Trivy often failing Maven dependency scanning

[devtobi]

Describe the bug
Due to API restrictions on Maven Central, dependency resolution for BOM or Parent POM managed dependencies does not work reliably. See aquasecurity/trivy#10853 for possible solutions.

Expected behavior
CVEs in Maven dependencies should be reliably detected.

• sbom als job artifact
• sbom mit trivy scannen

[hupling]

• sbom backen backend\target\classes\META-INF\sbom\application.cdx.json
• frondend \frontend\dist\application.cdx.json