/archive/v${version.unleash.specification}.zip
-                            </fromFile>
-                            <toDir
-                            >${project.build.directory}/client-specification</toDir>
+                            <fromFile>Unleash/client-specification/archive/v${version.unleash.specification}.zip</fromFile>
+                            <toDir>${project.build.directory}/client-specification</toDir>
                         </configuration>
                     </execution>
                 </executions>
@@ -314,8 +311,7 @@
                             <goal>copy-resources</goal>
                         </goals>
                         <configuration>
-                            <outputDirectory
-                            >${project.build.testOutputDirectory}/client-specification</outputDirectory>
+                            <outputDirectory>${project.build.testOutputDirectory}/client-specification</outputDirectory>
                             <resources>
                                 <resource>
                                     <directory>