{"diffoscope-json-version": 1, "source1": "/input1", "source2": "/input2", "unified_diff": null, "details": [{"source1": "/input1", "source2": "/input2", "unified_diff": "@@ -1,11 +1,11 @@\n <?xml version=\"1.0\" encoding=\"utf-8\"?>\n-<bom xmlns=\"http://cyclonedx.org/schema/bom/1.4\" serialNumber=\"urn:uuid:794fc03d-0d35-4311-91b3-4b412437c8c8\" version=\"1\">\n+<bom xmlns=\"http://cyclonedx.org/schema/bom/1.4\" serialNumber=\"urn:uuid:98ed9535-cf1d-441b-8d51-e45dc9ab177c\" version=\"1\">\n   <metadata>\n-    <timestamp>2023-04-29T10:08:30Z</timestamp>\n+    <timestamp>2025-07-11T06:29:47Z</timestamp>\n     <tools>\n       <tool>\n         <vendor>CycloneDX</vendor>\n         <name>cyclonedx-gradle-plugin</name>\n         <version>1.7.4</version>\n       </tool>\n     </tools>\n@@ -13,170 +13,14 @@\n       <group>org.jreleaser</group>\n       <name>jreleaser-sdkman-java-sdk</name>\n       <version>1.6.0</version>\n       <purl>pkg:maven/org.jreleaser/jreleaser-sdkman-java-sdk@1.6.0?type=jar</purl>\n     </component>\n   </metadata>\n   <components>\n-    <component type=\"library\" bom-ref=\"pkg:maven/io.github.openfeign/feign-core@12.3?type=jar\">\n-      <group>io.github.openfeign</group>\n-      <name>feign-core</name>\n-      <version>12.3</version>\n-      <description>Feign Core</description>\n-      <hashes>\n-        <hash alg=\"MD5\">9e6e1ff8b68d2b6c1fc5bdc7ff208030</hash>\n-        <hash alg=\"SHA-1\">d280b09a17b63e69788fd3d8d215b7013ab48b16</hash>\n-        <hash alg=\"SHA-256\">939fbed2c2392a9633bc1d26f0ef9e934b059d1a9a9d4d966cedaf9075c546ec</hash>\n-        <hash alg=\"SHA-512\">8335901d8918747dc29d37a2ac630c6a78ea6ff04bfea77e6d8c74188e9e584142920996c45120caa86299486949a04e1ec1f1bef30229904360fcb5c5d4a1c4</hash>\n-        <hash alg=\"SHA-384\">dc7a0d10bdf2c3aeafba83ca7e41d21c3288f3df0b76e339788fcf7606381970b6429108dbf2d1212075d1feba040842</hash>\n-        <hash alg=\"SHA3-384\">2907938ea76735cde9b34676c6c8b04786f1595687f96734e7659768175cb7a525508f84c48d9b10b0b2f593158e1ed5</hash>\n-        <hash alg=\"SHA3-256\">474f6b0ab420bf63549ed123fff99b73fc881771c6a0c591e58dfb17adbe9899</hash>\n-        <hash alg=\"SHA3-512\">553a6dc1c3cf7facdb3b4e15be1d6d90259f1d36ce137db3a6e53a967ef4939aaa98c974b059c8f32dd42316bb7eee3b51910cf0fb172d0df9b8ff39d8cc722d</hash>\n-      </hashes>\n-      <licenses>\n-        <license>\n-          <id>Apache-2.0</id>\n-        </license>\n-      </licenses>\n-      <purl>pkg:maven/io.github.openfeign/feign-core@12.3?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar\">\n-      <group>org.jreleaser</group>\n-      <name>jreleaser-model-api</name>\n-      <version>1.6.0</version>\n-      <hashes>\n-        <hash alg=\"MD5\">288354c621fdfef298e4e8cdc843e2c3</hash>\n-        <hash alg=\"SHA-1\">54bcb05008c6f0b50433f8d0fe82e3a217317db1</hash>\n-        <hash alg=\"SHA-256\">397e18c4fa02ba508e409a119866d4e78d64c6c76f5a4f22b3aefc027b662b9b</hash>\n-        <hash alg=\"SHA-512\">67c4e2f9acb6db78c21cfd23d3411ce1e32b23690a1d5035a285b48cd9b996fd4c80b504d050e87a4a5604e6b56ca52878a464593f0bd8eea53059bcb263289f</hash>\n-        <hash alg=\"SHA-384\">8f67be44af6f792c32f2b86d07738c52e5b742a650d010e8c0b5e60a62db627d5c695f23f24d814f232fc0246d03086c</hash>\n-        <hash alg=\"SHA3-384\">1e5c3dffd4e3c545081904db6dcff892bd2f27285b4fa46a57cdd23c3fbb382ab06268e87d57212996387269b2c8b72f</hash>\n-        <hash alg=\"SHA3-256\">d2b875e45846a0d17cf7f85d6289681ee42897519cdaca9625ffc56b1639909d</hash>\n-        <hash alg=\"SHA3-512\">1a098f05c0735a7ed19cf374440818e9882b0288728f6658ce3709ac534c06cc7dc36ea4d7656a35281758d1ec09c31edf13a98d6680206a0c9fb1dff21ad04f</hash>\n-      </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar\">\n-      <group>org.apache.commons</group>\n-      <name>commons-jexl3</name>\n-      <version>3.3</version>\n-      <description>JEXL is a library intended to facilitate the implementation of scripting features in\n-        applications and frameworks written in Java.</description>\n-      <hashes>\n-        <hash alg=\"MD5\">3a332e3beb67b3a2a20bd0a950fc57c4</hash>\n-        <hash alg=\"SHA-1\">c76b4cfa436c3e79e04806e62656b09968c388ba</hash>\n-        <hash alg=\"SHA-256\">07b0ff6c5a10ffb2e2c02da9e2c0e2e6702df44178cfb76881f69447fc386014</hash>\n-        <hash alg=\"SHA-512\">879111d1c3ad021ea3961e49161b3ff6ba251044ffef1ca4d36d880d9a09b1f395e17eef221a13274303f44e116204ae4b2a3ee3e931f117fc901e321d59b5c6</hash>\n-        <hash alg=\"SHA-384\">7a268bf2c903be86813fcc7f06158abf79d558ee59ebf03470ebd06ca6e6d169beb1c3600e07c20c4f95fa7827fde841</hash>\n-        <hash alg=\"SHA3-384\">1803d239f17f7eeee6edb69d38c4473319fd4eeeb684eda5c38b577a7aaf42965ce41d9082d515d5007be9a0b0712d81</hash>\n-        <hash alg=\"SHA3-256\">01163da5e720b6d1f6bf8b6e9e398d26a1be92b3f18ef6089d218d54166b0c01</hash>\n-        <hash alg=\"SHA3-512\">8abdd72c14492340c05fd5d3555682a308ac00ac1b1e1e15ae38abc47f454f50db9e0727a49df72a50bf49f1447a6ca9dadc48b9ffd45a043bcbae9e5e050d3d</hash>\n-      </hashes>\n-      <licenses>\n-        <license>\n-          <id>Apache-2.0</id>\n-          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n-        </license>\n-      </licenses>\n-      <purl>pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar</purl>\n-      <modified>false</modified>\n-      <externalReferences>\n-        <reference type=\"issue-tracker\">\n-          <url>https://issues.apache.org/jira/browse/JEXL</url>\n-        </reference>\n-        <reference type=\"vcs\">\n-          <url>https://gitbox.apache.org/repos/asf/commons-jexl.git</url>\n-        </reference>\n-      </externalReferences>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar\">\n-      <group>org.bouncycastle</group>\n-      <name>bcpg-jdk15on</name>\n-      <version>1.70</version>\n-      <description>The Bouncy Castle Java API for handling the OpenPGP protocol. This jar contains the OpenPGP API for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.</description>\n-      <hashes>\n-        <hash alg=\"MD5\">01ddc3aa0289346f4db19d95039cefdb</hash>\n-        <hash alg=\"SHA-1\">062f72ec06f31a6c31a3f3355fce0384b21126d7</hash>\n-        <hash alg=\"SHA-256\">4f08f4aa74048824151c98dd3e92e7165ac30659834404f08a8e843bdad32847</hash>\n-        <hash alg=\"SHA-512\">4e240b7811ef90c090e83a181dace41da487555e4136221861b0060f9af6d8b316f2dd0472f747adb98ca5372f46055456ef04bdc0c3992188ab13302922fce9</hash>\n-        <hash alg=\"SHA-384\">d89dec6226112d13cbea461d84740699770dd7d8ad3f67ab65e7b49fd08a096a948e54da2e6a681925c4320f410bba37</hash>\n-        <hash alg=\"SHA3-384\">5e8e8ca63cc550a8f50b627c4dd051f0eb5c31b99ff53dabd7d5f5d1ed98d0dc1d4963a09fc0db32f8e0ff769a2a6e65</hash>\n-        <hash alg=\"SHA3-256\">77f28e7e22b3b3a8d7b667fb7f783847c4b11ee7208833636e09e8b38390fd51</hash>\n-        <hash alg=\"SHA3-512\">cb238dbb641c42c49b5801bdfa6432395e860c1a7485ba68e2d57887e3d22ff254718c6cbfa34c107bfb09d74e2f85c33b95f89dfa886e141a8247a0abf2b5c2</hash>\n-      </hashes>\n-      <licenses>\n-        <license>\n-          <name>Bouncy Castle Licence</name>\n-          <url>https://www.bouncycastle.org/licence.html</url>\n-        </license>\n-        <license>\n-          <id>Apache-1.1</id>\n-          <url>http://apache.org/licenses/LICENSE-1.1</url>\n-        </license>\n-      </licenses>\n-      <purl>pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar</purl>\n-      <modified>false</modified>\n-      <externalReferences>\n-        <reference type=\"issue-tracker\">\n-          <url>https://github.com/bcgit/bc-java/issues</url>\n-        </reference>\n-        <reference type=\"vcs\">\n-          <url>https://github.com/bcgit/bc-java</url>\n-        </reference>\n-      </externalReferences>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar\">\n-      <group>org.jreleaser</group>\n-      <name>jreleaser-command-java-sdk</name>\n-      <version>1.6.0</version>\n-      <hashes>\n-        <hash alg=\"MD5\">acbbfe01e59912d40bdaf2b516b8199d</hash>\n-        <hash alg=\"SHA-1\">f922261945a1a25999d8b4c95326c38f15b167e8</hash>\n-        <hash alg=\"SHA-256\">cc3bbe8d8a2cdcba73857752b9c2fbae3344c8597af7f37ac7cd0926b02d92ea</hash>\n-        <hash alg=\"SHA-512\">d40f5671c80589711087a7dc5e4148ffee88ffacbca4db3a5360c0827e2ccc0e3fe80ed95e9c4b91d8c29617dbf6171a8a849a652e9b7a472e906692cd792498</hash>\n-        <hash alg=\"SHA-384\">cc3b16425ab2505338e26c64b006157218391762d04cec9d4a9a2897ce33036a8cd6f6199b55c80e646bad434322c18c</hash>\n-        <hash alg=\"SHA3-384\">09fe1086a3bbfda7fa50c320ab4c60b056ea2b37002f281bb413a17cc4f8846be4a9bcaf4b6f507a51af74474b189bd1</hash>\n-        <hash alg=\"SHA3-256\">ef9ad8cd599799ffa70998131cfbaf2985c3070a8ff727becac8ceb5480ab900</hash>\n-        <hash alg=\"SHA3-512\">a62c41fdaca8e1849d661ffded5af92bf09e43afc3497c5f923f5d7463756116dabef382cd8649a71473e9e938e698734b09e3d81153a852ff278876cd7ba8c9</hash>\n-      </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar\">\n-      <group>com.fasterxml.jackson.core</group>\n-      <name>jackson-annotations</name>\n-      <version>2.14.2</version>\n-      <description>Core annotations used for value types, used by Jackson data binding package.</description>\n-      <hashes>\n-        <hash alg=\"MD5\">10d19982a8890f6eb37557af2f58e272</hash>\n-        <hash alg=\"SHA-1\">a7aae9525864930723e3453ab799521fdfd9d873</hash>\n-        <hash alg=\"SHA-256\">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>\n-        <hash alg=\"SHA-512\">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>\n-        <hash alg=\"SHA-384\">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>\n-        <hash alg=\"SHA3-384\">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>\n-        <hash alg=\"SHA3-256\">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>\n-        <hash alg=\"SHA3-512\">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>\n-      </hashes>\n-      <licenses>\n-        <license>\n-          <id>Apache-2.0</id>\n-        </license>\n-      </licenses>\n-      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>\n-      <modified>false</modified>\n-      <externalReferences>\n-        <reference type=\"vcs\">\n-          <url>https://github.com/FasterXML/jackson-annotations</url>\n-        </reference>\n-      </externalReferences>\n-    </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/commons-codec/commons-codec@1.15?type=jar\">\n       <group>commons-codec</group>\n       <name>commons-codec</name>\n       <version>1.15</version>\n       <description>The Apache Commons Codec package contains simple encoder and decoders for\n      various formats such as Base64 and Hexadecimal.  In addition to these\n      widely used encoders and decoders, the codec package also maintains a\n@@ -203,56 +47,14 @@\n           <url>https://issues.apache.org/jira/browse/CODEC</url>\n         </reference>\n         <reference type=\"vcs\">\n           <url>https://github.com/apache/commons-codec</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar\">\n-      <group>org.jreleaser</group>\n-      <name>jreleaser-logger-api</name>\n-      <version>1.6.0</version>\n-      <hashes>\n-        <hash alg=\"MD5\">e7da806a3427ab10405584067d880ead</hash>\n-        <hash alg=\"SHA-1\">92ae4e1826cf1d8321fcefd3f4ece0fa5cc4fc94</hash>\n-        <hash alg=\"SHA-256\">372d4b6cee7af83429f9f054a69f73d38d6fb4c983b14ce97f2599791d59aee9</hash>\n-        <hash alg=\"SHA-512\">c4f4edf49e18f475b7b44677497250cd93af45e302fb39306a94dc8f0ee1f783921967de3e1f1b7591f970a359080f43b24c1499a363280d904c2519d2e9bcb2</hash>\n-        <hash alg=\"SHA-384\">fcdadd6f2e8af30a7761e98f5c717ab1b8f6f0a79825a711454c8c9cc9842cf8fe0f5917b5ea48603eb0ee5788ed7a8b</hash>\n-        <hash alg=\"SHA3-384\">42a3e276d69efc85ce5798c5cd78ba1a910ef328169fb39a1a685eea5b98e9c3bf495124f56b518d553f1ca2e63d62f7</hash>\n-        <hash alg=\"SHA3-256\">0fb4d06e278df39d6633d1a09ed01ad4f7788838668f2ebc097f919384cec97d</hash>\n-        <hash alg=\"SHA3-512\">bb5a8b000955af1038d4d75c0fd8786561b3a2cf7bb804e09e42518a0bcc3e23ab01dd5236de4bdb58fd9b1a0e923982eb6cc6d0e450896bed9c86dfe808675d</hash>\n-      </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar\">\n-      <publisher>com.github.luben</publisher>\n-      <group>com.github.luben</group>\n-      <name>zstd-jni</name>\n-      <version>1.5.4-1</version>\n-      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>\n-      <hashes>\n-        <hash alg=\"MD5\">e787241d6ec56aac451be8b0d920c85b</hash>\n-        <hash alg=\"SHA-1\">291ccaacc039e41932de877303edb6af98a91c24</hash>\n-        <hash alg=\"SHA-256\">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>\n-        <hash alg=\"SHA-512\">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>\n-        <hash alg=\"SHA-384\">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>\n-        <hash alg=\"SHA3-384\">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>\n-        <hash alg=\"SHA3-256\">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>\n-        <hash alg=\"SHA3-512\">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>\n-      </hashes>\n-      <licenses>\n-        <license>\n-          <id>BSD-2-Clause</id>\n-        </license>\n-      </licenses>\n-      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar\">\n       <group>org.slf4j</group>\n       <name>jcl-over-slf4j</name>\n       <version>2.0.7</version>\n       <description>JCL 1.2 implemented over SLF4J</description>\n       <hashes>\n         <hash alg=\"MD5\">4e8d6cd31f7e6277280c95157ac7845a</hash>\n@@ -268,134 +70,103 @@\n         <license>\n           <id>Apache-2.0</id>\n         </license>\n       </licenses>\n       <purl>pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar</purl>\n       <modified>false</modified>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar\">\n-      <group>com.fasterxml.jackson.core</group>\n-      <name>jackson-core</name>\n-      <version>2.14.2</version>\n-      <description>Core Jackson processing abstractions (aka Streaming API), implementation for JSON</description>\n-      <hashes>\n-        <hash alg=\"MD5\">6ee422ee4c481b2d5aacb2b5e36a7dc0</hash>\n-        <hash alg=\"SHA-1\">f804090e6399ce0cf78242db086017512dd71fcc</hash>\n-        <hash alg=\"SHA-256\">b5d37a77c88277b97e3593c8740925216c06df8e4172bbde058528df04ad3e7a</hash>\n-        <hash alg=\"SHA-512\">208953cf72691b3bab1ca2f9a045cccd3d75c46c90099ba884fbf16bc3e45045e5cd014d2c68c96e8a8826f87a5f0e18cb34b35e7ef03348953869c21e197367</hash>\n-        <hash alg=\"SHA-384\">e806595862c5fcdae801d9845befc1d12c97e6036ee839d34590dbd785a422d5832cf4fc5c7ee6e1a5ee7a59f37740f0</hash>\n-        <hash alg=\"SHA3-384\">4fa59f572f2e100e2eba6fc664a3b9f804fabd911a552cb40805f39e624a9c04246b679cf4b017bb782c8272877f49d2</hash>\n-        <hash alg=\"SHA3-256\">cef17d3a539cbf798cfb0bfa9faffa2b7baff3670b50743e91ee58b4c60b59f1</hash>\n-        <hash alg=\"SHA3-512\">fceeed5cb8fe4335d88282d15657762a4728483275a7ff45f50b9fe6a999757ccb37c415d001eb6250226f98f5c576b1b36a83e601fb393cfd34a811c2df5d00</hash>\n-      </hashes>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar\">\n+      <group>org.jreleaser</group>\n+      <name>jreleaser-tool-java-sdk</name>\n+      <version>1.6.0</version>\n+      <description>Java SDK for Tools</description>\n       <licenses>\n         <license>\n           <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar</purl>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar</purl>\n       <modified>false</modified>\n       <externalReferences>\n         <reference type=\"vcs\">\n-          <url>https://github.com/FasterXML/jackson-core</url>\n+          <url>https://github.com/jreleaser/jreleaser</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar\">\n-      <group>org.slf4j</group>\n-      <name>slf4j-api</name>\n-      <version>2.0.7</version>\n-      <description>The slf4j API</description>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.httpcomponents/httpclient@4.5.13?type=jar\">\n+      <group>org.apache.httpcomponents</group>\n+      <name>httpclient</name>\n+      <version>4.5.13</version>\n+      <description>Apache HttpComponents Client</description>\n       <hashes>\n-        <hash alg=\"MD5\">403dffa46cdd2e3c82da19df4f394a4c</hash>\n-        <hash alg=\"SHA-1\">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>\n-        <hash alg=\"SHA-256\">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>\n-        <hash alg=\"SHA-512\">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>\n-        <hash alg=\"SHA-384\">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>\n-        <hash alg=\"SHA3-384\">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>\n-        <hash alg=\"SHA3-256\">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>\n-        <hash alg=\"SHA3-512\">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>\n+        <hash alg=\"MD5\">40d6b9075fbd28fa10292a45a0db9457</hash>\n+        <hash alg=\"SHA-1\">e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada</hash>\n+        <hash alg=\"SHA-256\">6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743</hash>\n+        <hash alg=\"SHA-512\">3567739186e551f84cad3e4b6b270c5b8b19aba297675a96bcdff3663ff7d20d188611d21f675fe5ff1bfd7d8ca31362070910d7b92ab1b699872a120aa6f089</hash>\n+        <hash alg=\"SHA-384\">093ac3e2dde58e34aa70309c7305eb3c9b5be2509a9293f1672494da55479a86bd112e83326746dc7a32855472952b99</hash>\n+        <hash alg=\"SHA3-384\">cd6882e7868624164e460f2f3ea01466f863c0dcb902b031c656b57356f563be83b29530df41d88d634ed3d01fc9964d</hash>\n+        <hash alg=\"SHA3-256\">710b1d8d7dae0b8e4270756694ca9c83d64965f42d3b4170c609b14d47c2762c</hash>\n+        <hash alg=\"SHA3-512\">276fa6a6599dc89382d658115695cf4da6b0d39b34e9c349c17a5dbd64122eaee553bb9ed75c0378ec4a83be157c8aa39370662de3c9b8fd55ebc1dd608383e6</hash>\n       </hashes>\n       <licenses>\n         <license>\n-          <id>MIT</id>\n-          <url>https://opensource.org/licenses/MIT</url>\n+          <id>Apache-2.0</id>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>\n+      <purl>pkg:maven/org.apache.httpcomponents/httpclient@4.5.13?type=jar</purl>\n       <modified>false</modified>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.tukaani/xz@1.9?type=jar\">\n-      <group>org.tukaani</group>\n-      <name>xz</name>\n-      <version>1.9</version>\n-      <description>XZ data compression</description>\n-      <hashes>\n-        <hash alg=\"MD5\">57c2fbfeb55e307ccae52e5322082e02</hash>\n-        <hash alg=\"SHA-1\">1ea4bec1a921180164852c65006d928617bd2caf</hash>\n-        <hash alg=\"SHA-256\">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>\n-        <hash alg=\"SHA-512\">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>\n-        <hash alg=\"SHA-384\">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>\n-        <hash alg=\"SHA3-384\">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>\n-        <hash alg=\"SHA3-256\">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>\n-        <hash alg=\"SHA3-512\">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>\n-      </hashes>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar\">\n+      <group>org.jreleaser</group>\n+      <name>jreleaser-command-java-sdk</name>\n+      <version>1.6.0</version>\n+      <description>JReleaser command SDK</description>\n       <licenses>\n         <license>\n-          <name>Public Domain</name>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar</purl>\n       <modified>false</modified>\n       <externalReferences>\n         <reference type=\"vcs\">\n-          <url>https://git.tukaani.org/?p=xz-java.git</url>\n+          <url>https://github.com/jreleaser/jreleaser</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar\">\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar\">\n       <group>org.jreleaser</group>\n-      <name>jreleaser-model-impl</name>\n+      <name>jreleaser-utils</name>\n       <version>1.6.0</version>\n+      <description>JReleaser utility classes</description>\n       <hashes>\n-        <hash alg=\"MD5\">d2760fed3ab0f395c3ec08c3f7493d52</hash>\n-        <hash alg=\"SHA-1\">37f35b86cc5bcdf8c7d306d97884c2d89fa742d5</hash>\n-        <hash alg=\"SHA-256\">284a61227c9f031b6b6928bfef76eeea45c97e6053b7a1190e3dd64c0effd8df</hash>\n-        <hash alg=\"SHA-512\">81899b65d3eb10b0dac885ee17b45822d12d5746141876ef2573b0afaec13c92187ebf8a6c446ce002f25f8bc3d40f1a88e1c8c548bd35a556efc86d9f5ed809</hash>\n-        <hash alg=\"SHA-384\">c961c3d7d900e27341988545b53d9bc8f89275e700799e41b56dc43444173e1bf962e00f96026de0fee5894594d40d6f</hash>\n-        <hash alg=\"SHA3-384\">984a6c6ab7487eeb35b3aa8d87754d4dd55bdcbcce9239bd0ec17b1ca63e1a66e4f34767476bd5b79e0998477ccc7c35</hash>\n-        <hash alg=\"SHA3-256\">a5b874d301532774b825877e6d29045492c60e20a00d55d096e0a3b371885a41</hash>\n-        <hash alg=\"SHA3-512\">83babeb5dc661f2a4f4082872615c1c70719c66ac3f2071f367a82d1b7e44390121d4e59ace75f0fdbc66f5277c306242ee491de2268d49bc5c9da4247b260e9</hash>\n-      </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar</purl>\n-      <modified>false</modified>\n-    </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/io.github.openfeign/feign-jackson@12.3?type=jar\">\n-      <group>io.github.openfeign</group>\n-      <name>feign-jackson</name>\n-      <version>12.3</version>\n-      <description>Feign Jackson</description>\n-      <hashes>\n-        <hash alg=\"MD5\">8bbba5bba4c26edb1b5c89e1a4912c22</hash>\n-        <hash alg=\"SHA-1\">583c0ce0354e6ed81d998d5b8f1786ade1e9f2c4</hash>\n-        <hash alg=\"SHA-256\">1dfc43d604693ce51ef3935f27dbfecd2d65636699a088eee32ff37cc50ea479</hash>\n-        <hash alg=\"SHA-512\">8ea71fae9a2a4ad9d06f27e21e078001e1a29761af85e81b91bf2a38e4dd8841184a12fdf467915c234d080aa28484452fe45b9bc0a381ce23d8366b03be1395</hash>\n-        <hash alg=\"SHA-384\">03553ac35a79266a150940fc62d3da7a389b47825102d91392f37b719da94af2d2355c2592d2b68604bf84248c73baf9</hash>\n-        <hash alg=\"SHA3-384\">986284d22c0bbb7abfbc1762447a44d0919c266002d6925c4ca75040f3950a3d943a71dedf2f72592e6a185218c498a9</hash>\n-        <hash alg=\"SHA3-256\">60242fd373d71575ffcb8a4f866b27d291b6acecf83be67e6ff51a13559dc016</hash>\n-        <hash alg=\"SHA3-512\">b7e0392fc793f19b3daf64c7e7b875fb2e4ec7ba2f1681d51c14c5c9efd5991817766753e62999a76bad83c624601f9f5a55304c4e06d2e3cd88ec4c609a1ede</hash>\n+        <hash alg=\"MD5\">ca784b5aa352b016a37b393e9e500325</hash>\n+        <hash alg=\"SHA-1\">b0dde5ebbe5a98e5fa90b101dca5ad56e92c49c8</hash>\n+        <hash alg=\"SHA-256\">02b038af2f098d6019b94f4f4e55b8f901d2b5b4a072b083b23e47bd6a3e23cd</hash>\n+        <hash alg=\"SHA-512\">9b5e03766473ee854f877182a758a4842a9566772405af73cd200388eeeb981712e6a3e57f4f2f14f09a912b0cad625a75c5441b57eaa238699beabf327dd56a</hash>\n+        <hash alg=\"SHA-384\">ebc800a8a0a6d19ac2bc922598f8913df5a5eb972dc46ba4eadec5034538c9c95866839670dbf92ca93b075dcb659a0c</hash>\n+        <hash alg=\"SHA3-384\">ed0ba35caf8b7d7dc67d7350617b6cbd54de336634fd5927f03768a89f74ede798ecf343964ef0484302ee262617756b</hash>\n+        <hash alg=\"SHA3-256\">b81154ce5c428820626ee1a99e7f9bbe63d4803f7f311744a26bb8331fb193cc</hash>\n+        <hash alg=\"SHA3-512\">b6429f8944cedd026f7b0c30328f8b5e2717493624cee82df48f7e69c8fe8a26b0542d447b1795c7fad7ff90affadcc087d69a576d69cbaccf3ccf1ca962be56</hash>\n       </hashes>\n       <licenses>\n         <license>\n           <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/io.github.openfeign/feign-jackson@12.3?type=jar</purl>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar</purl>\n       <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/jreleaser/jreleaser</url>\n+        </reference>\n+      </externalReferences>\n     </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/org.apache.commons/commons-compress@1.22?type=jar\">\n       <group>org.apache.commons</group>\n       <name>commons-compress</name>\n       <version>1.22</version>\n       <description>Apache Commons Compress software defines an API for working with\n compression and archive formats.  These include: bzip2, gzip, pack200,\n@@ -423,54 +194,66 @@\n           <url>https://issues.apache.org/jira/browse/COMPRESS</url>\n         </reference>\n         <reference type=\"vcs\">\n           <url>https://gitbox.apache.org/repos/asf?p=commons-compress.git</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.httpcomponents/httpclient@4.5.13?type=jar\">\n-      <group>org.apache.httpcomponents</group>\n-      <name>httpclient</name>\n-      <version>4.5.13</version>\n-      <description>Apache HttpComponents Client</description>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar\">\n+      <group>org.slf4j</group>\n+      <name>slf4j-api</name>\n+      <version>2.0.7</version>\n+      <description>The slf4j API</description>\n       <hashes>\n-        <hash alg=\"MD5\">40d6b9075fbd28fa10292a45a0db9457</hash>\n-        <hash alg=\"SHA-1\">e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada</hash>\n-        <hash alg=\"SHA-256\">6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743</hash>\n-        <hash alg=\"SHA-512\">3567739186e551f84cad3e4b6b270c5b8b19aba297675a96bcdff3663ff7d20d188611d21f675fe5ff1bfd7d8ca31362070910d7b92ab1b699872a120aa6f089</hash>\n-        <hash alg=\"SHA-384\">093ac3e2dde58e34aa70309c7305eb3c9b5be2509a9293f1672494da55479a86bd112e83326746dc7a32855472952b99</hash>\n-        <hash alg=\"SHA3-384\">cd6882e7868624164e460f2f3ea01466f863c0dcb902b031c656b57356f563be83b29530df41d88d634ed3d01fc9964d</hash>\n-        <hash alg=\"SHA3-256\">710b1d8d7dae0b8e4270756694ca9c83d64965f42d3b4170c609b14d47c2762c</hash>\n-        <hash alg=\"SHA3-512\">276fa6a6599dc89382d658115695cf4da6b0d39b34e9c349c17a5dbd64122eaee553bb9ed75c0378ec4a83be157c8aa39370662de3c9b8fd55ebc1dd608383e6</hash>\n+        <hash alg=\"MD5\">403dffa46cdd2e3c82da19df4f394a4c</hash>\n+        <hash alg=\"SHA-1\">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>\n+        <hash alg=\"SHA-256\">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>\n+        <hash alg=\"SHA-512\">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>\n+        <hash alg=\"SHA-384\">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>\n+        <hash alg=\"SHA3-384\">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>\n+        <hash alg=\"SHA3-256\">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>\n+        <hash alg=\"SHA3-512\">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>\n       </hashes>\n       <licenses>\n         <license>\n-          <id>Apache-2.0</id>\n+          <id>MIT</id>\n+          <url>https://opensource.org/licenses/MIT</url>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/org.apache.httpcomponents/httpclient@4.5.13?type=jar</purl>\n+      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>\n       <modified>false</modified>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar\">\n-      <group>org.jreleaser</group>\n-      <name>jreleaser-tool-java-sdk</name>\n-      <version>1.6.0</version>\n+    <component type=\"library\" bom-ref=\"pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar\">\n+      <group>com.github.spullara.mustache.java</group>\n+      <name>compiler</name>\n+      <version>0.9.10</version>\n+      <description>Implementation of mustache.js for Java</description>\n       <hashes>\n-        <hash alg=\"MD5\">abfd7ce4581351b44b505c26c1367955</hash>\n-        <hash alg=\"SHA-1\">ef1e1b370a0a24a202089f732598f82ce91c74f2</hash>\n-        <hash alg=\"SHA-256\">a4bcf1548d74752460e28bd3ab7e43b779b5a8f446285b8e7643dd83983f5b7f</hash>\n-        <hash alg=\"SHA-512\">e14548ab617020cac195b98b2b6bf04043cf409ef395783e8c2c38441c761f38dd34b4858d4d7e26d2c69fde233ccaa102f180d3ff547efc29e475d0c38b7b40</hash>\n-        <hash alg=\"SHA-384\">85953ec5ec2714df877d6012db03c5d88a971dcb35cfc43c197570e8e2b010c1c292e228e4fe8c7f93418e11868b8654</hash>\n-        <hash alg=\"SHA3-384\">cb294f21ab1d8a8c8f488e2f60b456e66985b55dbb5ecc56646b57fc6fbb9e36aa69801bdb6c1ea5825288baab329183</hash>\n-        <hash alg=\"SHA3-256\">cf8c1f78e8630a84e28269970a18752616d82aec3a5d9297459244fb4d52980a</hash>\n-        <hash alg=\"SHA3-512\">bd42233ee963b74dd472abde6801b8140f3ec1b08e503e486bd7c8ef7575e65a72f0bd8a3ca996adbc832d4df6be8e2b500a425b77dfdfd80e57818af84a79c2</hash>\n+        <hash alg=\"MD5\">5638fc78a17d5063cc4b0d00f6e87491</hash>\n+        <hash alg=\"SHA-1\">6111ae24e3be9ecbd75f5fe908583fc14b4f0174</hash>\n+        <hash alg=\"SHA-256\">2b5a9217811cb99846a473fa8e0d233eb33629347b7f44941f6c0fbd4cdf1038</hash>\n+        <hash alg=\"SHA-512\">2ccf3196af2b518c96df748a72a0122d033dc222e1fab3e12f3e2094146d44bec20bd1502390b59abf090cbdf5dd4d580084b07fb7241248b5b8da2605207559</hash>\n+        <hash alg=\"SHA-384\">0204e77a4a64701af5000df6601f4f4c23cb5e53dd39a1325615d4f942cd2c91d04bbac20348ae49731f586282165c33</hash>\n+        <hash alg=\"SHA3-384\">0960da7175835484471f485d481499f8b65f134ff4f1629618560adaa5a08caa897fbefcea190f93106ee9e3273381b2</hash>\n+        <hash alg=\"SHA3-256\">cfb7e640392ef590069e6b1d059dc20b8fcff984a4b267b3969fcf50ed0edd4f</hash>\n+        <hash alg=\"SHA3-512\">db3dad3809879bca835a04da890fd86dbc58ba6637c72f07d02e39d13645ebb6c640b7fecc18a779e58946072078bdf114b91445026a32dd6501b5d1c6e7d933</hash>\n       </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar</purl>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar</purl>\n       <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>http://github.com/spullara/mustache.java</url>\n+        </reference>\n+      </externalReferences>\n     </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2?type=jar\">\n       <group>com.fasterxml.jackson.core</group>\n       <name>jackson-databind</name>\n       <version>2.14.2</version>\n       <description>General data-binding functionality for Jackson: works on core streaming API</description>\n       <hashes>\n@@ -492,49 +275,126 @@\n       <modified>false</modified>\n       <externalReferences>\n         <reference type=\"vcs\">\n           <url>https://github.com/FasterXML/jackson-databind</url>\n         </reference>\n       </externalReferences>\n     </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.httpcomponents/httpcore@4.4.16?type=jar\">\n+      <group>org.apache.httpcomponents</group>\n+      <name>httpcore</name>\n+      <version>4.4.16</version>\n+      <description>Apache HttpComponents Core (blocking I/O)</description>\n+      <hashes>\n+        <hash alg=\"MD5\">28d2cd9bf8789fd2ec774fb88436ebd1</hash>\n+        <hash alg=\"SHA-1\">51cf043c87253c9f58b539c9f7e44c8894223850</hash>\n+        <hash alg=\"SHA-256\">6c9b3dd142a09dc468e23ad39aad6f75a0f2b85125104469f026e52a474e464f</hash>\n+        <hash alg=\"SHA-512\">168026436a6bcf5e96c0c59606638abbdc30de4b405ae55afde70fdf2895e267a3d48bba6bdadc5a89f38e31da3d9a9dc91e1cab7ea76f5e04322cf1ec63b838</hash>\n+        <hash alg=\"SHA-384\">ba9ceaee1a37ca3201d6a1315ecb0327b495489efd0baa155c219c475df8d3eb69fe77ab0026563db406497626da6562</hash>\n+        <hash alg=\"SHA3-384\">b9dc44dcc7cc86d5036f26d54c4003a2d72808ae7b07a0808bb53505c6d4281b5ad213eb1f3d0fef1113dec57cb0dfe1</hash>\n+        <hash alg=\"SHA3-256\">fd8ab51846476c6c18822151c9ec07b39a9633010b5d20ea937fc6910407bc64</hash>\n+        <hash alg=\"SHA3-512\">b42fa528242981a9d70e4f68ab75a24292df5112c44c21b6f18cb9201ce747885ba1d4dc69bc3d14d0da46a6c2638f937c11bc45749abeb55dc89ddada90cdda</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.apache.httpcomponents/httpcore@4.4.16?type=jar</purl>\n+      <modified>false</modified>\n+    </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar\">\n       <group>org.jreleaser</group>\n       <name>jreleaser-resource-bundle</name>\n       <version>1.6.0</version>\n+      <description>JReleaser resource bundle</description>\n       <hashes>\n         <hash alg=\"MD5\">8419930ec5e42489dad5e26749a994eb</hash>\n         <hash alg=\"SHA-1\">050aba092fa794e0cb91158de894a97aff581356</hash>\n         <hash alg=\"SHA-256\">38434b31fac439399aa37018fa69302a9d1b04be6efb7b23d53d18615e1f4f2b</hash>\n         <hash alg=\"SHA-512\">c77c476e972e17b25de3aecf75d71482535d68cdc5e4bf556f5d4cab17345b9318d47fa42c9da671769f9bcf7f549efde70b64eff5cb189c805bb406fd705cb8</hash>\n         <hash alg=\"SHA-384\">b1d8f56681f39c638806e669447d9600507946448b528060d98afc2123c637980ba5609aba4b357c83acd772bfbdb73e</hash>\n         <hash alg=\"SHA3-384\">74a52a9891c520a0f90ffbab33da0219cd787bbe309ae8eca303de00c6041692554e8d650a6a3925e057322bd00700ff</hash>\n         <hash alg=\"SHA3-256\">304bae90a7c53e6ad711e54bb8847c3eedc0e18cac03bffa14729918cb59efce</hash>\n         <hash alg=\"SHA3-512\">16a31cb40ed20dcaa5d34cb6aa2b81325f285b7feb5dda2486206496449fd548ef51117b38a8074a4a106fba9836de72232762dff60f535cd76f5848860c2f6c</hash>\n       </hashes>\n-      <licenses/>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n       <purl>pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar</purl>\n       <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/jreleaser/jreleaser</url>\n+        </reference>\n+      </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar\">\n-      <group>org.jreleaser</group>\n-      <name>jreleaser-utils</name>\n-      <version>1.6.0</version>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.tukaani/xz@1.9?type=jar\">\n+      <group>org.tukaani</group>\n+      <name>xz</name>\n+      <version>1.9</version>\n+      <description>XZ data compression</description>\n       <hashes>\n-        <hash alg=\"MD5\">ca784b5aa352b016a37b393e9e500325</hash>\n-        <hash alg=\"SHA-1\">b0dde5ebbe5a98e5fa90b101dca5ad56e92c49c8</hash>\n-        <hash alg=\"SHA-256\">02b038af2f098d6019b94f4f4e55b8f901d2b5b4a072b083b23e47bd6a3e23cd</hash>\n-        <hash alg=\"SHA-512\">9b5e03766473ee854f877182a758a4842a9566772405af73cd200388eeeb981712e6a3e57f4f2f14f09a912b0cad625a75c5441b57eaa238699beabf327dd56a</hash>\n-        <hash alg=\"SHA-384\">ebc800a8a0a6d19ac2bc922598f8913df5a5eb972dc46ba4eadec5034538c9c95866839670dbf92ca93b075dcb659a0c</hash>\n-        <hash alg=\"SHA3-384\">ed0ba35caf8b7d7dc67d7350617b6cbd54de336634fd5927f03768a89f74ede798ecf343964ef0484302ee262617756b</hash>\n-        <hash alg=\"SHA3-256\">b81154ce5c428820626ee1a99e7f9bbe63d4803f7f311744a26bb8331fb193cc</hash>\n-        <hash alg=\"SHA3-512\">b6429f8944cedd026f7b0c30328f8b5e2717493624cee82df48f7e69c8fe8a26b0542d447b1795c7fad7ff90affadcc087d69a576d69cbaccf3ccf1ca962be56</hash>\n+        <hash alg=\"MD5\">57c2fbfeb55e307ccae52e5322082e02</hash>\n+        <hash alg=\"SHA-1\">1ea4bec1a921180164852c65006d928617bd2caf</hash>\n+        <hash alg=\"SHA-256\">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>\n+        <hash alg=\"SHA-512\">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>\n+        <hash alg=\"SHA-384\">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>\n+        <hash alg=\"SHA3-384\">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>\n+        <hash alg=\"SHA3-256\">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>\n+        <hash alg=\"SHA3-512\">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>\n       </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar</purl>\n+      <licenses>\n+        <license>\n+          <name>Public Domain</name>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://git.tukaani.org/?p=xz-java.git</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar\">\n+      <group>org.apache.commons</group>\n+      <name>commons-jexl3</name>\n+      <version>3.3</version>\n+      <description>JEXL is a library intended to facilitate the implementation of scripting features in\n+        applications and frameworks written in Java.</description>\n+      <hashes>\n+        <hash alg=\"MD5\">3a332e3beb67b3a2a20bd0a950fc57c4</hash>\n+        <hash alg=\"SHA-1\">c76b4cfa436c3e79e04806e62656b09968c388ba</hash>\n+        <hash alg=\"SHA-256\">07b0ff6c5a10ffb2e2c02da9e2c0e2e6702df44178cfb76881f69447fc386014</hash>\n+        <hash alg=\"SHA-512\">879111d1c3ad021ea3961e49161b3ff6ba251044ffef1ca4d36d880d9a09b1f395e17eef221a13274303f44e116204ae4b2a3ee3e931f117fc901e321d59b5c6</hash>\n+        <hash alg=\"SHA-384\">7a268bf2c903be86813fcc7f06158abf79d558ee59ebf03470ebd06ca6e6d169beb1c3600e07c20c4f95fa7827fde841</hash>\n+        <hash alg=\"SHA3-384\">1803d239f17f7eeee6edb69d38c4473319fd4eeeb684eda5c38b577a7aaf42965ce41d9082d515d5007be9a0b0712d81</hash>\n+        <hash alg=\"SHA3-256\">01163da5e720b6d1f6bf8b6e9e398d26a1be92b3f18ef6089d218d54166b0c01</hash>\n+        <hash alg=\"SHA3-512\">8abdd72c14492340c05fd5d3555682a308ac00ac1b1e1e15ae38abc47f454f50db9e0727a49df72a50bf49f1447a6ca9dadc48b9ffd45a043bcbae9e5e050d3d</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar</purl>\n       <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"issue-tracker\">\n+          <url>https://issues.apache.org/jira/browse/JEXL</url>\n+        </reference>\n+        <reference type=\"vcs\">\n+          <url>https://gitbox.apache.org/repos/asf/commons-jexl.git</url>\n+        </reference>\n+      </externalReferences>\n     </component>\n     <component type=\"library\" bom-ref=\"pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar\">\n       <group>org.bouncycastle</group>\n       <name>bcprov-jdk15on</name>\n       <version>1.70</version>\n       <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.</description>\n       <hashes>\n@@ -560,84 +420,262 @@\n           <url>https://github.com/bcgit/bc-java/issues</url>\n         </reference>\n         <reference type=\"vcs\">\n           <url>https://github.com/bcgit/bc-java</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar\">\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar\">\n       <group>org.jreleaser</group>\n-      <name>jreleaser-signing-java-sdk</name>\n+      <name>jreleaser-model-impl</name>\n       <version>1.6.0</version>\n+      <description>JReleaser Model implementation</description>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/jreleaser/jreleaser</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar\">\n+      <publisher>com.github.luben</publisher>\n+      <group>com.github.luben</group>\n+      <name>zstd-jni</name>\n+      <version>1.5.4-1</version>\n+      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>\n       <hashes>\n-        <hash alg=\"MD5\">2608fa713b1fa2a515ec2c83ec96a49c</hash>\n-        <hash alg=\"SHA-1\">f0de8990fee988060fe7721d389d6ba8aad481a4</hash>\n-        <hash alg=\"SHA-256\">ea0e35358f453eee98d0a4e921bfa6114c04afe52adb0c74bcc5200092971454</hash>\n-        <hash alg=\"SHA-512\">4d0146d43526b329139bb38edbe63f6f783ae99f5d2778c6c6af8851be458739afe31951bf8e54f85da7c6e5d5e7d4670b45917c6ffa855f578355a6359286a6</hash>\n-        <hash alg=\"SHA-384\">a29024fbd6fb57818b5800cb961a043d4d131e4c16d0b6965a4abd4ef275001bd607697195f562e6b3d4f36fac5847b0</hash>\n-        <hash alg=\"SHA3-384\">5b9e053c6b9a48483a7cdd898f37fc72275171348ed4433b9759e0a4f86edad6a26c84ed69eae8612811e17b806df60a</hash>\n-        <hash alg=\"SHA3-256\">477c36bff3a1ec95810622a43d43ea9b1c614c54306897d9c4ee66f2a349a9e9</hash>\n-        <hash alg=\"SHA3-512\">b6594d20048651c4982230202c5af186f064025bf80d21c87d4cacb3d1b466bc1e5c850fea374edf9c3c98fda734ea52284bd62bbd456aee903c705152d767da</hash>\n+        <hash alg=\"MD5\">e787241d6ec56aac451be8b0d920c85b</hash>\n+        <hash alg=\"SHA-1\">291ccaacc039e41932de877303edb6af98a91c24</hash>\n+        <hash alg=\"SHA-256\">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>\n+        <hash alg=\"SHA-512\">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>\n+        <hash alg=\"SHA-384\">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>\n+        <hash alg=\"SHA3-384\">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>\n+        <hash alg=\"SHA3-256\">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>\n+        <hash alg=\"SHA3-512\">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>\n       </hashes>\n-      <licenses/>\n-      <purl>pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar</purl>\n+      <licenses>\n+        <license>\n+          <id>BSD-2-Clause</id>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>\n       <modified>false</modified>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar\">\n-      <group>com.github.spullara.mustache.java</group>\n-      <name>compiler</name>\n-      <version>0.9.10</version>\n-      <description>Implementation of mustache.js for Java</description>\n+    <component type=\"library\" bom-ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar\">\n+      <group>com.fasterxml.jackson.core</group>\n+      <name>jackson-annotations</name>\n+      <version>2.14.2</version>\n+      <description>Core annotations used for value types, used by Jackson data binding package.</description>\n       <hashes>\n-        <hash alg=\"MD5\">5638fc78a17d5063cc4b0d00f6e87491</hash>\n-        <hash alg=\"SHA-1\">6111ae24e3be9ecbd75f5fe908583fc14b4f0174</hash>\n-        <hash alg=\"SHA-256\">2b5a9217811cb99846a473fa8e0d233eb33629347b7f44941f6c0fbd4cdf1038</hash>\n-        <hash alg=\"SHA-512\">2ccf3196af2b518c96df748a72a0122d033dc222e1fab3e12f3e2094146d44bec20bd1502390b59abf090cbdf5dd4d580084b07fb7241248b5b8da2605207559</hash>\n-        <hash alg=\"SHA-384\">0204e77a4a64701af5000df6601f4f4c23cb5e53dd39a1325615d4f942cd2c91d04bbac20348ae49731f586282165c33</hash>\n-        <hash alg=\"SHA3-384\">0960da7175835484471f485d481499f8b65f134ff4f1629618560adaa5a08caa897fbefcea190f93106ee9e3273381b2</hash>\n-        <hash alg=\"SHA3-256\">cfb7e640392ef590069e6b1d059dc20b8fcff984a4b267b3969fcf50ed0edd4f</hash>\n-        <hash alg=\"SHA3-512\">db3dad3809879bca835a04da890fd86dbc58ba6637c72f07d02e39d13645ebb6c640b7fecc18a779e58946072078bdf114b91445026a32dd6501b5d1c6e7d933</hash>\n+        <hash alg=\"MD5\">10d19982a8890f6eb37557af2f58e272</hash>\n+        <hash alg=\"SHA-1\">a7aae9525864930723e3453ab799521fdfd9d873</hash>\n+        <hash alg=\"SHA-256\">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>\n+        <hash alg=\"SHA-512\">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>\n+        <hash alg=\"SHA-384\">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>\n+        <hash alg=\"SHA3-384\">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>\n+        <hash alg=\"SHA3-256\">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>\n+        <hash alg=\"SHA3-512\">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/FasterXML/jackson-annotations</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar\">\n+      <group>org.jreleaser</group>\n+      <name>jreleaser-logger-api</name>\n+      <version>1.6.0</version>\n+      <description>JReleaser logger API</description>\n+      <hashes>\n+        <hash alg=\"MD5\">e7da806a3427ab10405584067d880ead</hash>\n+        <hash alg=\"SHA-1\">92ae4e1826cf1d8321fcefd3f4ece0fa5cc4fc94</hash>\n+        <hash alg=\"SHA-256\">372d4b6cee7af83429f9f054a69f73d38d6fb4c983b14ce97f2599791d59aee9</hash>\n+        <hash alg=\"SHA-512\">c4f4edf49e18f475b7b44677497250cd93af45e302fb39306a94dc8f0ee1f783921967de3e1f1b7591f970a359080f43b24c1499a363280d904c2519d2e9bcb2</hash>\n+        <hash alg=\"SHA-384\">fcdadd6f2e8af30a7761e98f5c717ab1b8f6f0a79825a711454c8c9cc9842cf8fe0f5917b5ea48603eb0ee5788ed7a8b</hash>\n+        <hash alg=\"SHA3-384\">42a3e276d69efc85ce5798c5cd78ba1a910ef328169fb39a1a685eea5b98e9c3bf495124f56b518d553f1ca2e63d62f7</hash>\n+        <hash alg=\"SHA3-256\">0fb4d06e278df39d6633d1a09ed01ad4f7788838668f2ebc097f919384cec97d</hash>\n+        <hash alg=\"SHA3-512\">bb5a8b000955af1038d4d75c0fd8786561b3a2cf7bb804e09e42518a0bcc3e23ab01dd5236de4bdb58fd9b1a0e923982eb6cc6d0e450896bed9c86dfe808675d</hash>\n       </hashes>\n       <licenses>\n         <license>\n           <id>Apache-2.0</id>\n           <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar</purl>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>\n       <modified>false</modified>\n       <externalReferences>\n         <reference type=\"vcs\">\n-          <url>http://github.com/spullara/mustache.java</url>\n+          <url>https://github.com/jreleaser/jreleaser</url>\n         </reference>\n       </externalReferences>\n     </component>\n-    <component type=\"library\" bom-ref=\"pkg:maven/org.apache.httpcomponents/httpcore@4.4.16?type=jar\">\n-      <group>org.apache.httpcomponents</group>\n-      <name>httpcore</name>\n-      <version>4.4.16</version>\n-      <description>Apache HttpComponents Core (blocking I/O)</description>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar\">\n+      <group>org.bouncycastle</group>\n+      <name>bcpg-jdk15on</name>\n+      <version>1.70</version>\n+      <description>The Bouncy Castle Java API for handling the OpenPGP protocol. This jar contains the OpenPGP API for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.</description>\n       <hashes>\n-        <hash alg=\"MD5\">28d2cd9bf8789fd2ec774fb88436ebd1</hash>\n-        <hash alg=\"SHA-1\">51cf043c87253c9f58b539c9f7e44c8894223850</hash>\n-        <hash alg=\"SHA-256\">6c9b3dd142a09dc468e23ad39aad6f75a0f2b85125104469f026e52a474e464f</hash>\n-        <hash alg=\"SHA-512\">168026436a6bcf5e96c0c59606638abbdc30de4b405ae55afde70fdf2895e267a3d48bba6bdadc5a89f38e31da3d9a9dc91e1cab7ea76f5e04322cf1ec63b838</hash>\n-        <hash alg=\"SHA-384\">ba9ceaee1a37ca3201d6a1315ecb0327b495489efd0baa155c219c475df8d3eb69fe77ab0026563db406497626da6562</hash>\n-        <hash alg=\"SHA3-384\">b9dc44dcc7cc86d5036f26d54c4003a2d72808ae7b07a0808bb53505c6d4281b5ad213eb1f3d0fef1113dec57cb0dfe1</hash>\n-        <hash alg=\"SHA3-256\">fd8ab51846476c6c18822151c9ec07b39a9633010b5d20ea937fc6910407bc64</hash>\n-        <hash alg=\"SHA3-512\">b42fa528242981a9d70e4f68ab75a24292df5112c44c21b6f18cb9201ce747885ba1d4dc69bc3d14d0da46a6c2638f937c11bc45749abeb55dc89ddada90cdda</hash>\n+        <hash alg=\"MD5\">01ddc3aa0289346f4db19d95039cefdb</hash>\n+        <hash alg=\"SHA-1\">062f72ec06f31a6c31a3f3355fce0384b21126d7</hash>\n+        <hash alg=\"SHA-256\">4f08f4aa74048824151c98dd3e92e7165ac30659834404f08a8e843bdad32847</hash>\n+        <hash alg=\"SHA-512\">4e240b7811ef90c090e83a181dace41da487555e4136221861b0060f9af6d8b316f2dd0472f747adb98ca5372f46055456ef04bdc0c3992188ab13302922fce9</hash>\n+        <hash alg=\"SHA-384\">d89dec6226112d13cbea461d84740699770dd7d8ad3f67ab65e7b49fd08a096a948e54da2e6a681925c4320f410bba37</hash>\n+        <hash alg=\"SHA3-384\">5e8e8ca63cc550a8f50b627c4dd051f0eb5c31b99ff53dabd7d5f5d1ed98d0dc1d4963a09fc0db32f8e0ff769a2a6e65</hash>\n+        <hash alg=\"SHA3-256\">77f28e7e22b3b3a8d7b667fb7f783847c4b11ee7208833636e09e8b38390fd51</hash>\n+        <hash alg=\"SHA3-512\">cb238dbb641c42c49b5801bdfa6432395e860c1a7485ba68e2d57887e3d22ff254718c6cbfa34c107bfb09d74e2f85c33b95f89dfa886e141a8247a0abf2b5c2</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <name>Bouncy Castle Licence</name>\n+          <url>https://www.bouncycastle.org/licence.html</url>\n+        </license>\n+        <license>\n+          <id>Apache-1.1</id>\n+          <url>http://apache.org/licenses/LICENSE-1.1</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"issue-tracker\">\n+          <url>https://github.com/bcgit/bc-java/issues</url>\n+        </reference>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/bcgit/bc-java</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/io.github.openfeign/feign-jackson@12.3?type=jar\">\n+      <group>io.github.openfeign</group>\n+      <name>feign-jackson</name>\n+      <version>12.3</version>\n+      <description>Feign Jackson</description>\n+      <hashes>\n+        <hash alg=\"MD5\">8bbba5bba4c26edb1b5c89e1a4912c22</hash>\n+        <hash alg=\"SHA-1\">583c0ce0354e6ed81d998d5b8f1786ade1e9f2c4</hash>\n+        <hash alg=\"SHA-256\">1dfc43d604693ce51ef3935f27dbfecd2d65636699a088eee32ff37cc50ea479</hash>\n+        <hash alg=\"SHA-512\">8ea71fae9a2a4ad9d06f27e21e078001e1a29761af85e81b91bf2a38e4dd8841184a12fdf467915c234d080aa28484452fe45b9bc0a381ce23d8366b03be1395</hash>\n+        <hash alg=\"SHA-384\">03553ac35a79266a150940fc62d3da7a389b47825102d91392f37b719da94af2d2355c2592d2b68604bf84248c73baf9</hash>\n+        <hash alg=\"SHA3-384\">986284d22c0bbb7abfbc1762447a44d0919c266002d6925c4ca75040f3950a3d943a71dedf2f72592e6a185218c498a9</hash>\n+        <hash alg=\"SHA3-256\">60242fd373d71575ffcb8a4f866b27d291b6acecf83be67e6ff51a13559dc016</hash>\n+        <hash alg=\"SHA3-512\">b7e0392fc793f19b3daf64c7e7b875fb2e4ec7ba2f1681d51c14c5c9efd5991817766753e62999a76bad83c624601f9f5a55304c4e06d2e3cd88ec4c609a1ede</hash>\n       </hashes>\n       <licenses>\n         <license>\n           <id>Apache-2.0</id>\n         </license>\n       </licenses>\n-      <purl>pkg:maven/org.apache.httpcomponents/httpcore@4.4.16?type=jar</purl>\n+      <purl>pkg:maven/io.github.openfeign/feign-jackson@12.3?type=jar</purl>\n+      <modified>false</modified>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar\">\n+      <group>org.jreleaser</group>\n+      <name>jreleaser-model-api</name>\n+      <version>1.6.0</version>\n+      <description>JReleaser Model API</description>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/jreleaser/jreleaser</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/io.github.openfeign/feign-core@12.3?type=jar\">\n+      <group>io.github.openfeign</group>\n+      <name>feign-core</name>\n+      <version>12.3</version>\n+      <description>Feign Core</description>\n+      <hashes>\n+        <hash alg=\"MD5\">9e6e1ff8b68d2b6c1fc5bdc7ff208030</hash>\n+        <hash alg=\"SHA-1\">d280b09a17b63e69788fd3d8d215b7013ab48b16</hash>\n+        <hash alg=\"SHA-256\">939fbed2c2392a9633bc1d26f0ef9e934b059d1a9a9d4d966cedaf9075c546ec</hash>\n+        <hash alg=\"SHA-512\">8335901d8918747dc29d37a2ac630c6a78ea6ff04bfea77e6d8c74188e9e584142920996c45120caa86299486949a04e1ec1f1bef30229904360fcb5c5d4a1c4</hash>\n+        <hash alg=\"SHA-384\">dc7a0d10bdf2c3aeafba83ca7e41d21c3288f3df0b76e339788fcf7606381970b6429108dbf2d1212075d1feba040842</hash>\n+        <hash alg=\"SHA3-384\">2907938ea76735cde9b34676c6c8b04786f1595687f96734e7659768175cb7a525508f84c48d9b10b0b2f593158e1ed5</hash>\n+        <hash alg=\"SHA3-256\">474f6b0ab420bf63549ed123fff99b73fc881771c6a0c591e58dfb17adbe9899</hash>\n+        <hash alg=\"SHA3-512\">553a6dc1c3cf7facdb3b4e15be1d6d90259f1d36ce137db3a6e53a967ef4939aaa98c974b059c8f32dd42316bb7eee3b51910cf0fb172d0df9b8ff39d8cc722d</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/io.github.openfeign/feign-core@12.3?type=jar</purl>\n       <modified>false</modified>\n     </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar\">\n+      <group>org.jreleaser</group>\n+      <name>jreleaser-signing-java-sdk</name>\n+      <version>1.6.0</version>\n+      <description>JReleaser signing Java SDK</description>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/jreleaser/jreleaser</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n+    <component type=\"library\" bom-ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar\">\n+      <group>com.fasterxml.jackson.core</group>\n+      <name>jackson-core</name>\n+      <version>2.14.2</version>\n+      <description>Core Jackson processing abstractions (aka Streaming API), implementation for JSON</description>\n+      <hashes>\n+        <hash alg=\"MD5\">6ee422ee4c481b2d5aacb2b5e36a7dc0</hash>\n+        <hash alg=\"SHA-1\">f804090e6399ce0cf78242db086017512dd71fcc</hash>\n+        <hash alg=\"SHA-256\">b5d37a77c88277b97e3593c8740925216c06df8e4172bbde058528df04ad3e7a</hash>\n+        <hash alg=\"SHA-512\">208953cf72691b3bab1ca2f9a045cccd3d75c46c90099ba884fbf16bc3e45045e5cd014d2c68c96e8a8826f87a5f0e18cb34b35e7ef03348953869c21e197367</hash>\n+        <hash alg=\"SHA-384\">e806595862c5fcdae801d9845befc1d12c97e6036ee839d34590dbd785a422d5832cf4fc5c7ee6e1a5ee7a59f37740f0</hash>\n+        <hash alg=\"SHA3-384\">4fa59f572f2e100e2eba6fc664a3b9f804fabd911a552cb40805f39e624a9c04246b679cf4b017bb782c8272877f49d2</hash>\n+        <hash alg=\"SHA3-256\">cef17d3a539cbf798cfb0bfa9faffa2b7baff3670b50743e91ee58b4c60b59f1</hash>\n+        <hash alg=\"SHA3-512\">fceeed5cb8fe4335d88282d15657762a4728483275a7ff45f50b9fe6a999757ccb37c415d001eb6250226f98f5c576b1b36a83e601fb393cfd34a811c2df5d00</hash>\n+      </hashes>\n+      <licenses>\n+        <license>\n+          <id>Apache-2.0</id>\n+        </license>\n+      </licenses>\n+      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar</purl>\n+      <modified>false</modified>\n+      <externalReferences>\n+        <reference type=\"vcs\">\n+          <url>https://github.com/FasterXML/jackson-core</url>\n+        </reference>\n+      </externalReferences>\n+    </component>\n   </components>\n   <dependencies>\n     <dependency ref=\"pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar\">\n       <dependency ref=\"pkg:maven/commons-codec/commons-codec@1.15?type=jar\"/>\n       <dependency ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2?type=jar\"/>\n       <dependency ref=\"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar\"/>\n       <dependency ref=\"pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar\"/>\n"}]}