--- results/net.sourceforge.pmd/pmd/7.0.0/oss-rebuild-improved-2/reference/pmd-7.0.0-cyclonedx.xml:bom.xml	2025-04-06 13:02:32.394203250 +0000
+++ results/net.sourceforge.pmd/pmd/7.0.0/oss-rebuild-improved-2/rebuild/pmd-7.0.0-cyclonedx.xml:bom.xml	2025-04-06 13:02:43.450029757 +0000
@@ -3900,6 +3900,156 @@
       <purl>pkg:maven/org.scala-lang.modules/scala-collection-compat_2.12@2.11.0?type=jar</purl>
       <externalReferences><reference type="website"><url>http://www.scala-lang.org/</url></reference><reference type="issue-tracker"><url>https://github.com/scala/scala-collection-compat/issues</url></reference><reference type="vcs"><url>https://github.com/scala/scala-collection-compat</url></reference></externalReferences>
     </component>
+    <component type="library" bom-ref="pkg:maven/net.sourceforge.pmd/pmd-cli@7.0.0?type=jar">
+      <publisher>PMD</publisher>
+      <group>net.sourceforge.pmd</group>
+      <name>pmd-cli</name>
+      <version>7.0.0</version>
+      <description>PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks,
+        unnecessary object creation, and so forth. It supports many languages. It can be extended with custom rules.
+        It uses JavaCC and Antlr to parse source files into abstract syntax trees (AST) and runs rules against them to find violations.
+        Rules can be written in Java or using a XPath query.
+
+        It supports Java, JavaScript, Salesforce.com Apex and Visualforce,
+        Kotlin, Swift, Modelica, PLSQL, Apache Velocity, JSP, WSDL, HTML, XML and XSL.
+        Scala is supported, but there are currently no Scala rules available.
+
+        Additionally, it includes CPD, the copy-paste-detector. CPD finds duplicated code in
+        Coco, C/C++, C#, Dart, Fortran, Gherkin, Go, Groovy, HTML, Java, JavaScript, JSP, Julia, Kotlin, Lua, Matlab, Modelica,
+        Objective-C, Perl, PHP, PLSQL, Python, Ruby, Salesforce.com Apex and Visualforce, Scala, Swift, T-SQL, Typescript and XML.</description>
+      <licenses>
+        <license>
+          <name>BSD-style</name>
+          <url>http://pmd.sourceforge.net/license.html</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/net.sourceforge.pmd/pmd-cli@7.0.0?type=jar</purl>
+      <externalReferences><reference type="website"><url>https://pmd.github.io/pmd-cli/</url></reference><reference type="build-system"><url>https://github.com/pmd/pmd/actions</url></reference><reference type="distribution"><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></reference><reference type="issue-tracker"><url>https://github.com/pmd/pmd/issues</url></reference><reference type="mailing-list"><url>https://sourceforge.net/p/pmd/mailman/pmd-devel</url></reference><reference type="vcs"><url>https://github.com/pmd/pmd/pmd-cli</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/net.sourceforge.pmd/pmd-designer@7.0.0?type=jar">
+      <group>net.sourceforge.pmd</group>
+      <name>pmd-designer</name>
+      <version>7.0.0</version>
+      <description>The Rule Designer is a graphical tool that helps PMD users develop their custom rules.</description>
+      <scope>required</scope>
+      <hashes>
+        <hash alg="MD5">b4dd3a15b1d92ba3d4e89ac789141987</hash>
+        <hash alg="SHA-1">df6db4dee00f855170cf5dfda940f3ea8365bcd6</hash>
+        <hash alg="SHA-256">bc637fa0a2545f73b79746500a863255937dd408f949990c32b1d747a53101ae</hash>
+        <hash alg="SHA-512">dd14642a62684415f8c2c7110709adf6704e398c794ac535f513547d0d5037cd0814e3a795f3846a0339f7c71c5d6e04c546be5a575ec8ded29a54b9f7a51778</hash>
+        <hash alg="SHA-384">444caca32731d806d47b34b8edda0b6c6a6c1dc95ff086250bd1b8e9095ec6edcc48b2c9935ffe49285e440a1863a9ba</hash>
+        <hash alg="SHA3-384">0434befede39c129e6325ae1f6bdce5073a12d78f2851d53fd0bce145ff932cc2fbe0f3779d8decb01ec2cd7d66c3102</hash>
+        <hash alg="SHA3-256">6c589ff5c9926675ad52caa2d8d4f2e894b2199cbdf857b0c809a7cfd17cccaa</hash>
+        <hash alg="SHA3-512">bebc15b2c2775526147096b4e78c4328a9e0b73d37ad613df1455800df5173a7ace8b2bbda8a2f4e2d9209b4d9fab4b8404921fec6fc9e09256a684265440d30</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+          <url>https://opensource.org/licenses/BSD-2-Clause</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/net.sourceforge.pmd/pmd-designer@7.0.0?type=jar</purl>
+      <externalReferences><reference type="website"><url>https://pmd.github.io</url></reference><reference type="build-system"><url>https://github.com/pmd/pmd-designer/actions</url></reference><reference type="distribution"><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></reference><reference type="vcs"><url>https://github.com/pmd/pmd-designer</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/info.picocli/picocli@4.7.5?type=jar">
+      <group>info.picocli</group>
+      <name>picocli</name>
+      <version>4.7.5</version>
+      <description>Java command line parser with both an annotations API and a programmatic API. Usage help with ANSI styles and colors. Autocomplete. Nested subcommands. Easily included as source to avoid adding a dependency.</description>
+      <scope>required</scope>
+      <hashes>
+        <hash alg="MD5">130eeeb3c9c1a58d7174d10a9d771644</hash>
+        <hash alg="SHA-1">a6f99ec0a97aeb3be63a9f55703b28f2cf08788f</hash>
+        <hash alg="SHA-256">e83a906fb99b57091d1d68ac11f7c3d2518bd7a81a9c71b259e2c00d1564c8e8</hash>
+        <hash alg="SHA-512">9fe48bf352b07e708f251f0fcda05a994317083dced7e0ffd67a140219eda0fa4b1f73eefa11920e86e388b9ae49d2d148bf984c24da4e2293509dfc265a951e</hash>
+        <hash alg="SHA-384">b74b7e895eb2ca849ac87567d50bfa9bcf957051e8fc797fda79881fedca917fa17e54845cffc6f36708f5f98d6eafdf</hash>
+        <hash alg="SHA3-384">9a145f639e8ea7856c84441985467bd89c7dddb9e3adfed6db2d33556de92ba44c959be03a4d1f06667ce53b09899576</hash>
+        <hash alg="SHA3-256">566eb56566442d65cc6180d620e800534f676dc07a1bcd500947d3c305f42ff6</hash>
+        <hash alg="SHA3-512">86c64d4838e860252cdc605eaf26ce937836a49d6f75c7b4f1d6646985662877d79895c2ed5bc1e3a84ca9b9ec65b7c22768622b02588cf9bba90a86e4884104</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/info.picocli/picocli@4.7.5?type=jar</purl>
+      <externalReferences><reference type="website"><url>https://picocli.info</url></reference><reference type="vcs"><url>https://github.com/remkop/picocli/tree/master</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/me.tongfei/progressbar@0.9.5?type=jar">
+      <group>me.tongfei</group>
+      <name>progressbar</name>
+      <version>0.9.5</version>
+      <description>A terminal-based progress bar for JVM</description>
+      <scope>required</scope>
+      <hashes>
+        <hash alg="MD5">7bda2e0d24c326b6af99f8ff28239c28</hash>
+        <hash alg="SHA-1">aaf7a04a9e9e6bd0aa03268cfcd6168e903bcf2d</hash>
+        <hash alg="SHA-256">a1a086fa66f85c49bb3ca701a78cebb33647f367d4a5be8588c784d56272cc6e</hash>
+        <hash alg="SHA-512">e9f29b15cea7746c02288645c92633ec2a30b19fc1273a71608df5d42140ecaf69339c576bf263093148f4548a85924a62eb4e24013128cf61053b4c97df82c8</hash>
+        <hash alg="SHA-384">126db35d39f280298d6395de0f90df954a8e64b41db424b00f565dda1bde0f66f017237a42094adee4d72a453e6b1b7e</hash>
+        <hash alg="SHA3-384">7452d8b7785cab60dfb10e5c36f8547c8bc0e6df985b2c9fde5134481bce5426e83ba59efbdcdb38538f0168a5aecb7e</hash>
+        <hash alg="SHA3-256">e02f1576f6ec76e457b728b6049cb4b859fa342dcfcd467e9347fb82f307355d</hash>
+        <hash alg="SHA3-512">b8cbcbc1d4e126305d354382d44fb4b6999fd03d67c0770677f5067e8926be3903be3a34982cc0795eec2b39a48395574ca11b0da34229c923b255cc44630782</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>MIT</id>
+          <url>https://opensource.org/licenses/MIT</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/me.tongfei/progressbar@0.9.5?type=jar</purl>
+      <externalReferences><reference type="website"><url>http://github.com/ctongfei/progressbar</url></reference><reference type="distribution"><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.jline/jline@3.21.0?type=jar">
+      <group>org.jline</group>
+      <name>jline</name>
+      <version>3.21.0</version>
+      <description>JLine</description>
+      <scope>required</scope>
+      <hashes>
+        <hash alg="MD5">859778f9cdd3bd42bbaaf0f6f7fe5e6a</hash>
+        <hash alg="SHA-1">2bf6f2311356f309fda0412e9389d2499346b5a1</hash>
+        <hash alg="SHA-256">1e7d63a2bd1c26354ca1987e55469ea4327c4a3845c10d7a7790ca9729c49c02</hash>
+        <hash alg="SHA-512">1a2321279254bd9782b76bf6afe4dbb137ad2efb73e441f7a0d8fd568eee9f600ce812223b0aa579d598071f43a1663e345f44d07b24a9469698f7224c56771b</hash>
+        <hash alg="SHA-384">8bbcb0d0e3018e29cf03853efdae4e275541f9c4e4424228a5fbc83d0f8ae7eb3bef6d8ae4c85c4c69e11e2a67eb4eb7</hash>
+        <hash alg="SHA3-384">2f45c0ef812ad0726f79a5399dbf034984f7e5eae482948d90220f98dec4a354e75116369734a0a44c6a614fd025ddb6</hash>
+        <hash alg="SHA3-256">a3650ce5b31b44e5d07c3405f7a279483fa2e7768a57f7f284e99c75733d52db</hash>
+        <hash alg="SHA3-512">2906a3597c98169b426946afb079c2429a3b6041985651b50526d0fc98c21e514d44c6d3f1b4e7a5b508469c4783535c3eea5d2161d33270c6d052b67c48fe8c</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>BSD-4-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jline/jline@3.21.0?type=jar</purl>
+      <externalReferences><reference type="website"><url>http://nexus.sonatype.org/oss-repository-hosting.html/jline-parent/jline</url></reference><reference type="build-system"><url>https://travis-ci.org/jline/jline3</url></reference><reference type="distribution"><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></reference><reference type="issue-tracker"><url>https://github.com/jline/jline3/issues</url></reference><reference type="mailing-list"><url>https://groups.google.com/group/jline-users</url></reference><reference type="vcs"><url>http://github.com/jline/jline3/jline</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/net.sourceforge.pmd/pmd-dist@7.0.0?type=jar">
+      <publisher>PMD</publisher>
+      <group>net.sourceforge.pmd</group>
+      <name>pmd-dist</name>
+      <version>7.0.0</version>
+      <description>PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks,
+        unnecessary object creation, and so forth. It supports many languages. It can be extended with custom rules.
+        It uses JavaCC and Antlr to parse source files into abstract syntax trees (AST) and runs rules against them to find violations.
+        Rules can be written in Java or using a XPath query.
+
+        It supports Java, JavaScript, Salesforce.com Apex and Visualforce,
+        Kotlin, Swift, Modelica, PLSQL, Apache Velocity, JSP, WSDL, HTML, XML and XSL.
+        Scala is supported, but there are currently no Scala rules available.
+
+        Additionally, it includes CPD, the copy-paste-detector. CPD finds duplicated code in
+        Coco, C/C++, C#, Dart, Fortran, Gherkin, Go, Groovy, HTML, Java, JavaScript, JSP, Julia, Kotlin, Lua, Matlab, Modelica,
+        Objective-C, Perl, PHP, PLSQL, Python, Ruby, Salesforce.com Apex and Visualforce, Scala, Swift, T-SQL, Typescript and XML.</description>
+      <licenses>
+        <license>
+          <name>BSD-style</name>
+          <url>http://pmd.sourceforge.net/license.html</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/net.sourceforge.pmd/pmd-dist@7.0.0?type=jar</purl>
+      <externalReferences><reference type="website"><url>https://pmd.github.io/pmd-dist/</url></reference><reference type="build-system"><url>https://github.com/pmd/pmd/actions</url></reference><reference type="distribution"><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></reference><reference type="issue-tracker"><url>https://github.com/pmd/pmd/issues</url></reference><reference type="mailing-list"><url>https://sourceforge.net/p/pmd/mailman/pmd-devel</url></reference><reference type="vcs"><url>https://github.com/pmd/pmd/pmd-dist</url></reference></externalReferences>
+    </component>
     <component type="library" bom-ref="pkg:maven/net.sourceforge.pmd/pmd-compat6@7.0.0?type=jar">
       <publisher>PMD</publisher>
       <group>net.sourceforge.pmd</group>
@@ -3966,6 +4116,8 @@
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-xml@7.0.0?type=jar"/>
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-languages-deps@7.0.0?type=pom"/>
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-doc@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-cli@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-dist@7.0.0?type=jar"/>
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-compat6@7.0.0?type=jar"/>
     </dependency>
     <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-core@7.0.0?type=jar">
@@ -4596,6 +4748,30 @@
     <dependency ref="pkg:maven/org.scala-lang.modules/scala-collection-compat_2.12@2.11.0?type=jar">
       <dependency ref="pkg:maven/org.scala-lang/scala-library@2.12.19?type=jar"/>
     </dependency>
+    <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-cli@7.0.0?type=jar">
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-core@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-designer@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar"/>
+      <dependency ref="pkg:maven/org.slf4j/slf4j-simple@1.7.36?type=jar"/>
+      <dependency ref="pkg:maven/info.picocli/picocli@4.7.5?type=jar"/>
+      <dependency ref="pkg:maven/me.tongfei/progressbar@0.9.5?type=jar"/>
+      <dependency ref="pkg:maven/org.checkerframework/checker-qual@2.11.1?type=jar"/>
+    </dependency>
+    <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-designer@7.0.0?type=jar"/>
+    <dependency ref="pkg:maven/info.picocli/picocli@4.7.5?type=jar"/>
+    <dependency ref="pkg:maven/me.tongfei/progressbar@0.9.5?type=jar">
+      <dependency ref="pkg:maven/org.jline/jline@3.21.0?type=jar"/>
+    </dependency>
+    <dependency ref="pkg:maven/org.jline/jline@3.21.0?type=jar"/>
+    <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-dist@7.0.0?type=jar">
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-core@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-cli@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-ant@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-designer@7.0.0?type=jar"/>
+      <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-languages-deps@7.0.0?type=pom"/>
+      <dependency ref="pkg:maven/org.slf4j/slf4j-simple@1.7.36?type=jar"/>
+      <dependency ref="pkg:maven/org.apache.commons/commons-lang3@3.14.0?type=jar"/>
+    </dependency>
     <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-compat6@7.0.0?type=jar">
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-core@7.0.0?type=jar"/>
       <dependency ref="pkg:maven/net.sourceforge.pmd/pmd-java@7.0.0?type=jar"/>
