--- results/org.jreleaser/jreleaser/1.6.0/oss-rebuild-improved-2/reference/jreleaser-utils-1.6.0-cyclonedx.xml:jreleaser-utils-1.6.0-cyclonedx.xml	2025-07-28 23:33:27.172673684 +0200
+++ results/org.jreleaser/jreleaser/1.6.0/oss-rebuild-improved-2/rebuild/jreleaser-utils-1.6.0-cyclonedx.xml:jreleaser-utils-1.6.0-cyclonedx.xml	2025-07-28 23:33:28.338669574 +0200
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom serialNumber="urn:uuid:ea157d14-48a5-4102-81be-e50c8b75df2b" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
+<bom serialNumber="urn:uuid:e856e3ee-c660-4288-9634-601e07776f7e" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
   <metadata>
-    <timestamp>2023-04-29T10:08:59Z</timestamp>
+    <timestamp>2025-07-11T06:29:53Z</timestamp>
     <tools>
       <tool>
         <vendor>CycloneDX</vendor>
@@ -17,53 +17,128 @@
     </component>
   </metadata>
   <components>
-    <component type="library" bom-ref="pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar">
+    <component type="library" bom-ref="pkg:maven/commons-codec/commons-codec@1.15?type=jar">
+      <group>commons-codec</group>
+      <name>commons-codec</name>
+      <version>1.15</version>
+      <description>The Apache Commons Codec package contains simple encoder and decoders for
+     various formats such as Base64 and Hexadecimal.  In addition to these
+     widely used encoders and decoders, the codec package also maintains a
+     collection of phonetic encoding utilities.</description>
+      <hashes>
+        <hash alg="MD5">303baf002ce6d382198090aedd9d79a2</hash>
+        <hash alg="SHA-1">49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d</hash>
+        <hash alg="SHA-256">b3e9f6d63a790109bf0d056611fbed1cf69055826defeb9894a71369d246ed63</hash>
+        <hash alg="SHA-512">da30a716770795fce390e4dd340a8b728f220c6572383ffef55bd5839655d5611fcc06128b2144f6cdcb36f53072a12ec80b04afee787665e7ad0b6e888a6787</hash>
+        <hash alg="SHA-384">05d0506283716472175d44c2a4766523397bf8a007c18848f9c9a61718cc8aa437f9cb4b91771037ab29a960860b62a0</hash>
+        <hash alg="SHA3-384">12fad4ef78274b06f97b1243cea6f970088abde082d2de9377d915a34b44f7d7d67807c03e59c849b69f1544e2a9a1be</hash>
+        <hash alg="SHA3-256">87be248f33f241121f54aad61a9a460a79eabefbf1b5b0dd22aeb95b581f727e</hash>
+        <hash alg="SHA3-512">8c992c9c569ebaa0bf956a4c5b34fbf5e1ed1c212c2dd896fa216183ee0bcd341e96698af4b9cec7e8880762faa081a3d3a27f51349aa457cb8e373e4f57c788</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/commons-codec/commons-codec@1.15?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/CODEC</url></reference><reference type="vcs"><url>https://github.com/apache/commons-codec</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar">
+      <publisher>com.github.luben</publisher>
+      <group>com.github.luben</group>
+      <name>zstd-jni</name>
+      <version>1.5.4-1</version>
+      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>
+      <hashes>
+        <hash alg="MD5">e787241d6ec56aac451be8b0d920c85b</hash>
+        <hash alg="SHA-1">291ccaacc039e41932de877303edb6af98a91c24</hash>
+        <hash alg="SHA-256">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>
+        <hash alg="SHA-512">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>
+        <hash alg="SHA-384">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>
+        <hash alg="SHA3-384">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>
+        <hash alg="SHA3-256">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>
+        <hash alg="SHA3-512">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar">
       <group>org.slf4j</group>
-      <name>slf4j-api</name>
+      <name>jcl-over-slf4j</name>
       <version>2.0.7</version>
-      <description>The slf4j API</description>
+      <description>JCL 1.2 implemented over SLF4J</description>
       <hashes>
-        <hash alg="MD5">403dffa46cdd2e3c82da19df4f394a4c</hash>
-        <hash alg="SHA-1">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>
-        <hash alg="SHA-256">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>
-        <hash alg="SHA-512">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>
-        <hash alg="SHA-384">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>
-        <hash alg="SHA3-384">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>
-        <hash alg="SHA3-256">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>
-        <hash alg="SHA3-512">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>
+        <hash alg="MD5">4e8d6cd31f7e6277280c95157ac7845a</hash>
+        <hash alg="SHA-1">f127fe5ee53404a8b3697cdd032dd1dd6a29dd77</hash>
+        <hash alg="SHA-256">41806757e1d26dae5d6db2ca7d4a5176eed2d6e709cd86564d4a11dab0601742</hash>
+        <hash alg="SHA-512">221b39b85145cf7c245acb7f2692a02b6c5816f8b1187a1a77942dd39de958c1b01ecd066682eb88244f87b2a47513d40b6c1e69ef49a43b2a07ba818f124e17</hash>
+        <hash alg="SHA-384">fa8d53b46cd3ddab0bd265d384a90c35efef6a02a7822aa6f79065cee68d78f6ad7c4d248dea7497af449845dc962730</hash>
+        <hash alg="SHA3-384">cf06cfeaba477f7738f089ba401fb841074681d1c7f465546cdf0e95751a8bf912493428876a7d9108eef83f637c6a1e</hash>
+        <hash alg="SHA3-256">efbad2de8683215936c56b3f8fd3492f1cc27c2ee77595a99c794e18777dec42</hash>
+        <hash alg="SHA3-512">2707d5513e49f6e3ea6dec96510d360cfc125dab164ae5d99a1dcbd628751640f625a70ed749dad66024ae9fd7725f1c6c7f76de7f5a6efc9d8208a9e01922f7</hash>
       </hashes>
       <licenses>
         <license>
-          <id>MIT</id>
-          <url>https://opensource.org/licenses/MIT</url>
+          <id>Apache-2.0</id>
         </license>
       </licenses>
-      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>
+      <purl>pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar</purl>
       <modified>false</modified>
     </component>
-    <component type="library" bom-ref="pkg:maven/org.tukaani/xz@1.9?type=jar">
-      <group>org.tukaani</group>
-      <name>xz</name>
-      <version>1.9</version>
-      <description>XZ data compression</description>
+    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar">
+      <group>org.jreleaser</group>
+      <name>jreleaser-logger-api</name>
+      <version>1.6.0</version>
+      <description>JReleaser logger API</description>
       <hashes>
-        <hash alg="MD5">57c2fbfeb55e307ccae52e5322082e02</hash>
-        <hash alg="SHA-1">1ea4bec1a921180164852c65006d928617bd2caf</hash>
-        <hash alg="SHA-256">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>
-        <hash alg="SHA-512">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>
-        <hash alg="SHA-384">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>
-        <hash alg="SHA3-384">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>
-        <hash alg="SHA3-256">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>
-        <hash alg="SHA3-512">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>
+        <hash alg="MD5">e7da806a3427ab10405584067d880ead</hash>
+        <hash alg="SHA-1">92ae4e1826cf1d8321fcefd3f4ece0fa5cc4fc94</hash>
+        <hash alg="SHA-256">372d4b6cee7af83429f9f054a69f73d38d6fb4c983b14ce97f2599791d59aee9</hash>
+        <hash alg="SHA-512">c4f4edf49e18f475b7b44677497250cd93af45e302fb39306a94dc8f0ee1f783921967de3e1f1b7591f970a359080f43b24c1499a363280d904c2519d2e9bcb2</hash>
+        <hash alg="SHA-384">fcdadd6f2e8af30a7761e98f5c717ab1b8f6f0a79825a711454c8c9cc9842cf8fe0f5917b5ea48603eb0ee5788ed7a8b</hash>
+        <hash alg="SHA3-384">42a3e276d69efc85ce5798c5cd78ba1a910ef328169fb39a1a685eea5b98e9c3bf495124f56b518d553f1ca2e63d62f7</hash>
+        <hash alg="SHA3-256">0fb4d06e278df39d6633d1a09ed01ad4f7788838668f2ebc097f919384cec97d</hash>
+        <hash alg="SHA3-512">bb5a8b000955af1038d4d75c0fd8786561b3a2cf7bb804e09e42518a0bcc3e23ab01dd5236de4bdb58fd9b1a0e923982eb6cc6d0e450896bed9c86dfe808675d</hash>
       </hashes>
       <licenses>
         <license>
-          <name>Public Domain</name>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         </license>
       </licenses>
-      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>
+      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>
       <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>https://git.tukaani.org/?p=xz-java.git</url></reference></externalReferences>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar">
+      <group>com.fasterxml.jackson.core</group>
+      <name>jackson-annotations</name>
+      <version>2.14.2</version>
+      <description>Core annotations used for value types, used by Jackson data binding package.</description>
+      <hashes>
+        <hash alg="MD5">10d19982a8890f6eb37557af2f58e272</hash>
+        <hash alg="SHA-1">a7aae9525864930723e3453ab799521fdfd9d873</hash>
+        <hash alg="SHA-256">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>
+        <hash alg="SHA-512">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>
+        <hash alg="SHA-384">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>
+        <hash alg="SHA3-384">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>
+        <hash alg="SHA3-256">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>
+        <hash alg="SHA3-512">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-annotations</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar">
       <group>org.bouncycastle</group>
@@ -121,73 +196,28 @@
       <modified>false</modified>
       <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/COMPRESS</url></reference><reference type="vcs"><url>https://gitbox.apache.org/repos/asf?p=commons-compress.git</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar">
-      <group>com.fasterxml.jackson.core</group>
-      <name>jackson-annotations</name>
-      <version>2.14.2</version>
-      <description>Core annotations used for value types, used by Jackson data binding package.</description>
-      <hashes>
-        <hash alg="MD5">10d19982a8890f6eb37557af2f58e272</hash>
-        <hash alg="SHA-1">a7aae9525864930723e3453ab799521fdfd9d873</hash>
-        <hash alg="SHA-256">2c6869d505cf60dc066734b7d50339f975bd3adc635e26a78abb71acb4473c0d</hash>
-        <hash alg="SHA-512">a978384791bdc074df8039ffc95bb93f0f60d14d476861ee2a0ce208b33a991c486a07345cb80559252c3ff1dea14d3efb818c19bdc18435946dc8754d8e6ee3</hash>
-        <hash alg="SHA-384">d5111c69020666689414921ae4a8950f9fbdf86dec1360f6827beeee9ebd3f78db74e69c76e0becaba47eb34fdaaeb5a</hash>
-        <hash alg="SHA3-384">53b1a8891482e16a7d8849251cb0dcd1aacf6aaa2161a73589d9742ad96763e384d426d04db762e56fc4536f4e719084</hash>
-        <hash alg="SHA3-256">14f7b3c51c96f7429f7c60a69e3b7e4f9f2207820141f197d56b57018ffd5640</hash>
-        <hash alg="SHA3-512">75e4e4fb847fdacdd497cf6b340362581ab4091120ccf2ec32a273709d336af0f78c90ce12b2dd1d17354aa08583af0d3ded89bb415720f45f2d9c110d71dd7a</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
-      </licenses>
-      <purl>pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.2?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-annotations</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/commons-codec/commons-codec@1.15?type=jar">
-      <group>commons-codec</group>
-      <name>commons-codec</name>
-      <version>1.15</version>
-      <description>The Apache Commons Codec package contains simple encoder and decoders for
-     various formats such as Base64 and Hexadecimal.  In addition to these
-     widely used encoders and decoders, the codec package also maintains a
-     collection of phonetic encoding utilities.</description>
+    <component type="library" bom-ref="pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar">
+      <group>org.slf4j</group>
+      <name>slf4j-api</name>
+      <version>2.0.7</version>
+      <description>The slf4j API</description>
       <hashes>
-        <hash alg="MD5">303baf002ce6d382198090aedd9d79a2</hash>
-        <hash alg="SHA-1">49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d</hash>
-        <hash alg="SHA-256">b3e9f6d63a790109bf0d056611fbed1cf69055826defeb9894a71369d246ed63</hash>
-        <hash alg="SHA-512">da30a716770795fce390e4dd340a8b728f220c6572383ffef55bd5839655d5611fcc06128b2144f6cdcb36f53072a12ec80b04afee787665e7ad0b6e888a6787</hash>
-        <hash alg="SHA-384">05d0506283716472175d44c2a4766523397bf8a007c18848f9c9a61718cc8aa437f9cb4b91771037ab29a960860b62a0</hash>
-        <hash alg="SHA3-384">12fad4ef78274b06f97b1243cea6f970088abde082d2de9377d915a34b44f7d7d67807c03e59c849b69f1544e2a9a1be</hash>
-        <hash alg="SHA3-256">87be248f33f241121f54aad61a9a460a79eabefbf1b5b0dd22aeb95b581f727e</hash>
-        <hash alg="SHA3-512">8c992c9c569ebaa0bf956a4c5b34fbf5e1ed1c212c2dd896fa216183ee0bcd341e96698af4b9cec7e8880762faa081a3d3a27f51349aa457cb8e373e4f57c788</hash>
+        <hash alg="MD5">403dffa46cdd2e3c82da19df4f394a4c</hash>
+        <hash alg="SHA-1">41eb7184ea9d556f23e18b5cb99cad1f8581fc00</hash>
+        <hash alg="SHA-256">5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4</hash>
+        <hash alg="SHA-512">216d2cac27d501972c888f94dfa747d700b80d60813884b6ab4b12c6a3b17ed0c21a1d27e1aa4332c97c828f20039e3913d2763d7e1a3cef36ae4389a276e7a8</hash>
+        <hash alg="SHA-384">c25b39f418aa726ba8405dfd9b356131f89984e2ef5a55a724a2abf3b7c78443f671105835161d2414d602cf03da9f2d</hash>
+        <hash alg="SHA3-384">f33abfaac21badae6f85d3ebbc6c1204fd7fda3bb15173e763fa8cee95bce6a8270eec2c8f49343c66c8d2767bc317e1</hash>
+        <hash alg="SHA3-256">6e00d4b264a2afc4ca4e98f716ecece66c32c626ca3f8c5d56b22092b6fe417b</hash>
+        <hash alg="SHA3-512">ad7b9142d370fc532a07cdd43881a129b012ff50e2bede3ac27d9bd31ec707bf2f45e82002fa59e962955cc38ab73cdd77713fca50cedc926c046f5617c1285b</hash>
       </hashes>
       <licenses>
         <license>
-          <id>Apache-2.0</id>
+          <id>MIT</id>
+          <url>https://opensource.org/licenses/MIT</url>
         </license>
       </licenses>
-      <purl>pkg:maven/commons-codec/commons-codec@1.15?type=jar</purl>
-      <modified>false</modified>
-      <externalReferences><reference type="issue-tracker"><url>https://issues.apache.org/jira/browse/CODEC</url></reference><reference type="vcs"><url>https://github.com/apache/commons-codec</url></reference></externalReferences>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar">
-      <group>org.jreleaser</group>
-      <name>jreleaser-logger-api</name>
-      <version>1.6.0</version>
-      <hashes>
-        <hash alg="MD5">e7da806a3427ab10405584067d880ead</hash>
-        <hash alg="SHA-1">92ae4e1826cf1d8321fcefd3f4ece0fa5cc4fc94</hash>
-        <hash alg="SHA-256">372d4b6cee7af83429f9f054a69f73d38d6fb4c983b14ce97f2599791d59aee9</hash>
-        <hash alg="SHA-512">c4f4edf49e18f475b7b44677497250cd93af45e302fb39306a94dc8f0ee1f783921967de3e1f1b7591f970a359080f43b24c1499a363280d904c2519d2e9bcb2</hash>
-        <hash alg="SHA-384">fcdadd6f2e8af30a7761e98f5c717ab1b8f6f0a79825a711454c8c9cc9842cf8fe0f5917b5ea48603eb0ee5788ed7a8b</hash>
-        <hash alg="SHA3-384">42a3e276d69efc85ce5798c5cd78ba1a910ef328169fb39a1a685eea5b98e9c3bf495124f56b518d553f1ca2e63d62f7</hash>
-        <hash alg="SHA3-256">0fb4d06e278df39d6633d1a09ed01ad4f7788838668f2ebc097f919384cec97d</hash>
-        <hash alg="SHA3-512">bb5a8b000955af1038d4d75c0fd8786561b3a2cf7bb804e09e42518a0bcc3e23ab01dd5236de4bdb58fd9b1a0e923982eb6cc6d0e450896bed9c86dfe808675d</hash>
-      </hashes>
-      <licenses/>
-      <purl>pkg:maven/org.jreleaser/jreleaser-logger-api@1.6.0?type=jar</purl>
+      <purl>pkg:maven/org.slf4j/slf4j-api@2.0.7?type=jar</purl>
       <modified>false</modified>
     </component>
     <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2?type=jar">
@@ -214,57 +244,11 @@
       <modified>false</modified>
       <externalReferences><reference type="vcs"><url>https://github.com/FasterXML/jackson-databind</url></reference></externalReferences>
     </component>
-    <component type="library" bom-ref="pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar">
-      <publisher>com.github.luben</publisher>
-      <group>com.github.luben</group>
-      <name>zstd-jni</name>
-      <version>1.5.4-1</version>
-      <description>JNI bindings for Zstd native library that provides fast and high compression lossless algorithm for Java and all JVM languages.</description>
-      <hashes>
-        <hash alg="MD5">e787241d6ec56aac451be8b0d920c85b</hash>
-        <hash alg="SHA-1">291ccaacc039e41932de877303edb6af98a91c24</hash>
-        <hash alg="SHA-256">f0469d891127dc5ae6bd2df93a5aa38c4d79bcd5f360fbb88c2785b52a572349</hash>
-        <hash alg="SHA-512">368916f0057d69fa4ba3768f6f617291ce4083b89913e46c2daa68cc94c48b92e0ca626241486f34a4d154502eb77b19e82c16c68b341ecfc82ccc0520f8d4a9</hash>
-        <hash alg="SHA-384">7e72184873689fa286d93d88f69f8baa24f818fcd61105a14332fbb5ed254363c0969afa98befd797a3762577bc77993</hash>
-        <hash alg="SHA3-384">1302636797b291dbbe19f39bdeb66160c1317b395a0a9360ba93aeaa262de7ad8de7257e6a997a9c659fdf53b3367ee6</hash>
-        <hash alg="SHA3-256">54505ed16257a55330bb44c76719a687251d2623fa5e50a192b54c5067573255</hash>
-        <hash alg="SHA3-512">6e01cc9654c2d68c36a284e23c388267ac7013d534cceed0b6ab44679a6bbb6d03d4cfc52c967c4e76dbd5b8963c268e40d9890c927866ea00824821b0ecb82d</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>BSD-2-Clause</id>
-        </license>
-      </licenses>
-      <purl>pkg:maven/com.github.luben/zstd-jni@1.5.4-1?type=jar</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library" bom-ref="pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar">
-      <group>org.slf4j</group>
-      <name>jcl-over-slf4j</name>
-      <version>2.0.7</version>
-      <description>JCL 1.2 implemented over SLF4J</description>
-      <hashes>
-        <hash alg="MD5">4e8d6cd31f7e6277280c95157ac7845a</hash>
-        <hash alg="SHA-1">f127fe5ee53404a8b3697cdd032dd1dd6a29dd77</hash>
-        <hash alg="SHA-256">41806757e1d26dae5d6db2ca7d4a5176eed2d6e709cd86564d4a11dab0601742</hash>
-        <hash alg="SHA-512">221b39b85145cf7c245acb7f2692a02b6c5816f8b1187a1a77942dd39de958c1b01ecd066682eb88244f87b2a47513d40b6c1e69ef49a43b2a07ba818f124e17</hash>
-        <hash alg="SHA-384">fa8d53b46cd3ddab0bd265d384a90c35efef6a02a7822aa6f79065cee68d78f6ad7c4d248dea7497af449845dc962730</hash>
-        <hash alg="SHA3-384">cf06cfeaba477f7738f089ba401fb841074681d1c7f465546cdf0e95751a8bf912493428876a7d9108eef83f637c6a1e</hash>
-        <hash alg="SHA3-256">efbad2de8683215936c56b3f8fd3492f1cc27c2ee77595a99c794e18777dec42</hash>
-        <hash alg="SHA3-512">2707d5513e49f6e3ea6dec96510d360cfc125dab164ae5d99a1dcbd628751640f625a70ed749dad66024ae9fd7725f1c6c7f76de7f5a6efc9d8208a9e01922f7</hash>
-      </hashes>
-      <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
-      </licenses>
-      <purl>pkg:maven/org.slf4j/jcl-over-slf4j@2.0.7?type=jar</purl>
-      <modified>false</modified>
-    </component>
     <component type="library" bom-ref="pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar">
       <group>org.jreleaser</group>
       <name>jreleaser-resource-bundle</name>
       <version>1.6.0</version>
+      <description>JReleaser resource bundle</description>
       <hashes>
         <hash alg="MD5">8419930ec5e42489dad5e26749a994eb</hash>
         <hash alg="SHA-1">050aba092fa794e0cb91158de894a97aff581356</hash>
@@ -275,9 +259,39 @@
         <hash alg="SHA3-256">304bae90a7c53e6ad711e54bb8847c3eedc0e18cac03bffa14729918cb59efce</hash>
         <hash alg="SHA3-512">16a31cb40ed20dcaa5d34cb6aa2b81325f285b7feb5dda2486206496449fd548ef51117b38a8074a4a106fba9836de72232762dff60f535cd76f5848860c2f6c</hash>
       </hashes>
-      <licenses/>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+          <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+        </license>
+      </licenses>
       <purl>pkg:maven/org.jreleaser/jreleaser-resource-bundle@1.6.0?type=jar</purl>
       <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://github.com/jreleaser/jreleaser</url></reference></externalReferences>
+    </component>
+    <component type="library" bom-ref="pkg:maven/org.tukaani/xz@1.9?type=jar">
+      <group>org.tukaani</group>
+      <name>xz</name>
+      <version>1.9</version>
+      <description>XZ data compression</description>
+      <hashes>
+        <hash alg="MD5">57c2fbfeb55e307ccae52e5322082e02</hash>
+        <hash alg="SHA-1">1ea4bec1a921180164852c65006d928617bd2caf</hash>
+        <hash alg="SHA-256">211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5</hash>
+        <hash alg="SHA-512">a4362db234d4e83683e90f5baf90c82107450cc4404acab96e3fab14b8a3d4588a19722171d32f27d18463682a6994cad9af0b1065c954e3a77ea7bdcf586bac</hash>
+        <hash alg="SHA-384">aa30349b094723369908369a18e2cb5beb5b7ca0b24b4d56c2f5725fae152220f6526466672b22bfec939e2e0622a01d</hash>
+        <hash alg="SHA3-384">b3e1fee7784188df5e1931c9e8137ac0e20e63f66f93e7f938a448fc0b3adb4be5205c7a5f1835007e233fee2696fc2c</hash>
+        <hash alg="SHA3-256">92eff603ed0aab557e1a45e17a74e80d8ec656b5f137197b23c429c903fa448f</hash>
+        <hash alg="SHA3-512">b290f92958f8cd91705331d8411140c23957ab8b568fbe19a70f4f1dc97eddc13d3a200df28a02ab5911ce18f546c33f720878be0f727edac839a6e63ee66ece</hash>
+      </hashes>
+      <licenses>
+        <license>
+          <name>Public Domain</name>
+        </license>
+      </licenses>
+      <purl>pkg:maven/org.tukaani/xz@1.9?type=jar</purl>
+      <modified>false</modified>
+      <externalReferences><reference type="vcs"><url>https://git.tukaani.org/?p=xz-java.git</url></reference></externalReferences>
     </component>
     <component type="library" bom-ref="pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.2?type=jar">
       <group>com.fasterxml.jackson.core</group>