--- results/org.jreleaser/jreleaser/1.6.0/oss-rebuild-improved-2/reference/jreleaser-config-yaml-1.6.0-cyclonedx.xml:jreleaser-config-yaml-1.6.0-cyclonedx.xml	2025-07-28 23:33:21.990691952 +0200
+++ results/org.jreleaser/jreleaser/1.6.0/oss-rebuild-improved-2/rebuild/jreleaser-config-yaml-1.6.0-cyclonedx.xml:jreleaser-config-yaml-1.6.0-cyclonedx.xml	2025-07-28 23:33:23.321687260 +0200
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom serialNumber="urn:uuid:8252d6b7-f00e-4349-8671-6a76246a855b" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
+<bom serialNumber="urn:uuid:0186c181-1b2e-4441-aced-7fdac50cb365" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
   <metadata>
-    <timestamp>2023-04-29T10:07:05Z</timestamp>
+    <timestamp>2025-07-11T06:29:32Z</timestamp>
     <tools>
       <tool>
         <vendor>CycloneDX</vendor>
@@ -17,120 +17,29 @@
     </component>
   </metadata>
   <components>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-model-api</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">288354c621fdfef298e4e8cdc843e2c3</hash>
-        <hash alg="SHA-1">54bcb05008c6f0b50433f8d0fe82e3a217317db1</hash>
-        <hash alg="SHA-256">397e18c4fa02ba508e409a119866d4e78d64c6c76f5a4f22b3aefc027b662b9b</hash>
-        <hash alg="SHA-512">67c4e2f9acb6db78c21cfd23d3411ce1e32b23690a1d5035a285b48cd9b996fd4c80b504d050e87a4a5604e6b56ca52878a464593f0bd8eea53059bcb263289f</hash>
-        <hash alg="SHA-384">8f67be44af6f792c32f2b86d07738c52e5b742a650d010e8c0b5e60a62db627d5c695f23f24d814f232fc0246d03086c</hash>
-        <hash alg="SHA3-384">1e5c3dffd4e3c545081904db6dcff892bd2f27285b4fa46a57cdd23c3fbb382ab06268e87d57212996387269b2c8b72f</hash>
-        <hash alg="SHA3-256">d2b875e45846a0d17cf7f85d6289681ee42897519cdaca9625ffc56b1639909d</hash>
-        <hash alg="SHA3-512">1a098f05c0735a7ed19cf374440818e9882b0288728f6658ce3709ac534c06cc7dc36ea4d7656a35281758d1ec09c31edf13a98d6680206a0c9fb1dff21ad04f</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar">
-      <group>org.apache.commons</group>
-      <name>commons-jexl3</name>
-      <version>3.3</version>
-      <description>JEXL is a library intended to facilitate the implementation of scripting features in
-        applications and frameworks written in Java.</description>
-      <hashes>
-        <hash alg="MD5">3a332e3beb67b3a2a20bd0a950fc57c4</hash>
-        <hash alg="SHA-1">c76b4cfa436c3e79e04806e62656b09968c388ba</hash>
-        <hash alg="SHA-256">07b0ff6c5a10ffb2e2c02da9e2c0e2e6702df44178cfb76881f69447fc386014</hash>
-        <hash alg="SHA-512">879111d1c3ad021ea3961e49161b3ff6ba251044ffef1ca4d36d880d9a09b1f395e17eef221a13274303f44e116204ae4b2a3ee3e931f117fc901e321d59b5c6</hash>
-        <hash alg="SHA-384">7a268bf2c903be86813fcc7f06158abf79d558ee59ebf03470ebd06ca6e6d169beb1c3600e07c20c4f95fa7827fde841</hash>
-        <hash alg="SHA3-384">1803d239f17f7eeee6edb69d38c4473319fd4eeeb684eda5c38b577a7aaf42965ce41d9082d515d5007be9a0b0712d81</hash>
-        <hash alg="SHA3-256">01163da5e720b6d1f6bf8b6e9e398d26a1be92b3f18ef6089d218d54166b0c01</hash>
-        <hash alg="SHA3-512">8abdd72c14492340c05fd5d3555682a308ac00ac1b1e1e15ae38abc47f454f50db9e0727a49df72a50bf49f1447a6ca9dadc48b9ffd45a043bcbae9e5e050d3d</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>Apache-2.0</id>
-          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
-        </license>
-      </licenses>
-      <purl>pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/JEXL</url></reference><reference type="vcs"><url>https://gitbox.apache.org/repos/asf/commons-jexl.git</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar">
-      <group>org.bouncycastle</group>
-      <name>bcpg-jdk15on</name>
-      <version>1.70</version>
-      <description>The Bouncy Castle Java API for handling the OpenPGP protocol. This jar contains the OpenPGP API for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.</description>
-      <hashes>
-        <hash alg="MD5">01ddc3aa0289346f4db19d95039cefdb</hash>
-        <hash alg="SHA-1">062f72ec06f31a6c31a3f3355fce0384b21126d7</hash>
-        <hash alg="SHA-256">4f08f4aa74048824151c98dd3e92e7165ac30659834404f08a8e843bdad32847</hash>
-        <hash alg="SHA-512">4e240b7811ef90c090e83a181dace41da487555e4136221861b0060f9af6d8b316f2dd0472f747adb98ca5372f46055456ef04bdc0c3992188ab13302922fce9</hash>
-        <hash alg="SHA-384">d89dec6226112d13cbea461d84740699770dd7d8ad3f67ab65e7b49fd08a096a948e54da2e6a681925c4320f410bba37</hash>
-        <hash alg="SHA3-384">5e8e8ca63cc550a8f50b627c4dd051f0eb5c31b99ff53dabd7d5f5d1ed98d0dc1d4963a09fc0db32f8e0ff769a2a6e65</hash>
-        <hash alg="SHA3-256">77f28e7e22b3b3a8d7b667fb7f783847c4b11ee7208833636e09e8b38390fd51</hash>
-        <hash alg="SHA3-512">cb238dbb641c42c49b5801bdfa6432395e860c1a7485ba68e2d57887e3d22ff254718c6cbfa34c107bfb09d74e2f85c33b95f89dfa886e141a8247a0abf2b5c2</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <name>Bouncy Castle Licence</name>
-          <url>https://www.bouncycastle.org/licence.html</url>
-        </license>
-        <license>
-          <id>Apache-1.1</id>
-          <url>http://apache.org/licenses/LICENSE-1.1</url>
-        </license>
-      </licenses>
-      <purl>pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="issue-tracker"><url>https://github.com/bcgit/bc-java/issues</url></reference><reference type="vcs"><url>https://github.com/bcgit/bc-java</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-command-java-sdk</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">acbbfe01e59912d40bdaf2b516b8199d</hash>
-        <hash alg="SHA-1">f922261945a1a25999d8b4c95326c38f15b167e8</hash>
-        <hash alg="SHA-256">cc3bbe8d8a2cdcba73857752b9c2fbae3344c8597af7f37ac7cd0926b02d92ea</hash>
-        <hash alg="SHA-512">d40f5671c80589711087a7dc5e4148ffee88ffacbca4db3a5360c0827e2ccc0e3fe80ed95e9c4b91d8c29617dbf6171a8a849a652e9b7a472e906692cd792498</hash>
-        <hash alg="SHA-384">cc3b16425ab2505338e26c64b006157218391762d04cec9d4a9a2897ce33036a8cd6f6199b55c80e646bad434322c18c</hash>
-        <hash alg="SHA3-384">09fe1086a3bbfda7fa50c320ab4c60b056ea2b37002f281bb413a17cc4f8846be4a9bcaf4b6f507a51af74474b189bd1</hash>
-        <hash alg="SHA3-256">ef9ad8cd599799ffa70998131cfbaf2985c3070a8ff727becac8ceb5480ab900</hash>
-        <hash alg="SHA3-512">a62c41fdaca8e1849d661ffded5af92bf09e43afc3497c5f923f5d7463756116dabef382cd8649a71473e9e938e698734b09e3d81153a852ff278876cd7ba8c9</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar">
-      <group>com.fasterxml.jackson.core</group>
-      <name>jackson-annotations</name>
-      <version>2.14.2</version>
-      <description>Core annotations used for value types, used by Jackson data binding package.</description>
+    <component type="library" bom-ref="pkg:maven/org.yaml/snakeyaml@1.33?type=jar">
+      <group>org.yaml</group>
+      <name>snakeyaml</name>
+      <version>1.33</version>
+      <description>YAML 1.1 parser and emitter for Java</description>
       <hashes>
-        <hash alg="MD5">10d19982a8890f6eb37557af2f58e272</hash>
-        <hash alg="SHA-1">a7aae9525864930723e3453ab799521fdfd9d873</hash>
-        <hash alg="SHA-256">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>
-        <hash alg="SHA-512">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>
-        <hash alg="SHA-384">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>
-        <hash alg="SHA3-384">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>
-        <hash alg="SHA3-256">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>
-        <hash alg="SHA3-512">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>
+        <hash alg="MD5">e0164a637c691c8cf01d29f90a709c02</hash>
+        <hash alg="SHA-1">2cd0a87ff7df953f810c344bdf2fe3340b954c69</hash>
+        <hash alg="SHA-256">11ff459788f0a2d781f56a4a86d7e69202cebacd0273d5269c4ae9f02f3fd8f0</hash>
+        <hash alg="SHA-512">787b72aebb685689ab379ed8f238fc2f4175bb82d285909e39e7ff1ee1b9e64ad8878f4685dadde274f950b0dc77dca3082a52921c11094aa2a535672ae4f33c</hash>
+        <hash alg="SHA-384">9f0a0a35df2b339830b9e78294634ea894e7096e01709c82d965e24a9fa9ac6ee15edbbbf23368dcd57741de5bf23086</hash>
+        <hash alg="SHA3-384">91d8fd581d60be4090d3b522d8c119c12449cff2ce6c436d0e53977e1c9fea8686b2b360fb15f4c3507e4f243d7d6170</hash>
+        <hash alg="SHA3-256">7dcf0429ecb923a66e00ec633bafeb297e3b90e1cc2be0f85443fd61367f355a</hash>
+        <hash alg="SHA3-512">59b32910dddf63475893f7c830d58ca320cd6183704d80b8111cee7bb1674f97f5699c8ac52f905a5b9a20128b9e2b6a26a07490f217033c858d9c358bedcafc</hash>
       </hashes>
       <licenses>
         <license>
           <id>Apache-2.0</id>
         </license>
       </licenses>
-      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>
+      <purl>pkg:maven/org.yaml/snakeyaml@1.33?type=jar</purl>
       <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-annotations</url></reference></externalReferences>
+      <externalReferences><reference type="issue-tracker"><url>https://bitbucket.org/snakeyaml/snakeyaml/issues</url></reference><reference type="vcs"><url>https://bitbucket.org/snakeyaml/snakeyaml/src</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/commons-codec/commons-codec@1.15?type=jar">
       <group>commons-codec</group>
@@ -159,72 +68,6 @@
       <modified>false</modified>
       <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/CODEC</url></reference><reference type="vcs"><url>https://github.com/apache/commons-codec</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-logger-api</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">e7da806a3427ab10405584067d880ead</hash>
-        <hash alg="SHA-1">92ae4e1826cf1d8321fcefd3f4ece0fa5cc4fc94</hash>
-        <hash alg="SHA-256">372d4b6cee7af83429f9f054a69f73d38d6fb4c983b14ce97f2599791d59aee9</hash>
-        <hash alg="SHA-512">c4f4edf49e18f475b7b44677497250cd93af45e302fb39306a94dc8f0ee1f783921967de3e1f1b7591f970a359080f43b24c1499a363280d904c2519d2e9bcb2</hash>
-        <hash alg="SHA-384">fcdadd6f2e8af30a7761e98f5c717ab1b8f6f0a79825a711454c8c9cc9842cf8fe0f5917b5ea48603eb0ee5788ed7a8b</hash>
-        <hash alg="SHA3-384">42a3e276d69efc85ce5798c5cd78ba1a910ef328169fb39a1a685eea5b98e9c3bf495124f56b518d553f1ca2e63d62f7</hash>
-        <hash alg="SHA3-256">0fb4d06e278df39d6633d1a09ed01ad4f7788838668f2ebc097f919384cec97d</hash>
-        <hash alg="SHA3-512">bb5a8b000955af1038d4d75c0fd8786561b3a2cf7bb804e09e42518a0bcc3e23ab01dd5236de4bdb58fd9b1a0e923982eb6cc6d0e450896bed9c86dfe808675d</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library" bom-ref="pkg:maven/com.github.sbaudoin/yamllint@1.5.0?type=jar">
-      <group>com.github.sbaudoin</group>
-      <name>yamllint</name>
-      <version>1.5.0</version>
-      <description>YAML 1.1 linter</description>
-      <hashes>
-        <hash alg="MD5">bc2f934bd698696823f9ecc7677a20cd</hash>
-        <hash alg="SHA-1">d3d53f3d461edd88fb8bfab89169122b29a62b4f</hash>
-        <hash alg="SHA-256">5bba1d3ce753620e290835d561c13b0411884cbf4bf1c35525d5ad26ef4d2391</hash>
-        <hash alg="SHA-512">e8b42c4ba8250246f7f8cedb5a5787bfd453dfa9d71951f366e2b1d1e385ab5ef2bac0605aaedae5224d8fda12153fcd6983bfc4cb60448978c0f18c44136b05</hash>
-        <hash alg="SHA-384">161adc86a1301608ee5af9f51390217f670ad6edf2215ae382a35111476b08f0aa35d925cf9256f81818c236c1f9b2eb</hash>
-        <hash alg="SHA3-384">89502cc5f7ee210448f4cc3c6e0cf61a1f31726b8e7f00f82aceab823dc2a0b66c17d76f0935c9fa213fc33d21fd918b</hash>
-        <hash alg="SHA3-256">e7db7ae83b8f184b28cb61269786102a80a2b29bd44d50693504bc7468a1c4c5</hash>
-        <hash alg="SHA3-512">e8e018b4bcd6e56492c33225927ab828d7a725d56d08ce33f7193e11f53c961fdfaaadfb5d6745c3b6048787a9cb0ff6b8398a3925c5553710d387df7716d3aa</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
-      </licenses>
-      <purl>pkg:maven/com.github.sbaudoin/yamllint@1.5.0?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="issue-tracker"><url>https://github.com/sbaudoin/yamllint/issues</url></reference><reference type="vcs"><url>https://github.com/sbaudoin/yamllint.git</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar">
-      <publisher>com.github.luben</publisher>
-      <group>com.github.luben</group>
-      <name>zstd-jni</name>
-      <version>1.5.4-1</version>
-      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>
-      <hashes>
-        <hash alg="MD5">e787241d6ec56aac451be8b0d920c85b</hash>
-        <hash alg="SHA-1">291ccaacc039e41932de877303edb6af98a91c24</hash>
-        <hash alg="SHA-256">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>
-        <hash alg="SHA-512">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>
-        <hash alg="SHA-384">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>
-        <hash alg="SHA3-384">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>
-        <hash alg="SHA3-256">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>
-        <hash alg="SHA3-512">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>BSD-2-Clause</id>
-        </license>
-      </licenses>
-      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>
-      <modified>false</modified>
-    </component>
     <component type="library" bom-ref="pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar">
       <group>org.slf4j</group>
       <name>jcl-over-slf4j</name>
@@ -248,95 +91,35 @@
       <purl>pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar</purl>
       <modified>false</modified>
     </component>
-    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar">
-      <group>com.fasterxml.jackson.core</group>
-      <name>jackson-core</name>
-      <version>2.14.2</version>
-      <description>Core Jackson processing abstractions (aka Streaming API), implementation for JSON</description>
-      <hashes>
-        <hash alg="MD5">6ee422ee4c481b2d5aacb2b5e36a7dc0</hash>
-        <hash alg="SHA-1">f804090e6399ce0cf78242db086017512dd71fcc</hash>
-        <hash alg="SHA-256">b5d37a77c88277b97e3593c8740925216c06df8e4172bbde058528df04ad3e7a</hash>
-        <hash alg="SHA-512">208953cf72691b3bab1ca2f9a045cccd3d75c46c90099ba884fbf16bc3e45045e5cd014d2c68c96e8a8826f87a5f0e18cb34b35e7ef03348953869c21e197367</hash>
-        <hash alg="SHA-384">e806595862c5fcdae801d9845befc1d12c97e6036ee839d34590dbd785a422d5832cf4fc5c7ee6e1a5ee7a59f37740f0</hash>
-        <hash alg="SHA3-384">4fa59f572f2e100e2eba6fc664a3b9f804fabd911a552cb40805f39e624a9c04246b679cf4b017bb782c8272877f49d2</hash>
-        <hash alg="SHA3-256">cef17d3a539cbf798cfb0bfa9faffa2b7baff3670b50743e91ee58b4c60b59f1</hash>
-        <hash alg="SHA3-512">fceeed5cb8fe4335d88282d15657762a4728483275a7ff45f50b9fe6a999757ccb37c415d001eb6250226f98f5c576b1b36a83e601fb393cfd34a811c2df5d00</hash>
-      </hashes>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-tool-java-sdk</name>
+      <version>1.6.0</version>
+      <description>Java SDK for Tools</description>
       <licenses>
         <license>
           <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         </license>
       </licenses>
-      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-core</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar">
-      <group>org.slf4j</group>
-      <name>slf4j-api</name>
-      <version>2.0.7</version>
-      <description>The slf4j API</description>
-      <hashes>
-        <hash alg="MD5">403dffa46cdd2e3c82da19df4f394a4c</hash>
-        <hash alg="SHA-1">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>
-        <hash alg="SHA-256">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>
-        <hash alg="SHA-512">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>
-        <hash alg="SHA-384">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>
-        <hash alg="SHA3-384">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>
-        <hash alg="SHA3-256">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>
-        <hash alg="SHA3-512">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>MIT</id>
-          <url>https://opensource.org/licenses/MIT</url>
-        </license>
-      </licenses>
-      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>
+      <purl>pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.tukaani/xz@1.9?type=jar">
-      <group>org.tukaani</group>
-      <name>xz</name>
-      <version>1.9</version>
-      <description>XZ data compression</description>
-      <hashes>
-        <hash alg="MD5">57c2fbfeb55e307ccae52e5322082e02</hash>
-        <hash alg="SHA-1">1ea4bec1a921180164852c65006d928617bd2caf</hash>
-        <hash alg="SHA-256">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>
-        <hash alg="SHA-512">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>
-        <hash alg="SHA-384">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>
-        <hash alg="SHA3-384">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>
-        <hash alg="SHA3-256">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>
-        <hash alg="SHA3-512">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>
-      </hashes>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-command-java-sdk</name>
+      <version>1.6.0</version>
+      <description>JReleaser command SDK</description>
       <licenses>
         <license>
-          <name>Public Domain</name>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         </license>
       </licenses>
-      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>https://git.tukaani.org/?p=xz-java.git</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-model-impl</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">d2760fed3ab0f395c3ec08c3f7493d52</hash>
-        <hash alg="SHA-1">37f35b86cc5bcdf8c7d306d97884c2d89fa742d5</hash>
-        <hash alg="SHA-256">284a61227c9f031b6b6928bfef76eeea45c97e6053b7a1190e3dd64c0effd8df</hash>
-        <hash alg="SHA-512">81899b65d3eb10b0dac885ee17b45822d12d5746141876ef2573b0afaec13c92187ebf8a6c446ce002f25f8bc3d40f1a88e1c8c548bd35a556efc86d9f5ed809</hash>
-        <hash alg="SHA-384">c961c3d7d900e27341988545b53d9bc8f89275e700799e41b56dc43444173e1bf962e00f96026de0fee5894594d40d6f</hash>
-        <hash alg="SHA3-384">984a6c6ab7487eeb35b3aa8d87754d4dd55bdcbcce9239bd0ec17b1ca63e1a66e4f34767476bd5b79e0998477ccc7c35</hash>
-        <hash alg="SHA3-256">a5b874d301532774b825877e6d29045492c60e20a00d55d096e0a3b371885a41</hash>
-        <hash alg="SHA3-512">83babeb5dc661f2a4f4082872615c1c70719c66ac3f2071f367a82d1b7e44390121d4e59ace75f0fdbc66f5277c306242ee491de2268d49bc5c9da4247b260e9</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar</purl>
+      <purl>pkg:maven/org.jreleaser/jreleaser-command-java-sdk@1.6.0?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/org.apache.commons/commons-compress@1.22?type=jar">
       <group>org.apache.commons</group>
@@ -365,47 +148,54 @@
       <modified>false</modified>
       <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/COMPRESS</url></reference><reference type="vcs"><url>https://gitbox.apache.org/repos/asf?p=commons-compress.git</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.yaml/snakeyaml@1.33?type=jar">
-      <group>org.yaml</group>
-      <name>snakeyaml</name>
-      <version>1.33</version>
-      <description>YAML 1.1 parser and emitter for Java</description>
+    <component type="library" bom-ref="pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar">
+      <group>org.slf4j</group>
+      <name>slf4j-api</name>
+      <version>2.0.7</version>
+      <description>The slf4j API</description>
       <hashes>
-        <hash alg="MD5">e0164a637c691c8cf01d29f90a709c02</hash>
-        <hash alg="SHA-1">2cd0a87ff7df953f810c344bdf2fe3340b954c69</hash>
-        <hash alg="SHA-256">11ff459788f0a2d781f56a4a86d7e69202cebacd0273d5269c4ae9f02f3fd8f0</hash>
-        <hash alg="SHA-512">787b72aebb685689ab379ed8f238fc2f4175bb82d285909e39e7ff1ee1b9e64ad8878f4685dadde274f950b0dc77dca3082a52921c11094aa2a535672ae4f33c</hash>
-        <hash alg="SHA-384">9f0a0a35df2b339830b9e78294634ea894e7096e01709c82d965e24a9fa9ac6ee15edbbbf23368dcd57741de5bf23086</hash>
-        <hash alg="SHA3-384">91d8fd581d60be4090d3b522d8c119c12449cff2ce6c436d0e53977e1c9fea8686b2b360fb15f4c3507e4f243d7d6170</hash>
-        <hash alg="SHA3-256">7dcf0429ecb923a66e00ec633bafeb297e3b90e1cc2be0f85443fd61367f355a</hash>
-        <hash alg="SHA3-512">59b32910dddf63475893f7c830d58ca320cd6183704d80b8111cee7bb1674f97f5699c8ac52f905a5b9a20128b9e2b6a26a07490f217033c858d9c358bedcafc</hash>
+        <hash alg="MD5">403dffa46cdd2e3c82da19df4f394a4c</hash>
+        <hash alg="SHA-1">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>
+        <hash alg="SHA-256">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>
+        <hash alg="SHA-512">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>
+        <hash alg="SHA-384">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>
+        <hash alg="SHA3-384">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>
+        <hash alg="SHA3-256">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>
+        <hash alg="SHA3-512">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>
       </hashes>
       <licenses>
         <license>
-          <id>Apache-2.0</id>
+          <id>MIT</id>
+          <url>https://opensource.org/licenses/MIT</url>
         </license>
       </licenses>
-      <purl>pkg:maven/org.yaml/snakeyaml@1.33?type=jar</purl>
+      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>
       <modified>false</modified>
-      <externalReferences><reference type="issue-tracker"><url>https://bitbucket.org/snakeyaml/snakeyaml/issues</url></reference><reference type="vcs"><url>https://bitbucket.org/snakeyaml/snakeyaml/src</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-tool-java-sdk</name>
-      <version>1.6.0</version>
+    <component type="library" bom-ref="pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar">
+      <group>com.github.spullara.mustache.java</group>
+      <name>compiler</name>
+      <version>0.9.10</version>
+      <description>Implementation of mustache.js for Java</description>
       <hashes>
-        <hash alg="MD5">abfd7ce4581351b44b505c26c1367955</hash>
-        <hash alg="SHA-1">ef1e1b370a0a24a202089f732598f82ce91c74f2</hash>
-        <hash alg="SHA-256">a4bcf1548d74752460e28bd3ab7e43b779b5a8f446285b8e7643dd83983f5b7f</hash>
-        <hash alg="SHA-512">e14548ab617020cac195b98b2b6bf04043cf409ef395783e8c2c38441c761f38dd34b4858d4d7e26d2c69fde233ccaa102f180d3ff547efc29e475d0c38b7b40</hash>
-        <hash alg="SHA-384">85953ec5ec2714df877d6012db03c5d88a971dcb35cfc43c197570e8e2b010c1c292e228e4fe8c7f93418e11868b8654</hash>
-        <hash alg="SHA3-384">cb294f21ab1d8a8c8f488e2f60b456e66985b55dbb5ecc56646b57fc6fbb9e36aa69801bdb6c1ea5825288baab329183</hash>
-        <hash alg="SHA3-256">cf8c1f78e8630a84e28269970a18752616d82aec3a5d9297459244fb4d52980a</hash>
-        <hash alg="SHA3-512">bd42233ee963b74dd472abde6801b8140f3ec1b08e503e486bd7c8ef7575e65a72f0bd8a3ca996adbc832d4df6be8e2b500a425b77dfdfd80e57818af84a79c2</hash>
+        <hash alg="MD5">5638fc78a17d5063cc4b0d00f6e87491</hash>
+        <hash alg="SHA-1">6111ae24e3be9ecbd75f5fe908583fc14b4f0174</hash>
+        <hash alg="SHA-256">2b5a9217811cb99846a473fa8e0d233eb33629347b7f44941f6c0fbd4cdf1038</hash>
+        <hash alg="SHA-512">2ccf3196af2b518c96df748a72a0122d033dc222e1fab3e12f3e2094146d44bec20bd1502390b59abf090cbdf5dd4d580084b07fb7241248b5b8da2605207559</hash>
+        <hash alg="SHA-384">0204e77a4a64701af5000df6601f4f4c23cb5e53dd39a1325615d4f942cd2c91d04bbac20348ae49731f586282165c33</hash>
+        <hash alg="SHA3-384">0960da7175835484471f485d481499f8b65f134ff4f1629618560adaa5a08caa897fbefcea190f93106ee9e3273381b2</hash>
+        <hash alg="SHA3-256">cfb7e640392ef590069e6b1d059dc20b8fcff984a4b267b3969fcf50ed0edd4f</hash>
+        <hash alg="SHA3-512">db3dad3809879bca835a04da890fd86dbc58ba6637c72f07d02e39d13645ebb6c640b7fecc18a779e58946072078bdf114b91445026a32dd6501b5d1c6e7d933</hash>
       </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-tool-java-sdk@1.6.0?type=jar</purl>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>http://github.com/spullara/mustache.java</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2?type=jar">
       <group>com.fasterxml.jackson.core</group>
@@ -431,24 +221,6 @@
       <modified>false</modified>
       <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-databind</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-resource-bundle</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">8419930ec5e42489dad5e26749a994eb</hash>
-        <hash alg="SHA-1">050aba092fa794e0cb91158de894a97aff581356</hash>
-        <hash alg="SHA-256">38434b31fac439399aa37018fa69302a9d1b04be6efb7b23d53d18615e1f4f2b</hash>
-        <hash alg="SHA-512">c77c476e972e17b25de3aecf75d71482535d68cdc5e4bf556f5d4cab17345b9318d47fa42c9da671769f9bcf7f549efde70b64eff5cb189c805bb406fd705cb8</hash>
-        <hash alg="SHA-384">b1d8f56681f39c638806e669447d9600507946448b528060d98afc2123c637980ba5609aba4b357c83acd772bfbdb73e</hash>
-        <hash alg="SHA3-384">74a52a9891c520a0f90ffbab33da0219cd787bbe309ae8eca303de00c6041692554e8d650a6a3925e057322bd00700ff</hash>
-        <hash alg="SHA3-256">304bae90a7c53e6ad711e54bb8847c3eedc0e18cac03bffa14729918cb59efce</hash>
-        <hash alg="SHA3-512">16a31cb40ed20dcaa5d34cb6aa2b81325f285b7feb5dda2486206496449fd548ef51117b38a8074a4a106fba9836de72232762dff60f535cd76f5848860c2f6c</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar</purl>
-      <modified>false</modified>
-    </component>
     <component type="library" bom-ref="pkg:maven/commons-io/commons-io@2.11.0?type=jar">
       <group>commons-io</group>
       <name>commons-io</name>
@@ -474,23 +246,80 @@
       <modified>false</modified>
       <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/IO</url></reference><reference type="vcs"><url>https://gitbox.apache.org/repos/asf?p=commons-io.git</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-utils</name>
-      <version>1.6.0</version>
+    <component type="library" bom-ref="pkg:maven/org.tukaani/xz@1.9?type=jar">
+      <group>org.tukaani</group>
+      <name>xz</name>
+      <version>1.9</version>
+      <description>XZ data compression</description>
       <hashes>
-        <hash alg="MD5">ca784b5aa352b016a37b393e9e500325</hash>
-        <hash alg="SHA-1">b0dde5ebbe5a98e5fa90b101dca5ad56e92c49c8</hash>
-        <hash alg="SHA-256">02b038af2f098d6019b94f4f4e55b8f901d2b5b4a072b083b23e47bd6a3e23cd</hash>
-        <hash alg="SHA-512">9b5e03766473ee854f877182a758a4842a9566772405af73cd200388eeeb981712e6a3e57f4f2f14f09a912b0cad625a75c5441b57eaa238699beabf327dd56a</hash>
-        <hash alg="SHA-384">ebc800a8a0a6d19ac2bc922598f8913df5a5eb972dc46ba4eadec5034538c9c95866839670dbf92ca93b075dcb659a0c</hash>
-        <hash alg="SHA3-384">ed0ba35caf8b7d7dc67d7350617b6cbd54de336634fd5927f03768a89f74ede798ecf343964ef0484302ee262617756b</hash>
-        <hash alg="SHA3-256">b81154ce5c428820626ee1a99e7f9bbe63d4803f7f311744a26bb8331fb193cc</hash>
-        <hash alg="SHA3-512">b6429f8944cedd026f7b0c30328f8b5e2717493624cee82df48f7e69c8fe8a26b0542d447b1795c7fad7ff90affadcc087d69a576d69cbaccf3ccf1ca962be56</hash>
+        <hash alg="MD5">57c2fbfeb55e307ccae52e5322082e02</hash>
+        <hash alg="SHA-1">1ea4bec1a921180164852c65006d928617bd2caf</hash>
+        <hash alg="SHA-256">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>
+        <hash alg="SHA-512">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>
+        <hash alg="SHA-384">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>
+        <hash alg="SHA3-384">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>
+        <hash alg="SHA3-256">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>
+        <hash alg="SHA3-512">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>
       </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar</purl>
+      <licenses>
+        <license>
+          <name>Public Domain</name>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://git.tukaani.org/?p=xz-java.git</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar">
+      <group>org.apache.commons</group>
+      <name>commons-jexl3</name>
+      <version>3.3</version>
+      <description>JEXL is a library intended to facilitate the implementation of scripting features in
+        applications and frameworks written in Java.</description>
+      <hashes>
+        <hash alg="MD5">3a332e3beb67b3a2a20bd0a950fc57c4</hash>
+        <hash alg="SHA-1">c76b4cfa436c3e79e04806e62656b09968c388ba</hash>
+        <hash alg="SHA-256">07b0ff6c5a10ffb2e2c02da9e2c0e2e6702df44178cfb76881f69447fc386014</hash>
+        <hash alg="SHA-512">879111d1c3ad021ea3961e49161b3ff6ba251044ffef1ca4d36d880d9a09b1f395e17eef221a13274303f44e116204ae4b2a3ee3e931f117fc901e321d59b5c6</hash>
+        <hash alg="SHA-384">7a268bf2c903be86813fcc7f06158abf79d558ee59ebf03470ebd06ca6e6d169beb1c3600e07c20c4f95fa7827fde841</hash>
+        <hash alg="SHA3-384">1803d239f17f7eeee6edb69d38c4473319fd4eeeb684eda5c38b577a7aaf42965ce41d9082d515d5007be9a0b0712d81</hash>
+        <hash alg="SHA3-256">01163da5e720b6d1f6bf8b6e9e398d26a1be92b3f18ef6089d218d54166b0c01</hash>
+        <hash alg="SHA3-512">8abdd72c14492340c05fd5d3555682a308ac00ac1b1e1e15ae38abc47f454f50db9e0727a49df72a50bf49f1447a6ca9dadc48b9ffd45a043bcbae9e5e050d3d</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.apache.commons/commons-jexl3@3.3?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/JEXL</url></reference><reference type="vcs"><url>https://gitbox.apache.org/repos/asf/commons-jexl.git</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar">
+      <group>org.bouncycastle</group>
+      <name>bcprov-jdk15on</name>
+      <version>1.70</version>
+      <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.</description>
+      <hashes>
+        <hash alg="MD5">1809d0449a6374279c01fdd3be26cd92</hash>
+        <hash alg="SHA-1">4636a0d01f74acaf28082fb62b317f1080118371</hash>
+        <hash alg="SHA-256">8f3c20e3e2d565d26f33e8d4857a37d0d7f8ac39b62a7026496fcab1bdac30d4</hash>
+        <hash alg="SHA-512">7dccfc636ee4df1487615818cfa99c69941081df95e8ef1eaf4bca165594dff9547e3774fd70de3418abace77d2c45889f70bcd2e6823f8539f359e68eaf36d1</hash>
+        <hash alg="SHA-384">a0b35d204cd962f1d246fa94b6e8b0fcee1a7c3f37b7e87cda742f2124a25b48794ce11a903ea8d12009c86227b6808d</hash>
+        <hash alg="SHA3-384">980d81d3d9906764bbf2ae9b3b364ea58628b485ce1dc3d06734e10495d79f2be2e7cc7df61ac88cd67c1104c7af9393</hash>
+        <hash alg="SHA3-256">10a3572e42d29f609721d795116e3e5d0f6f03efef84bb979ce72e26908d242b</hash>
+        <hash alg="SHA3-512">a0761cb6deeb86c94b96850c72c0a0eaf516ca849f4b8268f9f60c9ed2a6730e692c15098d47e617da294e931113c6cbcaddec8957c9f029fa595b5f14ff35ac</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <name>Bouncy Castle Licence</name>
+          <url>https://www.bouncycastle.org/licence.html</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="issue-tracker"><url>https://github.com/bcgit/bc-java/issues</url></reference><reference type="vcs"><url>https://github.com/bcgit/bc-java</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.14.2?type=jar">
       <group>com.fasterxml.jackson.dataformat</group>
@@ -515,73 +344,220 @@
       <purl>pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.14.2?type=jar</purl>
       <modified>false</modified>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar">
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-model-impl</name>
+      <version>1.6.0</version>
+      <description>JReleaser Model implementation</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-model-impl@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar">
+      <publisher>com.github.luben</publisher>
+      <group>com.github.luben</group>
+      <name>zstd-jni</name>
+      <version>1.5.4-1</version>
+      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>
+      <hashes>
+        <hash alg="MD5">e787241d6ec56aac451be8b0d920c85b</hash>
+        <hash alg="SHA-1">291ccaacc039e41932de877303edb6af98a91c24</hash>
+        <hash alg="SHA-256">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>
+        <hash alg="SHA-512">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>
+        <hash alg="SHA-384">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>
+        <hash alg="SHA3-384">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>
+        <hash alg="SHA3-256">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>
+        <hash alg="SHA3-512">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar">
+      <group>com.fasterxml.jackson.core</group>
+      <name>jackson-annotations</name>
+      <version>2.14.2</version>
+      <description>Core annotations used for value types, used by Jackson data binding package.</description>
+      <hashes>
+        <hash alg="MD5">10d19982a8890f6eb37557af2f58e272</hash>
+        <hash alg="SHA-1">a7aae9525864930723e3453ab799521fdfd9d873</hash>
+        <hash alg="SHA-256">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>
+        <hash alg="SHA-512">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>
+        <hash alg="SHA-384">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>
+        <hash alg="SHA3-384">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>
+        <hash alg="SHA3-256">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>
+        <hash alg="SHA3-512">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-annotations</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-logger-api</name>
+      <version>1.6.0</version>
+      <description>JReleaser logger API</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-utils</name>
+      <version>1.6.0</version>
+      <description>JReleaser utility classes</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-utils@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar">
       <group>org.bouncycastle</group>
-      <name>bcprov-jdk15on</name>
+      <name>bcpg-jdk15on</name>
       <version>1.70</version>
-      <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.</description>
+      <description>The Bouncy Castle Java API for handling the OpenPGP protocol. This jar contains the OpenPGP API for JDK 1.5 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.</description>
       <hashes>
-        <hash alg="MD5">1809d0449a6374279c01fdd3be26cd92</hash>
-        <hash alg="SHA-1">4636a0d01f74acaf28082fb62b317f1080118371</hash>
-        <hash alg="SHA-256">8f3c20e3e2d565d26f33e8d4857a37d0d7f8ac39b62a7026496fcab1bdac30d4</hash>
-        <hash alg="SHA-512">7dccfc636ee4df1487615818cfa99c69941081df95e8ef1eaf4bca165594dff9547e3774fd70de3418abace77d2c45889f70bcd2e6823f8539f359e68eaf36d1</hash>
-        <hash alg="SHA-384">a0b35d204cd962f1d246fa94b6e8b0fcee1a7c3f37b7e87cda742f2124a25b48794ce11a903ea8d12009c86227b6808d</hash>
-        <hash alg="SHA3-384">980d81d3d9906764bbf2ae9b3b364ea58628b485ce1dc3d06734e10495d79f2be2e7cc7df61ac88cd67c1104c7af9393</hash>
-        <hash alg="SHA3-256">10a3572e42d29f609721d795116e3e5d0f6f03efef84bb979ce72e26908d242b</hash>
-        <hash alg="SHA3-512">a0761cb6deeb86c94b96850c72c0a0eaf516ca849f4b8268f9f60c9ed2a6730e692c15098d47e617da294e931113c6cbcaddec8957c9f029fa595b5f14ff35ac</hash>
+        <hash alg="MD5">01ddc3aa0289346f4db19d95039cefdb</hash>
+        <hash alg="SHA-1">062f72ec06f31a6c31a3f3355fce0384b21126d7</hash>
+        <hash alg="SHA-256">4f08f4aa74048824151c98dd3e92e7165ac30659834404f08a8e843bdad32847</hash>
+        <hash alg="SHA-512">4e240b7811ef90c090e83a181dace41da487555e4136221861b0060f9af6d8b316f2dd0472f747adb98ca5372f46055456ef04bdc0c3992188ab13302922fce9</hash>
+        <hash alg="SHA-384">d89dec6226112d13cbea461d84740699770dd7d8ad3f67ab65e7b49fd08a096a948e54da2e6a681925c4320f410bba37</hash>
+        <hash alg="SHA3-384">5e8e8ca63cc550a8f50b627c4dd051f0eb5c31b99ff53dabd7d5f5d1ed98d0dc1d4963a09fc0db32f8e0ff769a2a6e65</hash>
+        <hash alg="SHA3-256">77f28e7e22b3b3a8d7b667fb7f783847c4b11ee7208833636e09e8b38390fd51</hash>
+        <hash alg="SHA3-512">cb238dbb641c42c49b5801bdfa6432395e860c1a7485ba68e2d57887e3d22ff254718c6cbfa34c107bfb09d74e2f85c33b95f89dfa886e141a8247a0abf2b5c2</hash>
       </hashes>
       <licenses>
         <license>
           <name>Bouncy Castle Licence</name>
           <url>https://www.bouncycastle.org/licence.html</url>
         </license>
+        <license>
+          <id>Apache-1.1</id>
+          <url>http://apache.org/licenses/LICENSE-1.1</url>
+        </license>
       </licenses>
-      <purl>pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar</purl>
+      <purl>pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar</purl>
       <modified>false</modified>
       <externalReferences><reference type="issue-tracker"><url>https://github.com/bcgit/bc-java/issues</url></reference><reference type="vcs"><url>https://github.com/bcgit/bc-java</url></reference></externalReferences>
     </component>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-model-api</name>
+      <version>1.6.0</version>
+      <description>JReleaser Model API</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-model-api@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-resource-bundle</name>
+      <version>1.6.0</version>
+      <description>JReleaser resource bundle</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
     <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar">
       <group>org.jreleaser</group>
       <name>jreleaser-signing-java-sdk</name>
       <version>1.6.0</version>
+      <description>JReleaser signing Java SDK</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/com.github.sbaudoin/yamllint@1.5.0?type=jar">
+      <group>com.github.sbaudoin</group>
+      <name>yamllint</name>
+      <version>1.5.0</version>
+      <description>YAML 1.1 linter</description>
       <hashes>
-        <hash alg="MD5">2608fa713b1fa2a515ec2c83ec96a49c</hash>
-        <hash alg="SHA-1">f0de8990fee988060fe7721d389d6ba8aad481a4</hash>
-        <hash alg="SHA-256">ea0e35358f453eee98d0a4e921bfa6114c04afe52adb0c74bcc5200092971454</hash>
-        <hash alg="SHA-512">4d0146d43526b329139bb38edbe63f6f783ae99f5d2778c6c6af8851be458739afe31951bf8e54f85da7c6e5d5e7d4670b45917c6ffa855f578355a6359286a6</hash>
-        <hash alg="SHA-384">a29024fbd6fb57818b5800cb961a043d4d131e4c16d0b6965a4abd4ef275001bd607697195f562e6b3d4f36fac5847b0</hash>
-        <hash alg="SHA3-384">5b9e053c6b9a48483a7cdd898f37fc72275171348ed4433b9759e0a4f86edad6a26c84ed69eae8612811e17b806df60a</hash>
-        <hash alg="SHA3-256">477c36bff3a1ec95810622a43d43ea9b1c614c54306897d9c4ee66f2a349a9e9</hash>
-        <hash alg="SHA3-512">b6594d20048651c4982230202c5af186f064025bf80d21c87d4cacb3d1b466bc1e5c850fea374edf9c3c98fda734ea52284bd62bbd456aee903c705152d767da</hash>
+        <hash alg="MD5">bc2f934bd698696823f9ecc7677a20cd</hash>
+        <hash alg="SHA-1">d3d53f3d461edd88fb8bfab89169122b29a62b4f</hash>
+        <hash alg="SHA-256">5bba1d3ce753620e290835d561c13b0411884cbf4bf1c35525d5ad26ef4d2391</hash>
+        <hash alg="SHA-512">e8b42c4ba8250246f7f8cedb5a5787bfd453dfa9d71951f366e2b1d1e385ab5ef2bac0605aaedae5224d8fda12153fcd6983bfc4cb60448978c0f18c44136b05</hash>
+        <hash alg="SHA-384">161adc86a1301608ee5af9f51390217f670ad6edf2215ae382a35111476b08f0aa35d925cf9256f81818c236c1f9b2eb</hash>
+        <hash alg="SHA3-384">89502cc5f7ee210448f4cc3c6e0cf61a1f31726b8e7f00f82aceab823dc2a0b66c17d76f0935c9fa213fc33d21fd918b</hash>
+        <hash alg="SHA3-256">e7db7ae83b8f184b28cb61269786102a80a2b29bd44d50693504bc7468a1c4c5</hash>
+        <hash alg="SHA3-512">e8e018b4bcd6e56492c33225927ab828d7a725d56d08ce33f7193e11f53c961fdfaaadfb5d6745c3b6048787a9cb0ff6b8398a3925c5553710d387df7716d3aa</hash>
       </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-signing-java-sdk@1.6.0?type=jar</purl>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.github.sbaudoin/yamllint@1.5.0?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="issue-tracker"><url>https://github.com/sbaudoin/yamllint/issues</url></reference><reference type="vcs"><url>https://github.com/sbaudoin/yamllint.git</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar">
-      <group>com.github.spullara.mustache.java</group>
-      <name>compiler</name>
-      <version>0.9.10</version>
-      <description>Implementation of mustache.js for Java</description>
+    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar">
+      <group>com.fasterxml.jackson.core</group>
+      <name>jackson-core</name>
+      <version>2.14.2</version>
+      <description>Core Jackson processing abstractions (aka Streaming API), implementation for JSON</description>
       <hashes>
-        <hash alg="MD5">5638fc78a17d5063cc4b0d00f6e87491</hash>
-        <hash alg="SHA-1">6111ae24e3be9ecbd75f5fe908583fc14b4f0174</hash>
-        <hash alg="SHA-256">2b5a9217811cb99846a473fa8e0d233eb33629347b7f44941f6c0fbd4cdf1038</hash>
-        <hash alg="SHA-512">2ccf3196af2b518c96df748a72a0122d033dc222e1fab3e12f3e2094146d44bec20bd1502390b59abf090cbdf5dd4d580084b07fb7241248b5b8da2605207559</hash>
-        <hash alg="SHA-384">0204e77a4a64701af5000df6601f4f4c23cb5e53dd39a1325615d4f942cd2c91d04bbac20348ae49731f586282165c33</hash>
-        <hash alg="SHA3-384">0960da7175835484471f485d481499f8b65f134ff4f1629618560adaa5a08caa897fbefcea190f93106ee9e3273381b2</hash>
-        <hash alg="SHA3-256">cfb7e640392ef590069e6b1d059dc20b8fcff984a4b267b3969fcf50ed0edd4f</hash>
-        <hash alg="SHA3-512">db3dad3809879bca835a04da890fd86dbc58ba6637c72f07d02e39d13645ebb6c640b7fecc18a779e58946072078bdf114b91445026a32dd6501b5d1c6e7d933</hash>
+        <hash alg="MD5">6ee422ee4c481b2d5aacb2b5e36a7dc0</hash>
+        <hash alg="SHA-1">f804090e6399ce0cf78242db086017512dd71fcc</hash>
+        <hash alg="SHA-256">b5d37a77c88277b97e3593c8740925216c06df8e4172bbde058528df04ad3e7a</hash>
+        <hash alg="SHA-512">208953cf72691b3bab1ca2f9a045cccd3d75c46c90099ba884fbf16bc3e45045e5cd014d2c68c96e8a8826f87a5f0e18cb34b35e7ef03348953869c21e197367</hash>
+        <hash alg="SHA-384">e806595862c5fcdae801d9845befc1d12c97e6036ee839d34590dbd785a422d5832cf4fc5c7ee6e1a5ee7a59f37740f0</hash>
+        <hash alg="SHA3-384">4fa59f572f2e100e2eba6fc664a3b9f804fabd911a552cb40805f39e624a9c04246b679cf4b017bb782c8272877f49d2</hash>
+        <hash alg="SHA3-256">cef17d3a539cbf798cfb0bfa9faffa2b7baff3670b50743e91ee58b4c60b59f1</hash>
+        <hash alg="SHA3-512">fceeed5cb8fe4335d88282d15657762a4728483275a7ff45f50b9fe6a999757ccb37c415d001eb6250226f98f5c576b1b36a83e601fb393cfd34a811c2df5d00</hash>
       </hashes>
       <licenses>
         <license>
           <id>Apache-2.0</id>
-          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         </license>
       </licenses>
-      <purl>pkg:maven/com.github.spullara.mustache.java/compiler@0.9.10?type=jar</purl>
+      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar</purl>
       <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>http://github.com/spullara/mustache.java</url></reference></externalReferences>
+      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-core</url></reference></externalReferences>
     </component>
   </components>
   <dependencies>
