2.7.6 is timing out

[rcfja]

$ mvn -B org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom

...

[INFO]
[INFO] --------------------< com.XXX >---------------------
[INFO] Building XXX 5.9.5-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ war ]---------------------------------
[INFO]
[INFO] --- cyclonedx:2.7.6:makeAggregateBom (default-cli) @ XXX  ---
[INFO] CycloneDX: Resolving Dependencies

And its just stuck at this point and never finishes and eventually my CI/CD times out on it after 30 mins.

If I downgrade to 2.7.5 it all works fine again. The generate only take 1 or 2 minutes to run.

Running on openjdk 1.8.0_362

[hboutemy]

thanks for your report: we'll need your help to try to find the root cause (@knrc , I suppose we'll need your help)
Are you able to share with us a reproducer project?

[knrc]

@hboutemy I came across something similar when developing the PR for #306. I managed to change the way component resolution worked to reduce a ~30 min aggregate down to around 2 mins, but it's in #306 .
I'll take a look at extracting those parts later this week. I'm traveling today (~25 hours) so it may take a day or two.

Can you assign this to me?

[knrc]

BTW I have a project where this is evident, so I don't think I need a reproducer

[knrc]

I've submitted PR #333 which should address the performance issue. Note this PR doesn't address the dependency graph problems which we were trying to fix in #306.