@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/cli/jvmBom.js

@@ -8,6 +8,11 @@ import { build } from "@cdxgen/cdx-purl";
 import { gte, lte } from "semver";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { commandOutputText, recordDegradation } from "../core/buildLedger.js";
+import {
+  deferFailOnError,
+  isDeferredFailOnError,
+} from "../core/deferredExit.js";
 import {
   hasAnyProjectType,
   includeMavenTestScope,
@@ -39,10 +44,13 @@ import {
   getGradleCommand,
   getMavenCommand,
   getMillCommand,
+  hasGradleInvocationFailure,
   parseGradleDep,
   parseGradleInfoLogsForUrls,
   parseGradleProperties,
   parseGradleResolvedDistributions,
+  parseGradleVersionCatalog,
+  recordGradleInvocationFailure,
   splitOutputByGradleProjects,
 } from "../ecosystems/gradleutils.js";
 import {
@@ -77,6 +85,7 @@ import {
   attachIdentityTools,
   extractToolRefs,
 } from "../inventory/evidenceUtils.js";
+import { readGradleWrapperVersion } from "../inventory/jvmToolEnv.js";
 import { applyPurl, mavenPurl } from "../inventory/purl.js";
 import {
   buildBomNSData,
@@ -263,7 +272,25 @@ export function discoverSbtProjectsFromCmd(basePath, sbtCmd, env) {
         "sbt projects command did not succeed. Falling back to heuristic project discovery.",
       );
     }
+    // Reached only when the sbt projects command did not yield usable
+    // subprojects; both success paths above returned early.
+    recordDegradation("jvm.sbt.project-discovery", {
+      ecosystem: "java",
+      tool: "sbt",
+      impact: "components",
+      command: `${basename(sbtCmd)} -batch -no-colors "projects"`,
+      detail:
+        "The sbt projects command did not yield usable project ids, so project discovery falls back to the build-file heuristic.",
+    });
   } catch (err) {
+    recordDegradation("jvm.sbt.project-discovery", {
+      ecosystem: "java",
+      tool: "sbt",
+      kind: "command.failed",
+      impact: "components",
+      command: `${basename(sbtCmd)} -batch -no-colors "projects"`,
+      detail: "The sbt projects command could not be executed.",
+    });
     if (DEBUG_MODE) {
       console.log("Unable to run sbt projects command.", err);
     }
@@ -291,269 +318,245 @@ export async function createJavaBom(path, options) {
   let tools;
   let possible_misses = false;
   let parallelPropTaskOut = "";
-  // war/ear mode
-  if (path.endsWith(".war") || path.endsWith(".jar")) {
-    // Check if the file exists
-    if (safeExistsSync(path)) {
-      if (DEBUG_MODE) {
-        console.log(`Retrieving packages from ${path}`);
-      }
-      const tempDir = safeMkdtempSync(join(getTmpDir(), "war-deps-"));
-      jarNSMapping = await collectJarNS(tempDir);
-      pkgList = await extractJarArchive(path, tempDir, jarNSMapping);
-      if (pkgList.length) {
-        pkgList = await getMvnMetadata(pkgList);
-      }
-      // Clean up
-      if (tempDir?.startsWith(getTmpDir())) {
-        console.log(`Cleaning up ${tempDir}`);
-        safeRmSync(tempDir, { recursive: true, force: true });
-      }
-    } else {
-      console.log(`${path} doesn't exist`);
-    }
-    return buildBomNSData(options, pkgList, "maven", {
-      src: dirname(path),
-      filename: path,
-      nsMapping: jarNSMapping,
-      dependencies,
-      parentComponent,
-    });
-  }
-  // -t quarkus is supported
-  let isQuarkus = options?.projectType?.includes("quarkus");
-  let useMavenDepsTree = isQuarkus ? false : PREFER_MAVEN_DEPS_TREE;
-  // Is this a multi-module project
-  let rootModules;
-  // maven - pom.xml
-  const pomFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}pom.xml`,
-    options,
-  );
-  // gradle
-  const gradleFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}build.gradle*`,
-    options,
-  );
-  // mill
-  const millFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}build.mill`,
-    options,
-  );
-  let bomJsonFiles = [];
-  if (
-    pomFiles?.length &&
-    isPackageManagerAllowed(
-      "maven",
-      ["bazel", "sbt", "gradle", "mill"],
-      options,
-    )
-  ) {
-    if (gradleFiles.length) {
-      thoughtLog(
-        `Is this a Gradle project? I recommend invoking cdxgen with the "-t gradle" option if you're encountering build errors.`,
-      );
-    }
-    if (!isQuarkus) {
-      // Quarkus projects require special treatment. To detect quarkus, we parse the first 3 maven file to look for a hit
-      for (const pf of pomFiles.slice(0, 3)) {
-        const pomMap = parsePom(pf);
-        if (!rootModules && pomMap?.modules?.length) {
-          rootModules = pomMap.modules;
+  try {
+    // war/ear mode
+    if (path.endsWith(".war") || path.endsWith(".jar")) {
+      // Check if the file exists
+      if (safeExistsSync(path)) {
+        if (DEBUG_MODE) {
+          console.log(`Retrieving packages from ${path}`);
+        }
+        const tempDir = safeMkdtempSync(join(getTmpDir(), "war-deps-"));
+        jarNSMapping = await collectJarNS(tempDir);
+        pkgList = await extractJarArchive(path, tempDir, jarNSMapping);
+        if (pkgList.length) {
+          pkgList = await getMvnMetadata(pkgList);
         }
-        // In quarkus mode, we cannot use the maven deps tree
-        if (pomMap.isQuarkus) {
-          isQuarkus = true;
-          useMavenDepsTree = false;
-          break;
+        // Clean up
+        if (tempDir?.startsWith(getTmpDir())) {
+          console.log(`Cleaning up ${tempDir}`);
+          safeRmSync(tempDir, { recursive: true, force: true });
         }
+      } else {
+        console.log(`${path} doesn't exist`);
       }
+      return buildBomNSData(options, pkgList, "maven", {
+        src: dirname(path),
+        filename: path,
+        nsMapping: jarNSMapping,
+        dependencies,
+        parentComponent,
+      });
     }
-    let result;
-    let mvnArgs;
-    // FIXME: How do we motivate everyone to upgrade to 1.7?
-    const toolsSpecVersion = 1.6;
-    if (isQuarkus) {
-      thoughtLog(
-        "This appears to be a Quarkus project. Let's use the right Maven plugin.",
-      );
-      // disable analytics. See: https://quarkus.io/usage/
-      mvnArgs = [
-        "-fn",
-        "quarkus:dependency-sbom",
-        "-Dquarkus.analytics.disabled=true",
-      ];
-      if (options.specVersion >= 1.6) {
-        mvnArgs = mvnArgs.concat(
-          `-Dquarkus.dependency.sbom.schema-version=${toolsSpecVersion}`,
+    // -t quarkus is supported
+    let isQuarkus = options?.projectType?.includes("quarkus");
+    let useMavenDepsTree = isQuarkus ? false : PREFER_MAVEN_DEPS_TREE;
+    // Is this a multi-module project
+    let rootModules;
+    // maven - pom.xml
+    const pomFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}pom.xml`,
+      options,
+    );
+    // gradle
+    const gradleFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}build.gradle*`,
+      options,
+    );
+    // mill
+    const millFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}build.mill`,
+      options,
+    );
+    let bomJsonFiles = [];
+    if (
+      pomFiles?.length &&
+      isPackageManagerAllowed(
+        "maven",
+        ["bazel", "sbt", "gradle", "mill"],
+        options,
+      )
+    ) {
+      if (gradleFiles.length) {
+        thoughtLog(
+          `Is this a Gradle project? I recommend invoking cdxgen with the "-t gradle" option if you're encountering build errors.`,
         );
       }
-    } else {
-      // FIXME: The last maven plugin release was on November 28th, 2024.
-      // Should we fork this repo and maintain it ourselves?
-      const cdxMavenPlugin =
-        readEnvironmentVariable("CDX_MAVEN_PLUGIN") ||
-        "org.cyclonedx:cyclonedx-maven-plugin:2.9.1";
-      const cdxMavenGoal =
-        readEnvironmentVariable("CDX_MAVEN_GOAL") || "makeAggregateBom";
-      mvnArgs = [
-        "-fn",
-        `${cdxMavenPlugin}:${cdxMavenGoal}`,
-        "-DoutputName=bom",
-      ];
-      if (includeMavenTestScope) {
-        mvnArgs.push("-DincludeTestScope=true");
-      }
-      // By using quiet mode we can reduce the maxBuffer used and avoid crashes
-      if (!DEBUG_MODE) {
-        mvnArgs.push("-q");
-      }
-      // Support for passing additional settings and profile to maven
-      if (readEnvironmentVariable("MVN_ARGS")) {
-        const addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
-        mvnArgs = mvnArgs.concat(addArgs);
-      }
-      // specVersion 1.4 doesn't support externalReferences.type=distribution-intake
-      // so we need to run the plugin with the correct version
-      if (options.specVersion >= 1.6) {
-        mvnArgs = mvnArgs.concat(`-DschemaVersion=${toolsSpecVersion}`);
-      } else if (options.specVersion > 1.4) {
-        mvnArgs = mvnArgs.concat(`-DschemaVersion=${options.specVersion}`);
-      }
-    }
-    const firstPom = pomFiles.length ? pomFiles[0] : undefined;
-    let mavenCmd = getMavenCommand(path, path);
-    for (const f of pomFiles) {
-      const basePath = dirname(f);
-      if (
-        isQuarkus &&
-        !options.deep &&
-        rootModules?.includes(basename(basePath))
-      ) {
-        if (DEBUG_MODE) {
-          console.log("Skipped sub-module", basePath);
+      if (!isQuarkus) {
+        // Quarkus projects require special treatment. To detect quarkus, we parse the first 3 maven file to look for a hit
+        for (const pf of pomFiles.slice(0, 3)) {
+          const pomMap = parsePom(pf);
+          if (!rootModules && pomMap?.modules?.length) {
+            rootModules = pomMap.modules;
+          }
+          // In quarkus mode, we cannot use the maven deps tree
+          if (pomMap.isQuarkus) {
+            isQuarkus = true;
+            useMavenDepsTree = false;
+            break;
+          }
         }
-        continue;
       }
-      const settingsXml = join(basePath, "settings.xml");
-      if (safeExistsSync(settingsXml)) {
-        console.log(
-          `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`,
-        );
-      }
-      if (mavenCmd?.endsWith("mvn")) {
-        mavenCmd = getMavenCommand(basePath, path);
-      }
-      // Should we attempt to resolve class names
-      if (options.resolveClass || options.deep) {
-        const tmpjarNSMapping = await collectMvnDependencies(
-          mavenCmd,
-          basePath,
-          true,
-          false,
+      let result;
+      let mvnArgs;
+      // FIXME: How do we motivate everyone to upgrade to 1.7?
+      const toolsSpecVersion = 1.6;
+      if (isQuarkus) {
+        thoughtLog(
+          "This appears to be a Quarkus project. Let's use the right Maven plugin.",
         );
-        if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
-          jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+        // disable analytics. See: https://quarkus.io/usage/
+        mvnArgs = [
+          "-fn",
+          "quarkus:dependency-sbom",
+          "-Dquarkus.analytics.disabled=true",
+        ];
+        if (options.specVersion >= 1.6) {
+          mvnArgs = mvnArgs.concat(
+            `-Dquarkus.dependency.sbom.schema-version=${toolsSpecVersion}`,
+          );
+        }
+      } else {
+        // FIXME: The last maven plugin release was on November 28th, 2024.
+        // Should we fork this repo and maintain it ourselves?
+        const cdxMavenPlugin =
+          readEnvironmentVariable("CDX_MAVEN_PLUGIN") ||
+          "org.cyclonedx:cyclonedx-maven-plugin:2.9.1";
+        const cdxMavenGoal =
+          readEnvironmentVariable("CDX_MAVEN_GOAL") || "makeAggregateBom";
+        mvnArgs = [
+          "-fn",
+          `${cdxMavenPlugin}:${cdxMavenGoal}`,
+          "-DoutputName=bom",
+        ];
+        if (includeMavenTestScope) {
+          mvnArgs.push("-DincludeTestScope=true");
+        }
+        // By using quiet mode we can reduce the maxBuffer used and avoid crashes
+        if (!DEBUG_MODE) {
+          mvnArgs.push("-q");
+        }
+        // Support for passing additional settings and profile to maven
+        if (readEnvironmentVariable("MVN_ARGS")) {
+          const addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
+          mvnArgs = mvnArgs.concat(addArgs);
+        }
+        // specVersion 1.4 doesn't support externalReferences.type=distribution-intake
+        // so we need to run the plugin with the correct version
+        if (options.specVersion >= 1.6) {
+          mvnArgs = mvnArgs.concat(`-DschemaVersion=${toolsSpecVersion}`);
+        } else if (options.specVersion > 1.4) {
+          mvnArgs = mvnArgs.concat(`-DschemaVersion=${options.specVersion}`);
         }
       }
-      // Use the cyclonedx maven plugin if there is no preference for maven deps tree
-      if (!useMavenDepsTree) {
-        thoughtLog("The user wants me to use the cyclonedx-maven plugin.");
-        console.log(`Executing '${mavenCmd}' in`, basePath);
-        result = safeSpawnSync(mavenCmd, mvnArgs, {
-          cwd: basePath,
-          shell: isWin,
-        });
-        // Check if the cyclonedx plugin created the required bom.json file
-        // Sometimes the plugin fails silently for complex maven projects
-        bomJsonFiles = getAllFiles(
-          path,
-          "**/target/*{cdx,bom,cyclonedx}*.json",
-          options,
-        );
-        // Check if the bom json files got created in a directory other than target
-        if (!bomJsonFiles.length) {
+      const firstPom = pomFiles.length ? pomFiles[0] : undefined;
+      let mavenCmd = getMavenCommand(path, path);
+      for (const f of pomFiles) {
+        const basePath = dirname(f);
+        if (
+          isQuarkus &&
+          !options.deep &&
+          rootModules?.includes(basename(basePath))
+        ) {
+          if (DEBUG_MODE) {
+            console.log("Skipped sub-module", basePath);
+          }
+          continue;
+        }
+        const settingsXml = join(basePath, "settings.xml");
+        if (safeExistsSync(settingsXml)) {
+          console.log(
+            `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`,
+          );
+        }
+        if (mavenCmd?.endsWith("mvn")) {
+          mavenCmd = getMavenCommand(basePath, path);
+        }
+        // Should we attempt to resolve class names
+        if (options.resolveClass || options.deep) {
+          const tmpjarNSMapping = await collectMvnDependencies(
+            mavenCmd,
+            basePath,
+            true,
+            false,
+          );
+          if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+            jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+          }
+        }
+        // Use the cyclonedx maven plugin if there is no preference for maven deps tree
+        if (!useMavenDepsTree) {
+          thoughtLog("The user wants me to use the cyclonedx-maven plugin.");
+          console.log(`Executing '${mavenCmd}' in`, basePath);
+          result = safeSpawnSync(mavenCmd, mvnArgs, {
+            cwd: basePath,
+            shell: isWin,
+          });
+          // Check if the cyclonedx plugin created the required bom.json file
+          // Sometimes the plugin fails silently for complex maven projects
           bomJsonFiles = getAllFiles(
             path,
-            "target/**/*{cdx,bom,cyclonedx}*.json",
+            "**/target/*{cdx,bom,cyclonedx}*.json",
             options,
           );
-        }
-      }
-      // Also check if the user has a preference for maven deps tree command
-      if (
-        useMavenDepsTree ||
-        !bomJsonFiles.length ||
-        result?.status !== 0 ||
-        result?.error
-      ) {
-        const tempRoot = getTmpDir();
-        const tempDir = safeMkdtempSync(join(tempRoot, "cdxgen-mvn-"));
-        const tempMvnTree = join(tempDir, "cdxgen-mvn-tree.json");
-        const tempMvnTreeText = join(tempDir, "cdxgen-mvn-tree.txt");
-        const tempMvnParentTree = join(tempDir, "cdxgen-mvn-parent-tree.json");
-        const tempMvnParentTreeText = join(
-          tempDir,
-          "cdxgen-mvn-parent-tree.txt",
-        );
-        try {
-          let mvnTreeArgs = [
-            "dependency:tree",
-            `-DoutputFile=${tempMvnTree}`,
-            "-DoutputType=json",
-          ];
-          let addArgs = [];
-          if (readEnvironmentVariable("MVN_ARGS")) {
-            addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
-            mvnTreeArgs = mvnTreeArgs.concat(addArgs);
-          }
-          // Automatically use settings.xml to improve the success for fallback
-          if (safeExistsSync(settingsXml)) {
-            mvnTreeArgs.push("-s");
-            mvnTreeArgs.push(settingsXml);
-          }
-          // For the first pom alone, we need to execute first in non-recursive mode to capture
-          // the parent component. Then, we execute all of them in recursive mode
-          if (f === firstPom) {
-            thoughtLog(
-              "What is the parent component here? Let's use maven command to find out.",
+          // Check if the bom json files got created in a directory other than target
+          if (!bomJsonFiles.length) {
+            bomJsonFiles = getAllFiles(
+              path,
+              "target/**/*{cdx,bom,cyclonedx}*.json",
+              options,
             );
-            let findParentComponentArgs = [
+          }
+        }
+        // Also check if the user has a preference for maven deps tree command
+        if (
+          useMavenDepsTree ||
+          !bomJsonFiles.length ||
+          result?.status !== 0 ||
+          result?.error
+        ) {
+          const tempRoot = getTmpDir();
+          const tempDir = safeMkdtempSync(join(tempRoot, "cdxgen-mvn-"));
+          const tempMvnTree = join(tempDir, "cdxgen-mvn-tree.json");
+          const tempMvnTreeText = join(tempDir, "cdxgen-mvn-tree.txt");
+          const tempMvnParentTree = join(
+            tempDir,
+            "cdxgen-mvn-parent-tree.json",
+          );
+          const tempMvnParentTreeText = join(
+            tempDir,
+            "cdxgen-mvn-parent-tree.txt",
+          );
+          try {
+            let mvnTreeArgs = [
               "dependency:tree",
-              "-N",
-              `-DoutputFile=${tempMvnParentTree}`,
+              `-DoutputFile=${tempMvnTree}`,
               "-DoutputType=json",
             ];
-            if (addArgs.length) {
-              findParentComponentArgs = findParentComponentArgs.concat(addArgs);
+            let addArgs = [];
+            if (readEnvironmentVariable("MVN_ARGS")) {
+              addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
+              mvnTreeArgs = mvnTreeArgs.concat(addArgs);
             }
-            result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
-              cwd: basePath,
-              shell: isWin,
-            });
-            // If json is empty or unparseable, fallback to text parsing
-            let emptyJson = !safeExistsSync(tempMvnParentTree);
-            if (safeExistsSync(tempMvnParentTree)) {
-              const mvnTreeString = readFileSync(tempMvnParentTree, {
-                encoding: "utf-8",
-              });
-              const parsedList = parseMavenTreeJson(mvnTreeString, f);
-              if (!parsedList?.pkgList?.length) {
-                emptyJson = true;
-                // Remove the invalid json file so text output is preferred below.
-                if (safeExistsSync(tempMvnParentTree)) {
-                  safeUnlinkSync(tempMvnParentTree);
-                }
-              }
+            // Automatically use settings.xml to improve the success for fallback
+            if (safeExistsSync(settingsXml)) {
+              mvnTreeArgs.push("-s");
+              mvnTreeArgs.push(settingsXml);
             }
-            if (result.status !== 0 || result.error || emptyJson) {
-              findParentComponentArgs = [
+            // For the first pom alone, we need to execute first in non-recursive mode to capture
+            // the parent component. Then, we execute all of them in recursive mode
+            if (f === firstPom) {
+              thoughtLog(
+                "What is the parent component here? Let's use maven command to find out.",
+              );
+              let findParentComponentArgs = [
                 "dependency:tree",
                 "-N",
-                `-DoutputFile=${tempMvnParentTreeText}`,
+                `-DoutputFile=${tempMvnParentTree}`,
+                "-DoutputType=json",
               ];
               if (addArgs.length) {
                 findParentComponentArgs =
@@ -563,349 +566,407 @@ export async function createJavaBom(path, options) {
                 cwd: basePath,
                 shell: isWin,
               });
-            }
-            if (result.status === 0) {
-              const parentTreeFile = safeExistsSync(tempMvnParentTreeText)
-                ? tempMvnParentTreeText
-                : tempMvnParentTree;
-              if (safeExistsSync(parentTreeFile)) {
-                const mvnTreeString = readFileSync(parentTreeFile, {
+              // If json is empty or unparseable, fallback to text parsing
+              let emptyJson = !safeExistsSync(tempMvnParentTree);
+              if (safeExistsSync(tempMvnParentTree)) {
+                const mvnTreeString = readFileSync(tempMvnParentTree, {
                   encoding: "utf-8",
                 });
-                const parsedList = parentTreeFile.endsWith(".json")
-                  ? parseMavenTreeJson(mvnTreeString, f)
-                  : parseMavenTree(mvnTreeString, f);
-                const dlist = parsedList.pkgList || [];
-                if (dlist.length) {
-                  const tmpParentComponent = dlist.splice(0, 1)[0];
-                  tmpParentComponent.type = "application";
-                  parentComponent = tmpParentComponent;
-                  parentComponent.components = [];
-                  if (parentComponent.name) {
-                    thoughtLog(
-                      `Parent component is called ${parentComponent.name}!`,
-                    );
+                const parsedList = parseMavenTreeJson(mvnTreeString, f);
+                if (!parsedList?.pkgList?.length) {
+                  emptyJson = true;
+                  // Remove the invalid json file so text output is preferred below.
+                  if (safeExistsSync(tempMvnParentTree)) {
+                    safeUnlinkSync(tempMvnParentTree);
                   }
                 }
               }
-            }
-          }
-          thoughtLog(
-            `**MAVEN**: Let's use Maven to collect packages from ${basePath}.`,
-          );
-          if (DEBUG_MODE) {
-            console.log(
-              `Executing '${basename(mavenCmd)} dependency:tree ...' in ${basePath}`,
-            );
-          }
-          result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
-            cwd: basePath,
-            shell: isWin,
-          });
-          let emptyJson = !safeExistsSync(tempMvnTree);
-          if (safeExistsSync(tempMvnTree)) {
-            const mvnTreeString = readFileSync(tempMvnTree, {
-              encoding: "utf-8",
-            });
-            const parsedList = parseMavenTreeJson(mvnTreeString, f);
-            if (!parsedList?.pkgList?.length) {
-              emptyJson = true;
-              // Remove the invalid json file so text output is preferred below.
-              if (safeExistsSync(tempMvnTree)) {
-                safeUnlinkSync(tempMvnTree);
+              if (result.status !== 0 || result.error || emptyJson) {
+                findParentComponentArgs = [
+                  "dependency:tree",
+                  "-N",
+                  `-DoutputFile=${tempMvnParentTreeText}`,
+                ];
+                if (addArgs.length) {
+                  findParentComponentArgs =
+                    findParentComponentArgs.concat(addArgs);
+                }
+                result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
+                  cwd: basePath,
+                  shell: isWin,
+                });
+              }
+              if (result.status === 0) {
+                const parentTreeFile = safeExistsSync(tempMvnParentTreeText)
+                  ? tempMvnParentTreeText
+                  : tempMvnParentTree;
+                if (safeExistsSync(parentTreeFile)) {
+                  const mvnTreeString = readFileSync(parentTreeFile, {
+                    encoding: "utf-8",
+                  });
+                  const parsedList = parentTreeFile.endsWith(".json")
+                    ? parseMavenTreeJson(mvnTreeString, f)
+                    : parseMavenTree(mvnTreeString, f);
+                  const dlist = parsedList.pkgList || [];
+                  if (dlist.length) {
+                    const tmpParentComponent = dlist.splice(0, 1)[0];
+                    tmpParentComponent.type = "application";
+                    parentComponent = tmpParentComponent;
+                    parentComponent.components = [];
+                    if (parentComponent.name) {
+                      thoughtLog(
+                        `Parent component is called ${parentComponent.name}!`,
+                      );
+                    }
+                  }
+                }
               }
             }
-          }
-          if (result.status !== 0 || result.error || emptyJson) {
-            mvnTreeArgs = [
-              "dependency:tree",
-              `-DoutputFile=${tempMvnTreeText}`,
-            ];
-            if (addArgs.length) {
-              mvnTreeArgs = mvnTreeArgs.concat(addArgs);
-            }
-            if (safeExistsSync(settingsXml)) {
-              mvnTreeArgs.push("-s");
-              mvnTreeArgs.push(settingsXml);
+            thoughtLog(
+              `**MAVEN**: Let's use Maven to collect packages from ${basePath}.`,
+            );
+            if (DEBUG_MODE) {
+              console.log(
+                `Executing '${basename(mavenCmd)} dependency:tree ...' in ${basePath}`,
+              );
             }
             result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
               cwd: basePath,
               shell: isWin,
             });
-          }
-          if (result.status !== 0 || result.error) {
-            possible_misses = true;
-            // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
-            // These could be due to a range of reasons that are covered below.
-            if (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE) {
-              if (result.stdout) {
-                console.log(result.stdout);
+            let emptyJson = !safeExistsSync(tempMvnTree);
+            if (safeExistsSync(tempMvnTree)) {
+              const mvnTreeString = readFileSync(tempMvnTree, {
+                encoding: "utf-8",
+              });
+              const parsedList = parseMavenTreeJson(mvnTreeString, f);
+              if (!parsedList?.pkgList?.length) {
+                emptyJson = true;
+                // Remove the invalid json file so text output is preferred below.
+                if (safeExistsSync(tempMvnTree)) {
+                  safeUnlinkSync(tempMvnTree);
+                }
+              }
+            }
+            if (result.status !== 0 || result.error || emptyJson) {
+              mvnTreeArgs = [
+                "dependency:tree",
+                `-DoutputFile=${tempMvnTreeText}`,
+              ];
+              if (addArgs.length) {
+                mvnTreeArgs = mvnTreeArgs.concat(addArgs);
               }
-              if (result.stderr) {
-                console.log(result.stderr);
-                console.log("The above build errors could be due to:\n");
+              if (safeExistsSync(settingsXml)) {
+                mvnTreeArgs.push("-s");
+                mvnTreeArgs.push(settingsXml);
               }
+              result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
+                cwd: basePath,
+                shell: isWin,
+              });
+            }
+            if (result.status !== 0 || result.error) {
+              possible_misses = true;
+              // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
+              // These could be due to a range of reasons that are covered below.
               if (
-                result.stdout &&
-                (result.stdout.includes("Non-resolvable parent POM") ||
-                  result.stdout.includes("points at wrong local POM"))
-              ) {
-                console.log(
-                  "1. Check if the pom.xml contains valid settings for parent and modules. Some projects can be built only from a specific directory.",
-                );
-              } else if (
-                result.stdout &&
-                (result.stdout.includes("Could not resolve dependencies") ||
-                  result.stdout.includes(
-                    "no dependency information available",
-                  ) ||
-                  result.stdout.includes(
-                    "The following artifacts could not be resolved",
-                  ))
-              ) {
-                console.log(
-                  "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
-                );
-              } else if (
-                result.stdout?.includes(
-                  "Could not resolve target platform specification",
-                )
+                pomFiles.length === 1 ||
+                DEBUG_MODE ||
+                PREFER_MAVEN_DEPS_TREE
               ) {
+                if (result.stdout) {
+                  console.log(result.stdout);
+                }
+                if (result.stderr) {
+                  console.log(result.stderr);
+                  console.log("The above build errors could be due to:\n");
+                }
+                if (
+                  result.stdout &&
+                  (result.stdout.includes("Non-resolvable parent POM") ||
+                    result.stdout.includes("points at wrong local POM"))
+                ) {
+                  console.log(
+                    "1. Check if the pom.xml contains valid settings for parent and modules. Some projects can be built only from a specific directory.",
+                  );
+                } else if (
+                  result.stdout &&
+                  (result.stdout.includes("Could not resolve dependencies") ||
+                    result.stdout.includes(
+                      "no dependency information available",
+                    ) ||
+                    result.stdout.includes(
+                      "The following artifacts could not be resolved",
+                    ))
+                ) {
+                  recordDegradation("jvm.maven.build-first", {
+                    ecosystem: "java",
+                    tool: "maven",
+                    impact: "transitive-deps",
+                    command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
+                    exitCode:
+                      typeof result.status === "number"
+                        ? result.status
+                        : undefined,
+                    detail:
+                      "Maven could not resolve the project dependencies, so the dependency tree is incomplete.",
+                    outputExcerpt: commandOutputText(result),
+                  });
+                  console.log(
+                    "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
+                  );
+                } else if (
+                  result.stdout?.includes(
+                    "Could not resolve target platform specification",
+                  )
+                ) {
+                  console.log(
+                    "1. Some projects can be built only from the root directory. Invoke cdxgen with --no-recurse option",
+                  );
+                } else {
+                  console.log(
+                    "1. Java version requirement: cdxgen container image bundles Java 24 with maven 3.9 which might be incompatible. Try running cdxgen with the custom JDK11-based image `ghcr.io/cdxgen/cdxgen-java11:v13`.",
+                  );
+                }
                 console.log(
-                  "1. Some projects can be built only from the root directory. Invoke cdxgen with --no-recurse option",
+                  "2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.",
                 );
-              } else {
                 console.log(
-                  "1. Java version requirement: cdxgen container image bundles Java 24 with maven 3.9 which might be incompatible. Try running cdxgen with the custom JDK11-based image `ghcr.io/cdxgen/cdxgen-java11:v13`.",
+                  "3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.",
                 );
               }
+              // The degradation is recorded before the fail-on-error handling
+              // below, so the run that stops here still reports why maven
+              // failed and what fixes it.
+              recordDegradation("jvm.maven.manifest-fallback", {
+                ecosystem: "java",
+                tool: "maven",
+                impact: "transitive-deps",
+                command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
+                exitCode:
+                  typeof result.status === "number" ? result.status : undefined,
+                detail:
+                  "The maven dependency tree did not succeed, so at best the direct dependencies parsed from pom.xml are available.",
+                outputExcerpt: commandOutputText(result),
+              });
+              // Do not fall back to methods that can produce incomplete results when failOnError is set
+              deferFailOnError(options, {
+                ecosystem: "java",
+                tool: "maven",
+                exitCode:
+                  typeof result.status === "number" ? result.status : undefined,
+                command: `${mavenCmd} ${mvnTreeArgs.join(" ")}`,
+                outputExcerpt: commandOutputText(result),
+                detail: "the maven dependency tree command failed",
+              });
               console.log(
-                "2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.",
+                "\nFalling back to parsing pom.xml files. Only direct dependencies would get included!",
               );
-              console.log(
-                "3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.",
+              thoughtLog(
+                "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
               );
-            }
-            // Do not fall back to methods that can produce incomplete results when failOnError is set
-            options.failOnError && process.exit(1);
-            console.log(
-              "\nFalling back to parsing pom.xml files. Only direct dependencies would get included!",
-            );
-            thoughtLog(
-              "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
-            );
-            const pomMap = parsePom(f);
-            const dlist = pomMap?.dependencies || [];
-            if (dlist.length) {
-              pkgList = pkgList.concat(dlist);
-            }
-          } else {
-            const treeFile = safeExistsSync(tempMvnTreeText)
-              ? tempMvnTreeText
-              : tempMvnTree;
-            if (safeExistsSync(treeFile)) {
-              const mvnTreeString = readFileSync(treeFile, {
-                encoding: "utf-8",
-              });
-              const parsedList = treeFile.endsWith(".json")
-                ? parseMavenTreeJson(mvnTreeString, f)
-                : parseMavenTree(mvnTreeString, f);
-              const dlist = parsedList.pkgList || [];
-              const tmpParentComponent = dlist.splice(0, 1)[0];
-              if (tmpParentComponent) {
-                tmpParentComponent.type = "application";
-              }
+              const pomMap = parsePom(f);
+              const dlist = pomMap?.dependencies || [];
               if (dlist.length) {
                 pkgList = pkgList.concat(dlist);
-                if (dlist.length > 1) {
-                  thoughtLog(`Obtained ${dlist.length} components from maven.`);
-                } else {
+              }
+            } else {
+              const treeFile = safeExistsSync(tempMvnTreeText)
+                ? tempMvnTreeText
+                : tempMvnTree;
+              if (safeExistsSync(treeFile)) {
+                const mvnTreeString = readFileSync(treeFile, {
+                  encoding: "utf-8",
+                });
+                const parsedList = treeFile.endsWith(".json")
+                  ? parseMavenTreeJson(mvnTreeString, f)
+                  : parseMavenTree(mvnTreeString, f);
+                const dlist = parsedList.pkgList || [];
+                const tmpParentComponent = dlist.splice(0, 1)[0];
+                if (tmpParentComponent) {
+                  tmpParentComponent.type = "application";
+                }
+                if (dlist.length) {
+                  pkgList = pkgList.concat(dlist);
+                  if (dlist.length > 1) {
+                    thoughtLog(
+                      `Obtained ${dlist.length} components from maven.`,
+                    );
+                  } else {
+                    thoughtLog(
+                      `"Received very few components from the maven dependency tree command for ${basePath}."`,
+                    );
+                  }
+                }
+                // Retain the parent hierarchy
+                if (!tmpParentComponent) {
                   thoughtLog(
-                    `"Received very few components from the maven dependency tree command for ${basePath}."`,
+                    `No parseable components were found after executing '${basename(mavenCmd)}'.`,
                   );
+                } else if (!Object.keys(parentComponent).length) {
+                  parentComponent = tmpParentComponent;
+                  parentComponent.components = [];
+                } else {
+                  parentComponent.components.push(tmpParentComponent);
                 }
-              }
-              // Retain the parent hierarchy
-              if (!tmpParentComponent) {
-                thoughtLog(
-                  `No parseable components were found after executing '${basename(mavenCmd)}'.`,
-                );
-              } else if (!Object.keys(parentComponent).length) {
-                parentComponent = tmpParentComponent;
-                parentComponent.components = [];
-              } else {
-                parentComponent.components.push(tmpParentComponent);
-              }
-              if (parsedList?.dependenciesList?.length) {
-                dependencies = mergeDependencies(
-                  dependencies,
-                  parsedList.dependenciesList,
-                  tmpParentComponent,
-                );
-              } else {
-                if (dlist?.length) {
-                  thoughtLog(
-                    `Hmm, I didn't find any dependencies after executing '${basename(mavenCmd)}'. However, I did get ${dlist.length} components, which is confusing.`,
+                if (parsedList?.dependenciesList?.length) {
+                  dependencies = mergeDependencies(
+                    dependencies,
+                    parsedList.dependenciesList,
+                    tmpParentComponent,
                   );
+                } else {
+                  if (dlist?.length) {
+                    thoughtLog(
+                      `Hmm, I didn't find any dependencies after executing '${basename(mavenCmd)}'. However, I did get ${dlist.length} components, which is confusing.`,
+                    );
+                  }
                 }
               }
             }
-          }
-        } finally {
-          if (!DEBUG_MODE && tempDir?.startsWith(tempRoot)) {
-            safeRmSync(tempDir, { recursive: true, force: true });
+          } finally {
+            if (!DEBUG_MODE && tempDir?.startsWith(tempRoot)) {
+              safeRmSync(tempDir, { recursive: true, force: true });
+            }
           }
         }
-      }
-    } // for
-    // Locate and parse all bom.json files from the maven plugin
-    if (!useMavenDepsTree) {
-      for (const abjson of bomJsonFiles) {
-        let bomJsonObj;
-        try {
-          if (DEBUG_MODE) {
-            console.log(`Extracting data from generated bom file ${abjson}`);
-          }
-          bomJsonObj = JSON.parse(
-            readFileSync(abjson, {
-              encoding: "utf-8",
-            }),
-          );
-          if (bomJsonObj) {
-            if (
-              !tools &&
-              bomJsonObj.metadata &&
-              bomJsonObj.metadata.tools &&
-              (Array.isArray(bomJsonObj.metadata.tools) ||
-                bomJsonObj.metadata.tools.components ||
-                bomJsonObj.metadata.tools.services)
-            ) {
-              tools = bomJsonObj.metadata.tools;
+      } // for
+      // Locate and parse all bom.json files from the maven plugin
+      if (!useMavenDepsTree) {
+        for (const abjson of bomJsonFiles) {
+          let bomJsonObj;
+          try {
+            if (DEBUG_MODE) {
+              console.log(`Extracting data from generated bom file ${abjson}`);
             }
-            const toolRefs = extractToolRefs(
-              bomJsonObj?.metadata?.tools,
-              (tool) => tool?.name !== "cdxgen",
+            bomJsonObj = JSON.parse(
+              readFileSync(abjson, {
+                encoding: "utf-8",
+              }),
             );
-            if (
-              bomJsonObj.metadata?.component &&
-              !Object.keys(parentComponent).length
-            ) {
-              parentComponent = bomJsonObj.metadata.component;
-              options.parentComponent = parentComponent;
-            }
-            if (bomJsonObj.components) {
-              // Inject evidence into the components. #994
-              if (options.specVersion >= 1.5) {
-                // maven would usually generate a target directory closest to the pom.xml
-                // I am sure there would be cases where this assumption is not true :)
-                const srcPomFile = join(dirname(abjson), "..", "pom.xml");
-                for (const acomp of bomJsonObj.components) {
-                  if (!acomp.evidence) {
-                    acomp.evidence = {
-                      identity: {
-                        field: "purl",
-                        confidence: 0.8,
-                        methods: [
-                          {
-                            technique: "manifest-analysis",
-                            confidence: 0.8,
-                            value: srcPomFile,
-                          },
-                        ],
-                      },
-                    };
-                  }
-                  if (!acomp.properties) {
-                    acomp.properties = [];
+            if (bomJsonObj) {
+              if (
+                !tools &&
+                bomJsonObj.metadata &&
+                bomJsonObj.metadata.tools &&
+                (Array.isArray(bomJsonObj.metadata.tools) ||
+                  bomJsonObj.metadata.tools.components ||
+                  bomJsonObj.metadata.tools.services)
+              ) {
+                tools = bomJsonObj.metadata.tools;
+              }
+              const toolRefs = extractToolRefs(
+                bomJsonObj?.metadata?.tools,
+                (tool) => tool?.name !== "cdxgen",
+              );
+              if (
+                bomJsonObj.metadata?.component &&
+                !Object.keys(parentComponent).length
+              ) {
+                parentComponent = bomJsonObj.metadata.component;
+                options.parentComponent = parentComponent;
+              }
+              if (bomJsonObj.components) {
+                // Inject evidence into the components. #994
+                if (options.specVersion >= 1.5) {
+                  // maven would usually generate a target directory closest to the pom.xml
+                  // I am sure there would be cases where this assumption is not true :)
+                  const srcPomFile = join(dirname(abjson), "..", "pom.xml");
+                  for (const acomp of bomJsonObj.components) {
+                    if (!acomp.evidence) {
+                      acomp.evidence = {
+                        identity: {
+                          field: "purl",
+                          confidence: 0.8,
+                          methods: [
+                            {
+                              technique: "manifest-analysis",
+                              confidence: 0.8,
+                              value: srcPomFile,
+                            },
+                          ],
+                        },
+                      };
+                    }
+                    if (!acomp.properties) {
+                      acomp.properties = [];
+                    }
+                    acomp.properties.push({
+                      name: "internal:SrcFile",
+                      value: srcPomFile,
+                    });
+                    attachIdentityTools(acomp, toolRefs);
                   }
-                  acomp.properties.push({
-                    name: "internal:SrcFile",
-                    value: srcPomFile,
-                  });
-                  attachIdentityTools(acomp, toolRefs);
                 }
+                pkgList = pkgList.concat(bomJsonObj.components);
+              }
+              if (bomJsonObj.dependencies) {
+                dependencies = mergeDependencies(
+                  dependencies,
+                  bomJsonObj.dependencies,
+                  parentComponent,
+                );
               }
-              pkgList = pkgList.concat(bomJsonObj.components);
             }
-            if (bomJsonObj.dependencies) {
-              dependencies = mergeDependencies(
-                dependencies,
-                bomJsonObj.dependencies,
-                parentComponent,
-              );
+          } catch (err) {
+            if (options.failOnError || DEBUG_MODE) {
+              console.log(err);
             }
-          }
-        } catch (err) {
-          if (options.failOnError || DEBUG_MODE) {
-            console.log(err);
-            options.failOnError && process.exit(1);
+            deferFailOnError(options, {
+              ecosystem: "java",
+              tool: "maven",
+              detail:
+                "reading the BOM generated by the cyclonedx maven plugin failed",
+            });
           }
         }
       }
-    }
-    if (possible_misses) {
-      if (gradleFiles.length) {
-        console.log(
-          "Is this a gradle project? Try running cdxgen with `-t gradle`.",
-        );
-      } else if (!DEBUG_MODE) {
-        console.warn(
-          "Multiple errors occurred while building this project with maven. The SBOM is therefore incomplete!",
-        );
+      if (possible_misses) {
+        if (gradleFiles.length) {
+          console.log(
+            "Is this a gradle project? Try running cdxgen with `-t gradle`.",
+          );
+        } else if (!DEBUG_MODE) {
+          console.warn(
+            "Multiple errors occurred while building this project with maven. The SBOM is therefore incomplete!",
+          );
+        }
       }
     }
-  }
-  const allProjects = [];
-  const allProjectsAddedPurls = [];
-  const rootDependsOn = new Set();
-  const gradleModules = new Map();
-  // Determine the root path for gradle
-  // Fixes gradle invocation for microservices-demo
-  let gradleRootPath = path;
-  if (
-    gradleFiles?.length &&
-    !safeExistsSync(join(path, "settings.gradle")) &&
-    !safeExistsSync(join(path, "settings.gradle.kts")) &&
-    !safeExistsSync(join(path, "build.gradle")) &&
-    !safeExistsSync(join(path, "build.gradle.kts"))
-  ) {
-    gradleRootPath = dirname(gradleFiles[0]);
-  }
-  if (safeExistsSync(join(gradleRootPath, "gradle.properties"))) {
-    thoughtLog(
-      "Hmm, there is a gradle.properties file. Do we need any private modules or custom JVM arguments for this project 🤔?",
-    );
-  }
-  // Execute gradle properties
-  if (
-    gradleFiles?.length &&
-    isPackageManagerAllowed(
-      "gradle",
-      ["maven", "bazel", "sbt", "mill"],
-      options,
-    )
-  ) {
-    const wrapperPropPath = join(
-      gradleRootPath,
-      "gradle",
-      "wrapper",
-      "gradle-wrapper.properties",
-    );
-    if (safeExistsSync(wrapperPropPath)) {
-      try {
-        const propContent = readFileSync(wrapperPropPath, "utf-8");
-        const distUrlLine = propContent
-          .split("\n")
-          .find((l) => l.startsWith("distributionUrl="));
-        if (distUrlLine) {
-          const distributionUrl = distUrlLine
-            .split("=")[1]
-            .trim()
-            .replace(/\\:/g, ":");
-          const versionMatch = distributionUrl.match(
-            /gradle-(.*?)-(bin|all)\.zip/,
-          );
-          const gradleVersion = versionMatch ? versionMatch[1] : "unknown";
+    const allProjects = [];
+    const allProjectsAddedPurls = [];
+    const rootDependsOn = new Set();
+    const gradleModules = new Map();
+    // Determine the root path for gradle
+    // Fixes gradle invocation for microservices-demo
+    let gradleRootPath = path;
+    if (
+      gradleFiles?.length &&
+      !safeExistsSync(join(path, "settings.gradle")) &&
+      !safeExistsSync(join(path, "settings.gradle.kts")) &&
+      !safeExistsSync(join(path, "build.gradle")) &&
+      !safeExistsSync(join(path, "build.gradle.kts"))
+    ) {
+      gradleRootPath = dirname(gradleFiles[0]);
+    }
+    if (safeExistsSync(join(gradleRootPath, "gradle.properties"))) {
+      thoughtLog(
+        "Hmm, there is a gradle.properties file. Do we need any private modules or custom JVM arguments for this project 🤔?",
+      );
+    }
+    // Execute gradle properties
+    if (
+      gradleFiles?.length &&
+      isPackageManagerAllowed(
+        "gradle",
+        ["maven", "bazel", "sbt", "mill"],
+        options,
+      )
+    ) {
+      const wrapperInfo = readGradleWrapperVersion(gradleRootPath);
+      if (wrapperInfo) {
+        try {
+          const { version: gradleVersion, distributionUrl } = wrapperInfo;
           thoughtLog(
             `Found Gradle wrapper with distributionUrl: ${distributionUrl}, version: ${gradleVersion}`,
           );
@@ -921,20 +982,14 @@ export async function createJavaBom(path, options) {
             }
           }
           if (!toolsArr.find((c) => c.name === "gradle")) {
-            const distShaLine = propContent
-              .split("\n")
-              .find((l) => l.startsWith("distributionSha256Sum="));
             let hashes;
-            if (distShaLine) {
-              const sha256Sum = distShaLine.split("=")[1].trim();
-              if (sha256Sum) {
-                hashes = [
-                  {
-                    alg: "SHA-256",
-                    content: sha256Sum,
-                  },
-                ];
-              }
+            if (wrapperInfo.distributionSha256Sum) {
+              hashes = [
+                {
+                  alg: "SHA-256",
+                  content: wrapperInfo.distributionSha256Sum,
+                },
+              ];
             }
             const gradleComponent = {
               type: "application",
@@ -965,875 +1020,935 @@ export async function createJavaBom(path, options) {
           } else {
             tools.components = toolsArr;
           }
+        } catch (_err) {
+          // ignore
         }
-      } catch (_err) {
-        // ignore
-      }
-    }
-    let includedBuilds = [];
-    let allProjectsStr = [];
-    if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")) {
-      includedBuilds = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
-        .split(",")
-        .map((b) => (!b.startsWith(":") ? `:${b}` : b));
-    }
-    const resolveGradleDistribution = isFeatureEnabled(
-      options,
-      "resolve-gradle-distribution",
-    );
-    const gradleInitArgs = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
-      ? []
-      : ["--init-script", GRADLE_INIT_SCRIPT];
-    if (resolveGradleDistribution && gradleInitArgs.length) {
-      gradleInitArgs.push("-PcdxgenResolveDistribution=true");
-    }
-    parallelPropTaskOut = executeParallelGradleProperties(
-      gradleRootPath,
-      [null].concat(includedBuilds),
-      gradleInitArgs,
-    );
-    if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
-      const outputLines = parallelPropTaskOut.split("\n");
-      for (const [_i, line] of outputLines.entries()) {
-        if (line.startsWith("Root project '") || line.startsWith("Project '")) {
-          break;
-        }
-        if (line.startsWith("<CDXGEN:includedBuild>")) {
-          const includedBuild = line.split(">");
-          if (!includedBuilds.includes(includedBuild[1].trim())) {
-            includedBuilds.push(includedBuild[1].trim());
-          }
-        }
-      }
-      if (includedBuilds.length > 0) {
-        thoughtLog(
-          `Wait, this gradle project uses composite builds. I must carefully process these ${includedBuilds.length} projects, in addition to the root.`,
-        );
-        if (DEBUG_MODE) {
-          console.log(`Composite builds: ${includedBuilds.join(" ").trim()}.`);
-        }
-        parallelPropTaskOut = parallelPropTaskOut.concat(
-          "\n",
-          executeParallelGradleProperties(gradleRootPath, includedBuilds),
-        );
       }
-    }
-    const splitPropTaskOut = splitOutputByGradleProjects(parallelPropTaskOut, [
-      "properties",
-    ]);
-    for (const [key, propTaskOut] of splitPropTaskOut.entries()) {
-      const retMap = parseGradleProperties(propTaskOut);
-      const rootProject = retMap.rootProject;
-      if (rootProject) {
-        const rootComponent = await buildObjectForGradleModule(
-          rootProject,
-          retMap.metadata,
-        );
-        if (!includedBuilds.includes(key)) {
-          parentComponent = rootComponent;
-        }
-        gradleModules.set(key, rootComponent);
-        if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
-          allProjects.push(rootComponent);
-          rootDependsOn.add(rootComponent["bom-ref"]);
-          allProjectsAddedPurls.push(rootComponent["purl"]);
-        }
-        allProjectsStr = allProjectsStr.concat(retMap.projects);
+      let includedBuilds = [];
+      let allProjectsStr = [];
+      if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")) {
+        includedBuilds = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
+          .split(",")
+          .map((b) => (!b.startsWith(":") ? `:${b}` : b));
       }
-    }
-    // Get the sub-project properties and set the root dependencies
-    if (allProjectsStr?.length) {
-      const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
-        ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
-        : [];
-      if (modulesToSkip.length) {
-        thoughtLog(
-          `Good news. I know there are ${allProjectsStr.length} gradle modules at ${gradleRootPath}. I must skip ${modulesToSkip.length} out of these.`,
-        );
+      const resolveGradleDistribution = isFeatureEnabled(
+        options,
+        "resolve-gradle-distribution",
+      );
+      const gradleInitArgs = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
+        ? []
+        : ["--init-script", GRADLE_INIT_SCRIPT];
+      if (resolveGradleDistribution && gradleInitArgs.length) {
+        gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
       parallelPropTaskOut = executeParallelGradleProperties(
         gradleRootPath,
-        allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+        [null].concat(includedBuilds),
+        gradleInitArgs,
       );
+      if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS") === undefined) {
+        const outputLines = parallelPropTaskOut.split("\n");
+        for (const [_i, line] of outputLines.entries()) {
+          if (
+            line.startsWith("Root project '") ||
+            line.startsWith("Project '")
+          ) {
+            break;
+          }
+          if (line.startsWith("<CDXGEN:includedBuild>")) {
+            const includedBuild = line.split(">");
+            if (!includedBuilds.includes(includedBuild[1].trim())) {
+              includedBuilds.push(includedBuild[1].trim());
+            }
+          }
+        }
+        if (includedBuilds.length > 0) {
+          thoughtLog(
+            `Wait, this gradle project uses composite builds. I must carefully process these ${includedBuilds.length} projects, in addition to the root.`,
+          );
+          if (DEBUG_MODE) {
+            console.log(
+              `Composite builds: ${includedBuilds.join(" ").trim()}.`,
+            );
+          }
+          parallelPropTaskOut = parallelPropTaskOut.concat(
+            "\n",
+            executeParallelGradleProperties(gradleRootPath, includedBuilds),
+          );
+        }
+      }
       const splitPropTaskOut = splitOutputByGradleProjects(
         parallelPropTaskOut,
         ["properties"],
       );
-
-      for (const subProject of allProjectsStr) {
-        const retMap = parseGradleProperties(
-          splitPropTaskOut.get(subProject),
-          subProject,
-        );
-        const rootSubProject = retMap.rootProject;
-        if (rootSubProject) {
-          const rootSubProjectObj = await buildObjectForGradleModule(
-            rootSubProject === "root" ? subProject : rootSubProject,
+      for (const [key, propTaskOut] of splitPropTaskOut.entries()) {
+        const retMap = parseGradleProperties(propTaskOut);
+        const rootProject = retMap.rootProject;
+        if (rootProject) {
+          const rootComponent = await buildObjectForGradleModule(
+            rootProject,
             retMap.metadata,
           );
-          if (!allProjectsAddedPurls.includes(rootSubProjectObj["purl"])) {
-            allProjects.push(rootSubProjectObj);
-            rootDependsOn.add(rootSubProjectObj["bom-ref"]);
-            allProjectsAddedPurls.push(rootSubProjectObj["purl"]);
+          if (!includedBuilds.includes(key)) {
+            parentComponent = rootComponent;
+          }
+          gradleModules.set(key, rootComponent);
+          if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
+            allProjects.push(rootComponent);
+            rootDependsOn.add(rootComponent["bom-ref"]);
+            allProjectsAddedPurls.push(rootComponent["purl"]);
           }
-          gradleModules.set(subProject, rootSubProjectObj);
+          allProjectsStr = allProjectsStr.concat(retMap.projects);
         }
       }
-      // Bug #317 fix
-      parentComponent.components = allProjects.flatMap((s) => {
-        delete s.qualifiers;
-        delete s.evidence;
-        return s;
-      });
-      dependencies.push({
-        ref: parentComponent["bom-ref"],
-        dependsOn: [...rootDependsOn].sort(),
-      });
-    }
-  }
-  if (
-    gradleFiles?.length &&
-    options.installDeps &&
-    isPackageManagerAllowed(
-      "gradle",
-      ["maven", "bazel", "sbt", "mill"],
-      options,
-    )
-  ) {
-    allProjects.push(parentComponent);
-    const gradleCmd = getGradleCommand(gradleRootPath, null);
-    const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
-      ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
-      : "dependencies";
-
-    const gradleSubCommands = [];
-    let modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
-      ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
-      : [];
-    if (readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES")) {
-      modulesToSkip = modulesToSkip.concat(
-        readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES").split(","),
-      );
-    }
-    if (!modulesToSkip.includes("root")) {
-      gradleSubCommands.push(gradleDepTask);
-    }
-    for (const [key, sp] of gradleModules) {
-      //create single command for dependencies tasks on all subprojects
-      if (sp.purl !== parentComponent.purl && !modulesToSkip.includes(key)) {
-        gradleSubCommands.push(`${key}:${gradleDepTask}`);
-      }
-    }
-    const gradleArguments = buildGradleCommandArguments(
-      readEnvironmentVariable("GRADLE_ARGS")
-        ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
-        : [],
-      gradleSubCommands,
-      readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES")
-        ? readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES").split(" ")
-        : [],
-      gradleCmd.length,
-    );
-    const allOutputs = [];
-    for (const gradleArg of gradleArguments) {
-      if (DEBUG_MODE) {
-        console.log(
-          `Executing ${gradleCmd} with arguments ${gradleArg.join(" ").substring(0, 150)}... in ${gradleRootPath}`,
-        );
-      }
-      thoughtLog(
-        `Let's invoke '${basename(gradleCmd)}' with the arguments '${gradleArg.join(" ").substring(0, 100)} ...'.`,
-      );
-      const finalGradleArg = gradleArg.includes("--info")
-        ? gradleArg
-        : gradleArg.concat(["--info"]);
-      const sresult = safeSpawnSync(gradleCmd, finalGradleArg, {
-        cwd: gradleRootPath,
-        shell: isWin,
-      });
-      if (sresult.status !== 0 || sresult.error) {
-        if (options.failOnError || DEBUG_MODE) {
-          console.error(sresult.stdout, sresult.stderr);
+      // Get the sub-project properties and set the root dependencies
+      if (allProjectsStr?.length) {
+        const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+          ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+          : [];
+        if (modulesToSkip.length) {
+          thoughtLog(
+            `Good news. I know there are ${allProjectsStr.length} gradle modules at ${gradleRootPath}. I must skip ${modulesToSkip.length} out of these.`,
+          );
         }
-        options.failOnError && process.exit(1);
-      }
-      if (sresult.stdout !== null) {
-        allOutputs.push(sresult.stdout);
-      }
-    }
-    const sstdout = allOutputs.join("\n");
-    if (sstdout) {
-      const cmdOutput = Buffer.from(sstdout).toString();
-      const perProjectOutput = splitOutputByGradleProjects(cmdOutput, [
-        gradleDepTask,
-      ]);
-      for (const key of gradleModules.keys()) {
-        const parsedList = await parseGradleDep(
-          perProjectOutput.has(key) ? perProjectOutput.get(key) : "",
-          key,
-          gradleModules,
+        parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
+          allProjectsStr.filter((module) => !modulesToSkip.includes(module)),
+        );
+        const splitPropTaskOut = splitOutputByGradleProjects(
+          parallelPropTaskOut,
+          ["properties"],
         );
-        const dlist = parsedList.pkgList;
-        if (parsedList?.dependenciesList?.length) {
-          dependencies = mergeDependencies(
-            dependencies,
-            parsedList.dependenciesList,
-            parentComponent,
+
+        for (const subProject of allProjectsStr) {
+          const retMap = parseGradleProperties(
+            splitPropTaskOut.get(subProject),
+            subProject,
           );
-        } else {
-          if (dlist?.length) {
-            thoughtLog(
-              `Hmm, I didn't find any dependencies after executing '${basename(gradleCmd)}' for the project ${key}. However, I did get ${dlist.length} components, which is confusing.`,
+          const rootSubProject = retMap.rootProject;
+          if (rootSubProject) {
+            const rootSubProjectObj = await buildObjectForGradleModule(
+              rootSubProject === "root" ? subProject : rootSubProject,
+              retMap.metadata,
             );
+            if (!allProjectsAddedPurls.includes(rootSubProjectObj["purl"])) {
+              allProjects.push(rootSubProjectObj);
+              rootDependsOn.add(rootSubProjectObj["bom-ref"]);
+              allProjectsAddedPurls.push(rootSubProjectObj["purl"]);
+            }
+            gradleModules.set(subProject, rootSubProjectObj);
           }
         }
-        if (dlist?.length) {
-          pkgList = pkgList.concat(dlist);
-        }
+        // Bug #317 fix
+        parentComponent.components = allProjects.flatMap((s) => {
+          delete s.qualifiers;
+          delete s.evidence;
+          return s;
+        });
+        dependencies.push({
+          ref: parentComponent["bom-ref"],
+          dependsOn: [...rootDependsOn].sort(),
+        });
       }
     }
-    if (pkgList.length) {
-      const fileToUrlMap = parseGradleInfoLogsForUrls(sstdout);
-      // When the `resolve-gradle-distribution` feature flag is enabled, the init script
-      // probes each repository for the actual artifact and emits the resolved URL keyed
-      // by `group:name:version`. This is more accurate than guessing the first repository.
-      const resolvedDistributions =
-        parseGradleResolvedDistributions(parallelPropTaskOut);
+    if (
+      gradleFiles?.length &&
+      options.installDeps &&
+      isPackageManagerAllowed(
+        "gradle",
+        ["maven", "bazel", "sbt", "mill"],
+        options,
+      )
+    ) {
+      allProjects.push(parentComponent);
+      const gradleCmd = getGradleCommand(gradleRootPath, null);
+      const gradleDepTask = readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
+        ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
+        : "dependencies";
 
-      for (const p of pkgList) {
-        if (!p.externalReferences) {
-          p.externalReferences = [];
+      const gradleSubCommands = [];
+      let modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+        ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+        : [];
+      if (readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES")) {
+        modulesToSkip = modulesToSkip.concat(
+          readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES").split(","),
+        );
+      }
+      if (!modulesToSkip.includes("root")) {
+        gradleSubCommands.push(gradleDepTask);
+      }
+      for (const [key, sp] of gradleModules) {
+        //create single command for dependencies tasks on all subprojects
+        if (sp.purl !== parentComponent.purl && !modulesToSkip.includes(key)) {
+          gradleSubCommands.push(`${key}:${gradleDepTask}`);
         }
-        if (!p.externalReferences.find((r) => r.type === "distribution")) {
-          const groupPath = p.group.replace(/\./g, "/");
-          const matchPath = `${groupPath}/${p.name}/${p.version}/`;
-          let matchedUrl = Object.values(fileToUrlMap).find((url) =>
-            url.includes(matchPath),
+      }
+      const gradleArguments = buildGradleCommandArguments(
+        readEnvironmentVariable("GRADLE_ARGS")
+          ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
+          : [],
+        gradleSubCommands,
+        readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES")
+          ? readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES").split(" ")
+          : [],
+        gradleCmd.length,
+      );
+      const allOutputs = [];
+      for (const gradleArg of gradleArguments) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Executing ${gradleCmd} with arguments ${gradleArg.join(" ").substring(0, 150)}... in ${gradleRootPath}`,
           );
-          if (!matchedUrl) {
-            matchedUrl =
-              resolvedDistributions[`${p.group}:${p.name}:${p.version}`];
-          }
-          if (matchedUrl) {
-            p.externalReferences.push({
-              type: "distribution",
-              url: matchedUrl,
-            });
+        }
+        thoughtLog(
+          `Let's invoke '${basename(gradleCmd)}' with the arguments '${gradleArg.join(" ").substring(0, 100)} ...'.`,
+        );
+        const finalGradleArg = gradleArg.includes("--info")
+          ? gradleArg
+          : gradleArg.concat(["--info"]);
+        const sresult = safeSpawnSync(gradleCmd, finalGradleArg, {
+          cwd: gradleRootPath,
+          shell: isWin,
+        });
+        if (sresult.status !== 0 || sresult.error) {
+          if (options.failOnError || DEBUG_MODE) {
+            console.error(sresult.stdout, sresult.stderr);
           }
+          recordGradleInvocationFailure(sresult, {
+            command: `${gradleCmd} ${finalGradleArg.join(" ")}`,
+          });
+          deferFailOnError(options, {
+            ecosystem: "java",
+            tool: "gradle",
+            exitCode:
+              typeof sresult.status === "number" ? sresult.status : undefined,
+            command: `${gradleCmd} ${finalGradleArg.join(" ")}`,
+            detail: "the gradle dependencies task failed",
+          });
+        }
+        if (sresult.stdout !== null) {
+          allOutputs.push(sresult.stdout);
         }
       }
-      if (parentComponent.components?.length) {
-        for (const subProj of parentComponent.components) {
-          pkgList = pkgList.filter(
-            (pkg) =>
-              pkg["bom-ref"] !== subProj["bom-ref"] &&
-              pkg["bom-ref"] !== parentComponent["bom-ref"],
+      const sstdout = allOutputs.join("\n");
+      if (sstdout) {
+        const cmdOutput = Buffer.from(sstdout).toString();
+        const perProjectOutput = splitOutputByGradleProjects(cmdOutput, [
+          gradleDepTask,
+        ]);
+        for (const key of gradleModules.keys()) {
+          const parsedList = await parseGradleDep(
+            perProjectOutput.has(key) ? perProjectOutput.get(key) : "",
+            key,
+            gradleModules,
+            gradleRootPath,
           );
+          const dlist = parsedList.pkgList;
+          if (parsedList?.dependenciesList?.length) {
+            dependencies = mergeDependencies(
+              dependencies,
+              parsedList.dependenciesList,
+              parentComponent,
+            );
+          } else {
+            if (dlist?.length) {
+              thoughtLog(
+                `Hmm, I didn't find any dependencies after executing '${basename(gradleCmd)}' for the project ${key}. However, I did get ${dlist.length} components, which is confusing.`,
+              );
+            }
+          }
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          }
         }
       }
-      thoughtLog(
-        `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`,
-      );
-      if (DEBUG_MODE) {
-        console.log("Obtained", pkgList.length, "from this gradle project.");
-      }
-    } else {
-      thoughtLog(
-        "**GRADLE:** SBOM is incomplete. I recommend troubleshooting the issue to improve the BOM precision.",
-      );
-      if (!DEBUG_MODE) {
-        console.log(
-          "No packages found. Set the environment variable 'CDXGEN_DEBUG_MODE=debug' to troubleshoot any gradle related errors.",
+      if (pkgList.length) {
+        const fileToUrlMap = parseGradleInfoLogsForUrls(sstdout);
+        // When the `resolve-gradle-distribution` feature flag is enabled, the init script
+        // probes each repository for the actual artifact and emits the resolved URL keyed
+        // by `group:name:version`. This is more accurate than guessing the first repository.
+        const resolvedDistributions =
+          parseGradleResolvedDistributions(parallelPropTaskOut);
+
+        for (const p of pkgList) {
+          if (!p.externalReferences) {
+            p.externalReferences = [];
+          }
+          if (!p.externalReferences.find((r) => r.type === "distribution")) {
+            const groupPath = p.group.replace(/\./g, "/");
+            const matchPath = `${groupPath}/${p.name}/${p.version}/`;
+            let matchedUrl = Object.values(fileToUrlMap).find((url) =>
+              url.includes(matchPath),
+            );
+            if (!matchedUrl) {
+              matchedUrl =
+                resolvedDistributions[`${p.group}:${p.name}:${p.version}`];
+            }
+            if (matchedUrl) {
+              p.externalReferences.push({
+                type: "distribution",
+                url: matchedUrl,
+              });
+            }
+          }
+        }
+        if (parentComponent.components?.length) {
+          for (const subProj of parentComponent.components) {
+            pkgList = pkgList.filter(
+              (pkg) =>
+                pkg["bom-ref"] !== subProj["bom-ref"] &&
+                pkg["bom-ref"] !== parentComponent["bom-ref"],
+            );
+          }
+        }
+        thoughtLog(
+          `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`,
         );
+        if (DEBUG_MODE) {
+          console.log("Obtained", pkgList.length, "from this gradle project.");
+        }
+      } else if (hasGradleInvocationFailure()) {
+        // The invocation failure is already ranked, and an empty
+        // configuration is what that failure looks like from here: reporting
+        // both would rank two repairs for one broken toolchain.
+        thoughtLog(
+          "**GRADLE:** No configuration resolved, which the recorded invocation failure already explains.",
+        );
+      } else {
+        recordDegradation("jvm.gradle.unresolved-config", {
+          ecosystem: "java",
+          tool: "gradle",
+          impact: "transitive-deps",
+          command: `${basename(gradleCmd)} ${gradleDepTask}`,
+          detail:
+            "Gradle did not resolve any dependency configuration, so the gradle components carry no resolved dependencies.",
+        });
+        thoughtLog(
+          "**GRADLE:** SBOM is incomplete. I recommend troubleshooting the issue to improve the BOM precision.",
+        );
+        if (!DEBUG_MODE) {
+          console.log(
+            "No packages found. Set the environment variable 'CDXGEN_DEBUG_MODE=debug' to troubleshoot any gradle related errors.",
+          );
+        }
+        deferFailOnError(options, {
+          ecosystem: "java",
+          tool: "gradle",
+          detail: "gradle resolved no dependency configuration",
+        });
       }
-      options.failOnError && process.exit(1);
-    }
-    if (
-      (!readEnvironmentVariable("GRADLE_STOP_DAEMON") &&
-        (!readEnvironmentVariable("GRADLE_USE_DAEMON") ||
-          ["true", "1"].includes(
-            readEnvironmentVariable("GRADLE_USE_DAEMON"),
-          ))) ||
-      ["true", "1"].includes(readEnvironmentVariable("GRADLE_STOP_DAEMON"))
-    ) {
-      if (DEBUG_MODE) {
-        console.log("Stopping gradle daemon...");
+      if (
+        (!readEnvironmentVariable("GRADLE_STOP_DAEMON") &&
+          (!readEnvironmentVariable("GRADLE_USE_DAEMON") ||
+            ["true", "1"].includes(
+              readEnvironmentVariable("GRADLE_USE_DAEMON"),
+            ))) ||
+        ["true", "1"].includes(readEnvironmentVariable("GRADLE_STOP_DAEMON"))
+      ) {
+        if (DEBUG_MODE) {
+          console.log("Stopping gradle daemon...");
+        }
+        const sresult = safeSpawnSync(gradleCmd, ["--stop"], {
+          cwd: gradleRootPath,
+          shell: isWin,
+        });
+        if (sresult.status !== 0 || sresult.error) {
+          if (options.failOnError || DEBUG_MODE) {
+            console.error(sresult.stdout, sresult.stderr);
+          }
+          deferFailOnError(options, {
+            ecosystem: "java",
+            tool: "gradle",
+            exitCode:
+              typeof sresult.status === "number" ? sresult.status : undefined,
+            detail: "stopping the gradle daemon failed",
+          });
+        }
       }
-      const sresult = safeSpawnSync(gradleCmd, ["--stop"], {
-        cwd: gradleRootPath,
-        shell: isWin,
-      });
-      if (sresult.status !== 0 || sresult.error) {
-        if (options.failOnError || DEBUG_MODE) {
-          console.error(sresult.stdout, sresult.stderr);
+      // Should we attempt to resolve class names
+      if (options.resolveClass || options.deep) {
+        const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
+        if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+          jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
-        options.failOnError && process.exit(1);
       }
-    }
-    // Should we attempt to resolve class names
-    if (options.resolveClass || options.deep) {
-      const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
-      if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
-        jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+
+      // A version catalog declares coordinates without resolving them, so it
+      // is used only when Gradle produced no dependency information at all.
+      // The emitted components carry cdx:gradle:catalog=true to mark them as
+      // declared rather than resolved.
+      if (!pkgList.length) {
+        const catalogFiles = getAllFiles(
+          path,
+          `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
+          options,
+        );
+        for (const catalogFile of catalogFiles) {
+          if (DEBUG_MODE) {
+            console.log(`Parsing ${catalogFile}`);
+          }
+          const dlist = parseGradleVersionCatalog(catalogFile);
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          }
+        }
       }
     }
-  }
 
-  // Bazel
-  // Look for the BUILD file only in the root directory
-  // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
-  const bazelFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}{WORKSPACE{,.bazel},MODULE.bazel}`,
-    options,
-  );
-  if (
-    bazelFiles?.length &&
-    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
-    isPackageManagerAllowed(
-      "bazel",
-      ["maven", "gradle", "sbt", "mill"],
+    // Bazel
+    // Look for the BUILD file only in the root directory
+    // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
+    const bazelFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}{WORKSPACE{,.bazel},MODULE.bazel}`,
       options,
-    )
-  ) {
-    let BAZEL_CMD = "bazel";
-    const bazelHome = readEnvironmentVariable("BAZEL_HOME");
-    if (bazelHome) {
-      BAZEL_CMD = join(bazelHome, "bin", "bazel");
-    }
-
-    // bzlmod: parse MODULE.bazel and MODULE.bazel.lock for BCR modules and
-    // ecosystem dependencies (Maven, etc.). This works from the manifest and
-    // lock alone, so BCR/Maven packages are extracted even when the bazel
-    // toolchain is absent. Resolved third-party deps map to their true
-    // ecosystem purl (pkg:maven, ...); only BCR modules use pkg:bazel.
-    const moduleBazelFiles = bazelFiles.filter(
-      (f) => basename(f) === "MODULE.bazel",
     );
-    for (const moduleFile of moduleBazelFiles) {
-      const baseDir = dirname(moduleFile);
-      const moduleResult = parseModuleBazel(moduleFile);
-      if (moduleResult.pkgList?.length) {
-        pkgList = pkgList.concat(moduleResult.pkgList);
-      }
-      if (moduleResult.parentComponent?.name) {
-        parentComponent = moduleResult.parentComponent;
+    if (
+      bazelFiles?.length &&
+      !hasAnyProjectType(
+        ["docker", "oci", "container", "os"],
+        options,
+        false,
+      ) &&
+      isPackageManagerAllowed(
+        "bazel",
+        ["maven", "gradle", "sbt", "mill"],
+        options,
+      )
+    ) {
+      let BAZEL_CMD = "bazel";
+      const bazelHome = readEnvironmentVariable("BAZEL_HOME");
+      if (bazelHome) {
+        BAZEL_CMD = join(bazelHome, "bin", "bazel");
       }
-      const lockFile = join(baseDir, "MODULE.bazel.lock");
-      if (safeExistsSync(lockFile)) {
-        const lockResult = parseModuleBazelLock(lockFile);
-        if (lockResult.pkgList?.length) {
-          pkgList = pkgList.concat(lockResult.pkgList);
+
+      // bzlmod: parse MODULE.bazel and MODULE.bazel.lock for BCR modules and
+      // ecosystem dependencies (Maven, etc.). This works from the manifest and
+      // lock alone, so BCR/Maven packages are extracted even when the bazel
+      // toolchain is absent. Resolved third-party deps map to their true
+      // ecosystem purl (pkg:maven, ...); only BCR modules use pkg:bazel.
+      const moduleBazelFiles = bazelFiles.filter(
+        (f) => basename(f) === "MODULE.bazel",
+      );
+      for (const moduleFile of moduleBazelFiles) {
+        const baseDir = dirname(moduleFile);
+        const moduleResult = parseModuleBazel(moduleFile);
+        if (moduleResult.pkgList?.length) {
+          pkgList = pkgList.concat(moduleResult.pkgList);
         }
-        if (lockResult.dependencies?.length) {
-          dependencies = mergeDependencies(
-            dependencies,
-            lockResult.dependencies,
-          );
+        if (moduleResult.parentComponent?.name) {
+          parentComponent = moduleResult.parentComponent;
+        }
+        const lockFile = join(baseDir, "MODULE.bazel.lock");
+        if (safeExistsSync(lockFile)) {
+          const lockResult = parseModuleBazelLock(lockFile);
+          if (lockResult.pkgList?.length) {
+            pkgList = pkgList.concat(lockResult.pkgList);
+          }
+          if (lockResult.dependencies?.length) {
+            dependencies = mergeDependencies(
+              dependencies,
+              lockResult.dependencies,
+            );
+          }
         }
       }
-    }
 
-    // Querying bazel means building the project first, which is the most
-    // expensive thing cdxgen can do and needs network access. Like every other
-    // package-manager invocation it therefore runs only when dependency
-    // installation is permitted; `--lifecycle pre-build` and secure mode both
-    // turn it off, leaving the manifest and lock as the inventory source.
-    for (const f of options.installDeps ? bazelFiles : []) {
-      const basePath = dirname(f);
-      // Invoke bazel build first
-      const bazelTarget = readEnvironmentVariable("BAZEL_TARGET") || "//...";
-      let bArgs = [
-        ...(readEnvironmentVariable("BAZEL_ARGS")?.split(" ") || []),
-        "build",
-        bazelTarget,
-      ];
-      // Automatically load any bazelrc file
-      if (
-        !readEnvironmentVariable("BAZEL_ARGS") &&
-        safeExistsSync(join(basePath, ".bazelrc"))
-      ) {
-        bArgs = ["--bazelrc=.bazelrc", "build", bazelTarget];
-      }
-      console.log("Executing", BAZEL_CMD, "in", basePath);
-      let result = safeSpawnSync(BAZEL_CMD, bArgs, {
-        cwd: basePath,
-        shell: isWin,
-      });
-      if (result.status !== 0 || result.error) {
-        if (result.stderr) {
-          console.error(result.stdout, result.stderr);
-        }
-        console.log(
-          "1. Check if bazel is installed and available in PATH.\n2. Try building your app with bazel prior to invoking cdxgen",
-        );
-        options.failOnError && process.exit(1);
-      } else {
-        const target = readEnvironmentVariable("BAZEL_TARGET") || "//...";
-        let query = [
+      // Querying bazel means building the project first, which is the most
+      // expensive thing cdxgen can do and needs network access. Like every other
+      // package-manager invocation it therefore runs only when dependency
+      // installation is permitted; `--lifecycle pre-build` and secure mode both
+      // turn it off, leaving the manifest and lock as the inventory source.
+      for (const f of options.installDeps ? bazelFiles : []) {
+        const basePath = dirname(f);
+        // Invoke bazel build first
+        const bazelTarget = readEnvironmentVariable("BAZEL_TARGET") || "//...";
+        let bArgs = [
           ...(readEnvironmentVariable("BAZEL_ARGS")?.split(" ") || []),
+          "build",
+          bazelTarget,
         ];
-        let bazelParser;
         // Automatically load any bazelrc file
         if (
           !readEnvironmentVariable("BAZEL_ARGS") &&
           safeExistsSync(join(basePath, ".bazelrc"))
         ) {
-          query = ["--bazelrc=.bazelrc"];
-        }
-        if (
-          ["true", "1"].includes(
-            readEnvironmentVariable("BAZEL_USE_ACTION_GRAPH"),
-          )
-        ) {
-          query = query.concat(["query", `deps(${target})`, "--output=label"]);
-          bazelParser = parseBazelActionGraph;
-        } else {
-          query = query.concat([
-            "aquery",
-            "--output=textproto",
-            "--skyframe_state",
-          ]);
-          bazelParser = parseBazelSkyframe;
+          bArgs = ["--bazelrc=.bazelrc", "build", bazelTarget];
         }
-        console.log("Executing", BAZEL_CMD, `${query.join(" ")} in`, basePath);
-        result = safeSpawnSync(BAZEL_CMD, query, {
+        console.log("Executing", BAZEL_CMD, "in", basePath);
+        let result = safeSpawnSync(BAZEL_CMD, bArgs, {
           cwd: basePath,
+          shell: isWin,
         });
         if (result.status !== 0 || result.error) {
-          console.error(result.stdout, result.stderr);
-          options.failOnError && process.exit(1);
-        }
-        const stdout = result.stdout;
-        if (stdout) {
-          const cmdOutput = Buffer.from(stdout).toString();
-          const dlist = bazelParser(cmdOutput);
-          if (dlist?.length) {
-            pkgList = pkgList.concat(dlist);
-          } else {
-            console.log(
-              "No packages were detected.\n1. Build your project using bazel build command before running cdxgen\n2. Try running the bazel aquery command manually to see if skyframe state can be retrieved.",
-            );
-            console.log(
-              "If your project requires a different query, please file a bug at cyclonedx/cdxgen repo!",
-            );
-            options.failOnError && process.exit(1);
+          if (result.stderr) {
+            console.error(result.stdout, result.stderr);
           }
+          console.log(
+            "1. Check if bazel is installed and available in PATH.\n2. Try building your app with bazel prior to invoking cdxgen",
+          );
+          deferFailOnError(options, {
+            ecosystem: "java",
+            tool: "bazel",
+            exitCode:
+              typeof result.status === "number" ? result.status : undefined,
+            detail: "the bazel build failed",
+          });
         } else {
-          console.log("Bazel unexpectedly didn't produce any output");
-          options.failOnError && process.exit(1);
+          const target = readEnvironmentVariable("BAZEL_TARGET") || "//...";
+          let query = [
+            ...(readEnvironmentVariable("BAZEL_ARGS")?.split(" ") || []),
+          ];
+          let bazelParser;
+          // Automatically load any bazelrc file
+          if (
+            !readEnvironmentVariable("BAZEL_ARGS") &&
+            safeExistsSync(join(basePath, ".bazelrc"))
+          ) {
+            query = ["--bazelrc=.bazelrc"];
+          }
+          if (
+            ["true", "1"].includes(
+              readEnvironmentVariable("BAZEL_USE_ACTION_GRAPH"),
+            )
+          ) {
+            query = query.concat([
+              "query",
+              `deps(${target})`,
+              "--output=label",
+            ]);
+            bazelParser = parseBazelActionGraph;
+          } else {
+            query = query.concat([
+              "aquery",
+              "--output=textproto",
+              "--skyframe_state",
+            ]);
+            bazelParser = parseBazelSkyframe;
+          }
+          console.log(
+            "Executing",
+            BAZEL_CMD,
+            `${query.join(" ")} in`,
+            basePath,
+          );
+          result = safeSpawnSync(BAZEL_CMD, query, {
+            cwd: basePath,
+          });
+          if (result.status !== 0 || result.error) {
+            console.error(result.stdout, result.stderr);
+            deferFailOnError(options, {
+              ecosystem: "java",
+              tool: "bazel",
+              exitCode:
+                typeof result.status === "number" ? result.status : undefined,
+              detail: "the bazel graph query failed",
+            });
+          }
+          const stdout = result.stdout;
+          if (stdout) {
+            const cmdOutput = Buffer.from(stdout).toString();
+            const dlist = bazelParser(cmdOutput);
+            if (dlist?.length) {
+              pkgList = pkgList.concat(dlist);
+            } else {
+              console.log(
+                "No packages were detected.\n1. Build your project using bazel build command before running cdxgen\n2. Try running the bazel aquery command manually to see if skyframe state can be retrieved.",
+              );
+              console.log(
+                "If your project requires a different query, please file a bug at cyclonedx/cdxgen repo!",
+              );
+              deferFailOnError(options, {
+                ecosystem: "java",
+                tool: "bazel",
+                detail: "the bazel graph query produced no packages",
+              });
+            }
+          } else {
+            console.log("Bazel unexpectedly didn't produce any output");
+            deferFailOnError(options, {
+              ecosystem: "java",
+              tool: "bazel",
+              detail: "the bazel graph query unexpectedly produced no output",
+            });
+          }
         }
       }
     }
-  }
-
-  // scala sbt
-  // Identify sbt projects via its `project` directory:
-  // - all SBT project _should_ define build.properties file with sbt version info
-  // - SBT projects _typically_ have some configs/plugins defined in .sbt files
-  // - SBT projects that are still on 0.13.x, can still use the old approach,
-  //   where configs are defined via Scala files
-  // Detecting one of those should be enough to determine an SBT project.
-  let sbtProjectFiles = getAllFiles(
-    path,
-    `${
-      options.multiProject ? "**/" : ""
-    }project/{build.properties,*.sbt,*.scala}`,
-    options,
-  );
-
-  let sbtProjects = [];
-  for (const i in sbtProjectFiles) {
-    // parent dir of sbtProjectFile is the `project` directory
-    // parent dir of `project` is the sbt root project directory
-    const baseDir = dirname(dirname(sbtProjectFiles[i]));
-    sbtProjects = sbtProjects.concat(baseDir);
-  }
 
-  // Fallback in case sbt's project directory is non-existent
-  if (!sbtProjects.length) {
-    sbtProjectFiles = getAllFiles(
+    // scala sbt
+    // Identify sbt projects via its `project` directory:
+    // - all SBT project _should_ define build.properties file with sbt version info
+    // - SBT projects _typically_ have some configs/plugins defined in .sbt files
+    // - SBT projects that are still on 0.13.x, can still use the old approach,
+    //   where configs are defined via Scala files
+    // Detecting one of those should be enough to determine an SBT project.
+    let sbtProjectFiles = getAllFiles(
       path,
-      `${options.multiProject ? "**/" : ""}*.sbt`,
+      `${
+        options.multiProject ? "**/" : ""
+      }project/{build.properties,*.sbt,*.scala}`,
       options,
     );
+
+    let sbtProjects = [];
     for (const i in sbtProjectFiles) {
-      const baseDir = dirname(sbtProjectFiles[i]);
+      // parent dir of sbtProjectFile is the `project` directory
+      // parent dir of `project` is the sbt root project directory
+      const baseDir = dirname(dirname(sbtProjectFiles[i]));
       sbtProjects = sbtProjects.concat(baseDir);
     }
-  }
-  // eliminate duplicates and ignore project directories
-  sbtProjects = [...new Set(sbtProjects)].filter(
-    (p) => !p.endsWith(`${sep}project`) && !p.includes(`target${sep}`),
-  );
-  const sbtLockFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}build.sbt.lock`,
-    options,
-  );
-  const tempCacheDir = safeMkdtempSync(join(getTmpDir(), "sbt-cache-"));
-  safeMkdirSync(tempCacheDir, { recursive: true });
-  if (
-    sbtProjects?.length &&
-    isPackageManagerAllowed(
-      "sbt",
-      ["bazel", "maven", "gradle", "mill"],
+
+    // Fallback in case sbt's project directory is non-existent
+    if (!sbtProjects.length) {
+      sbtProjectFiles = getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}*.sbt`,
+        options,
+      );
+      for (const i in sbtProjectFiles) {
+        const baseDir = dirname(sbtProjectFiles[i]);
+        sbtProjects = sbtProjects.concat(baseDir);
+      }
+    }
+    // eliminate duplicates and ignore project directories
+    sbtProjects = [...new Set(sbtProjects)].filter(
+      (p) => !p.endsWith(`${sep}project`) && !p.includes(`target${sep}`),
+    );
+    const sbtLockFiles = getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}build.sbt.lock`,
       options,
-    )
-  ) {
-    // If the project use sbt lock files
-    if (sbtLockFiles?.length) {
-      for (const f of sbtLockFiles) {
-        const dlist = await parseSbtLock(f);
-        if (dlist?.length) {
-          pkgList = pkgList.concat(dlist);
+    );
+    const tempCacheDir = safeMkdtempSync(join(getTmpDir(), "sbt-cache-"));
+    safeMkdirSync(tempCacheDir, { recursive: true });
+    if (
+      sbtProjects?.length &&
+      isPackageManagerAllowed(
+        "sbt",
+        ["bazel", "maven", "gradle", "mill"],
+        options,
+      )
+    ) {
+      // If the project use sbt lock files
+      if (sbtLockFiles?.length) {
+        for (const f of sbtLockFiles) {
+          const dlist = await parseSbtLock(f);
+          if (dlist?.length) {
+            pkgList = pkgList.concat(dlist);
+          }
         }
-      }
-    } else {
-      const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
-      let sbtVersion = determineSbtVersion(path);
-      // If can't find sbt version at the root of repository then search in
-      // sbt project array too because sometimes the project folder isn't at
-      // root of repository
-      if (sbtVersion == null) {
-        for (const i in sbtProjects) {
-          sbtVersion = determineSbtVersion(sbtProjects[i]);
-          if (sbtVersion != null) {
-            break;
+      } else {
+        const SBT_CMD = readEnvironmentVariable("SBT_CMD") || "sbt";
+        let sbtVersion = determineSbtVersion(path);
+        // If can't find sbt version at the root of repository then search in
+        // sbt project array too because sometimes the project folder isn't at
+        // root of repository
+        if (sbtVersion == null) {
+          for (const i in sbtProjects) {
+            sbtVersion = determineSbtVersion(sbtProjects[i]);
+            if (sbtVersion != null) {
+              break;
+            }
           }
         }
-      }
-      if (DEBUG_MODE) {
-        console.log(`Detected sbt version: ${sbtVersion}`);
-      }
-      // Introduced in 1.2.0 https://www.scala-sbt.org/1.x/docs/sbt-1.2-Release-Notes.html#addPluginSbtFile+command,
-      // however working properly for real only since 1.3.4: https://github.com/sbt/sbt/releases/tag/v1.3.4
-      const standalonePluginFile =
-        sbtVersion != null &&
-        gte(sbtVersion, "1.3.4") &&
-        lte(sbtVersion, "1.4.0");
-      const useSlashSyntax = !sbtVersion || gte(sbtVersion, "1.5.0");
-      const isDependencyTreeBuiltIn =
-        sbtVersion != null && gte(sbtVersion, "1.4.0");
-      const tempDir = safeMkdtempSync(join(getTmpDir(), "cdxsbt-"));
-      const tempSbtgDir = safeMkdtempSync(join(getTmpDir(), "cdxsbtg-"));
-      safeMkdirSync(tempSbtgDir, { recursive: true });
-      // Create temporary plugins file
-      const tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
-
-      // Requires a custom version of `sbt-dependency-graph` that
-      // supports `--append` for `toFile` subtask.
-      let sbtPluginDefinition = `\naddSbtPlugin("io.shiftleft" % "sbt-dependency-graph" % "0.10.0-append-to-file3")\n`;
-      if (isDependencyTreeBuiltIn) {
-        sbtPluginDefinition = "\naddDependencyTreePlugin\n";
         if (DEBUG_MODE) {
-          console.log("Using addDependencyTreePlugin as the custom plugin");
+          console.log(`Detected sbt version: ${sbtVersion}`);
         }
-      }
-      safeWriteSync(tempSbtPlugins, sbtPluginDefinition);
-      let sbtExtraArgs = "";
-      const env = { ...process.env };
-      // We need to collect the jars from the cache
-      if (options.deep) {
-        sbtExtraArgs = " updateClassifiers";
-        env["COURSIER_CACHE"] = tempCacheDir;
-        env["SBT_IVY_HOME"] = tempCacheDir;
-      }
-      for (const i in sbtProjects) {
-        const basePath = sbtProjects[i];
-        const dlFile = join(tempDir, `dl-${i}.tmp`);
-        let sbtArgs = [];
-        let pluginFile = null;
-        const subDlFiles = [];
-        if (standalonePluginFile) {
-          sbtArgs = [
-            `-addPluginSbtFile=${tempSbtPlugins}`,
-            `"dependencyList::toFile ${dlFile} --force"`,
-          ];
-          subDlFiles.push(dlFile);
-        } else {
-          // write to the existing plugins file
-          // Discover the real sbt project ids by asking sbt itself, falling
-          // back to the regex-based heuristic if that fails. A per-subproject
-          // `dependencyTree` fan-out yields a far more complete tree than a
-          // single root resolution (which only captures the root project's own
-          // libraryDependencies). See https://github.com/cdxgen/cdxgen/issues/4291
-          const subprojects = discoverSbtProjectsFromCmd(
-            basePath,
-            SBT_CMD,
-            env,
-          );
-          if (subprojects.length > 0 && useSlashSyntax) {
-            sbtArgs = [
-              `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs}`,
-            ];
-            for (const sp of subprojects) {
-              const subDlFile = join(tempDir, `dl-${i}-${sp}.tmp`);
-              subDlFiles.push(subDlFile);
-              sbtArgs.push(
-                `"${sp}/dependencyTree / toFile ${subDlFile} --force"`,
-              );
-            }
-          } else if (useSlashSyntax) {
+        // Introduced in 1.2.0 https://www.scala-sbt.org/1.x/docs/sbt-1.2-Release-Notes.html#addPluginSbtFile+command,
+        // however working properly for real only since 1.3.4: https://github.com/sbt/sbt/releases/tag/v1.3.4
+        const standalonePluginFile =
+          sbtVersion != null &&
+          gte(sbtVersion, "1.3.4") &&
+          lte(sbtVersion, "1.4.0");
+        const useSlashSyntax = !sbtVersion || gte(sbtVersion, "1.5.0");
+        const isDependencyTreeBuiltIn =
+          sbtVersion != null && gte(sbtVersion, "1.4.0");
+        const tempDir = safeMkdtempSync(join(getTmpDir(), "cdxsbt-"));
+        const tempSbtgDir = safeMkdtempSync(join(getTmpDir(), "cdxsbtg-"));
+        safeMkdirSync(tempSbtgDir, { recursive: true });
+        // Create temporary plugins file
+        const tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
+
+        // Requires a custom version of `sbt-dependency-graph` that
+        // supports `--append` for `toFile` subtask.
+        let sbtPluginDefinition = `\naddSbtPlugin("io.shiftleft" % "sbt-dependency-graph" % "0.10.0-append-to-file3")\n`;
+        if (isDependencyTreeBuiltIn) {
+          sbtPluginDefinition = "\naddDependencyTreePlugin\n";
+          if (DEBUG_MODE) {
+            console.log("Using addDependencyTreePlugin as the custom plugin");
+          }
+        }
+        safeWriteSync(tempSbtPlugins, sbtPluginDefinition);
+        let sbtExtraArgs = "";
+        const env = { ...process.env };
+        // We need to collect the jars from the cache
+        if (options.deep) {
+          sbtExtraArgs = " updateClassifiers";
+          env["COURSIER_CACHE"] = tempCacheDir;
+          env["SBT_IVY_HOME"] = tempCacheDir;
+        }
+        for (const i in sbtProjects) {
+          const basePath = sbtProjects[i];
+          const dlFile = join(tempDir, `dl-${i}.tmp`);
+          let sbtArgs = [];
+          let pluginFile = null;
+          const subDlFiles = [];
+          if (standalonePluginFile) {
             sbtArgs = [
-              `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs} "dependencyTree / toFile ${dlFile} --force"`,
+              `-addPluginSbtFile=${tempSbtPlugins}`,
+              `"dependencyList::toFile ${dlFile} --force"`,
             ];
             subDlFiles.push(dlFile);
           } else {
-            sbtArgs = [
-              `'set asciiGraphWidth in ThisBuild := 800'${sbtExtraArgs} "dependencyTree::toFile ${dlFile} --force"`,
-            ];
-            subDlFiles.push(dlFile);
+            // write to the existing plugins file
+            // Discover the real sbt project ids by asking sbt itself, falling
+            // back to the regex-based heuristic if that fails. A per-subproject
+            // `dependencyTree` fan-out yields a far more complete tree than a
+            // single root resolution (which only captures the root project's own
+            // libraryDependencies). See https://github.com/cdxgen/cdxgen/issues/4291
+            const subprojects = discoverSbtProjectsFromCmd(
+              basePath,
+              SBT_CMD,
+              env,
+            );
+            if (subprojects.length > 0 && useSlashSyntax) {
+              sbtArgs = [
+                `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs}`,
+              ];
+              for (const sp of subprojects) {
+                const subDlFile = join(tempDir, `dl-${i}-${sp}.tmp`);
+                subDlFiles.push(subDlFile);
+                sbtArgs.push(
+                  `"${sp}/dependencyTree / toFile ${subDlFile} --force"`,
+                );
+              }
+            } else if (useSlashSyntax) {
+              sbtArgs = [
+                `'set ThisBuild / asciiGraphWidth := 800'${sbtExtraArgs} "dependencyTree / toFile ${dlFile} --force"`,
+              ];
+              subDlFiles.push(dlFile);
+            } else {
+              sbtArgs = [
+                `'set asciiGraphWidth in ThisBuild := 800'${sbtExtraArgs} "dependencyTree::toFile ${dlFile} --force"`,
+              ];
+              subDlFiles.push(dlFile);
+            }
+            pluginFile = addPlugin(basePath, sbtPluginDefinition);
           }
-          pluginFile = addPlugin(basePath, sbtPluginDefinition);
-        }
-        // Run sbt in non-interactive batch mode so it never blocks waiting for
-        // input on stdin (which can otherwise appear as an indefinite hang) and
-        // does not emit ANSI colour codes into the dependency tree output.
-        sbtArgs = ["-batch", "-no-colors", ...sbtArgs];
-        console.log(
-          "Executing",
-          SBT_CMD,
-          sbtArgs.join(" "),
-          "in",
-          basePath,
-          "using plugins",
-          tempSbtgDir,
-        );
-        // Note that the command has to be invoked with `shell: true` to properly execut sbt
-        const result = safeSpawnSync(SBT_CMD, sbtArgs, {
-          cwd: basePath,
-          shell: true,
-          env,
-        });
-        if (result.status !== 0 || result.error) {
-          console.error(result.stdout, result.stderr);
+          // Run sbt in non-interactive batch mode so it never blocks waiting for
+          // input on stdin (which can otherwise appear as an indefinite hang) and
+          // does not emit ANSI colour codes into the dependency tree output.
+          sbtArgs = ["-batch", "-no-colors", ...sbtArgs];
           console.log(
-            "1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.",
-          );
-          console.log(
-            "2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment",
-          );
-          console.log(
-            "3. Consider creating a lockfile using sbt-dependency-lock plugin. See https://github.com/stringbean/sbt-dependency-lock",
+            "Executing",
+            SBT_CMD,
+            sbtArgs.join(" "),
+            "in",
+            basePath,
+            "using plugins",
+            tempSbtgDir,
           );
-          options.failOnError && process.exit(1);
-        }
-        if (!standalonePluginFile) {
-          cleanupPlugin(basePath, pluginFile);
-        }
-        const sbtSubprojectRoots = [];
-        for (const subDlFile of subDlFiles) {
-          if (safeExistsSync(subDlFile)) {
-            const retMap = await parseSbtTree(subDlFile);
-            if (retMap.pkgList?.length) {
-              const tmpParentComponent = retMap.pkgList.splice(0, 1)[0];
-              tmpParentComponent.type = "application";
-              pkgList = pkgList.concat(retMap.pkgList);
-              pkgList.push(tmpParentComponent);
-              sbtSubprojectRoots.push(tmpParentComponent);
-            }
-            if (retMap.dependenciesList) {
-              dependencies = mergeDependencies(
-                dependencies,
-                retMap.dependenciesList,
-                parentComponent,
-              );
-            }
-          } else {
-            if (options.failOnError || DEBUG_MODE) {
-              console.log(`sbt dependencyList did not yield ${subDlFile}`);
+          // Note that the command has to be invoked with `shell: true` to properly execut sbt
+          const result = safeSpawnSync(SBT_CMD, sbtArgs, {
+            cwd: basePath,
+            shell: true,
+            env,
+          });
+          if (result.status !== 0 || result.error) {
+            console.error(result.stdout, result.stderr);
+            recordDegradation("jvm.sbt.no-lockfile", {
+              ecosystem: "java",
+              tool: "sbt",
+              impact: "versions",
+              command: `${SBT_CMD} ${sbtArgs.join(" ")}`,
+              exitCode:
+                typeof result.status === "number" ? result.status : undefined,
+              detail:
+                "The sbt dependencyTree command did not succeed, so the declared sbt dependencies are the only evidence available.",
+            });
+            console.log(
+              "1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.",
+            );
+            console.log(
+              "2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment",
+            );
+            console.log(
+              "3. Consider creating a lockfile using sbt-dependency-lock plugin. See https://github.com/stringbean/sbt-dependency-lock",
+            );
+            deferFailOnError(options, {
+              ecosystem: "java",
+              tool: "sbt",
+              exitCode:
+                typeof result.status === "number" ? result.status : undefined,
+              command: `${SBT_CMD} ${sbtArgs.join(" ")}`,
+              detail: "the sbt dependencyTree command failed",
+            });
+          }
+          if (!standalonePluginFile) {
+            cleanupPlugin(basePath, pluginFile);
+          }
+          const sbtSubprojectRoots = [];
+          for (const subDlFile of subDlFiles) {
+            if (safeExistsSync(subDlFile)) {
+              const retMap = await parseSbtTree(subDlFile);
+              if (retMap.pkgList?.length) {
+                const tmpParentComponent = retMap.pkgList.splice(0, 1)[0];
+                tmpParentComponent.type = "application";
+                pkgList = pkgList.concat(retMap.pkgList);
+                pkgList.push(tmpParentComponent);
+                sbtSubprojectRoots.push(tmpParentComponent);
+              }
+              if (retMap.dependenciesList) {
+                dependencies = mergeDependencies(
+                  dependencies,
+                  retMap.dependenciesList,
+                  parentComponent,
+                );
+              }
+            } else {
+              if (options.failOnError || DEBUG_MODE) {
+                console.log(`sbt dependencyList did not yield ${subDlFile}`);
+              }
+              if (options.failOnError) {
+                deferFailOnError(options, {
+                  ecosystem: "java",
+                  tool: "sbt",
+                  detail: "the sbt dependencyList output was missing",
+                });
+              }
             }
-            options.failOnError && process.exit(1);
+          }
+          // Construct a synthetic root component from build.sbt name/org/version
+          // that aggregates all subproject roots as its direct dependencies.
+          const sbtRoot = parseSbtRootProject(basePath);
+          if (sbtRoot && sbtSubprojectRoots.length > 0) {
+            const rootPurl = build({
+              type: "maven",
+              namespace: sbtRoot.group || null,
+              name: sbtRoot.name,
+              version: sbtRoot.version || null,
+              qualifiers: { type: "jar" } || null,
+            });
+            const rootComponent = {
+              group: sbtRoot.group,
+              name: sbtRoot.name,
+              version: sbtRoot.version,
+              type: "application",
+              purl: rootPurl,
+              "bom-ref": decodeURIComponent(rootPurl),
+            };
+            parentComponent = rootComponent;
+            dependencies.push({
+              ref: decodeURIComponent(rootPurl),
+              dependsOn: sbtSubprojectRoots
+                .map((c) => c["bom-ref"])
+                .filter(Boolean),
+            });
+          } else if (sbtSubprojectRoots.length > 0 && !parentComponent) {
+            parentComponent = sbtSubprojectRoots[0];
           }
         }
-        // Construct a synthetic root component from build.sbt name/org/version
-        // that aggregates all subproject roots as its direct dependencies.
-        const sbtRoot = parseSbtRootProject(basePath);
-        if (sbtRoot && sbtSubprojectRoots.length > 0) {
-          const rootPurl = build({
-            type: "maven",
-            namespace: sbtRoot.group || null,
-            name: sbtRoot.name,
-            version: sbtRoot.version || null,
-            qualifiers: { type: "jar" } || null,
-          });
-          const rootComponent = {
-            group: sbtRoot.group,
-            name: sbtRoot.name,
-            version: sbtRoot.version,
-            type: "application",
-            purl: rootPurl,
-            "bom-ref": decodeURIComponent(rootPurl),
-          };
-          parentComponent = rootComponent;
-          dependencies.push({
-            ref: decodeURIComponent(rootPurl),
-            dependsOn: sbtSubprojectRoots
-              .map((c) => c["bom-ref"])
-              .filter(Boolean),
-          });
-        } else if (sbtSubprojectRoots.length > 0 && !parentComponent) {
-          parentComponent = sbtSubprojectRoots[0];
-        }
-      }
 
-      // Cleanup
-      safeUnlinkSync(tempSbtPlugins);
-    } // else
+        // Cleanup
+        safeUnlinkSync(tempSbtPlugins);
+      } // else
 
-    if (DEBUG_MODE) {
-      console.log(`Found ${pkgList.length} packages`);
-    }
-    // Should we attempt to resolve class names
-    if (options.resolveClass || options.deep) {
-      const tmpjarNSMapping = await collectJarNS(tempCacheDir);
-      if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
-        jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+      if (DEBUG_MODE) {
+        console.log(`Found ${pkgList.length} packages`);
       }
-      // sbt can store jars in the target directory
-      const jarNSData = await createJarBom(path, options);
-      if (jarNSData?.bomJson?.components) {
-        pkgList = pkgList.concat(jarNSData?.bomJson?.components);
-        const targetJarNSMapping = {};
-        for (const p of jarNSData.bomJson.components) {
-          if (!p?.purl || !p?.properties?.length) {
-            continue;
-          }
-          const nsProp = p.properties.filter(
-            (prop) => prop.name === "internal:Namespaces",
-          );
-          if (nsProp.length) {
-            targetJarNSMapping[p.purl] = nsProp[0].value;
+      // Should we attempt to resolve class names
+      if (options.resolveClass || options.deep) {
+        const tmpjarNSMapping = await collectJarNS(tempCacheDir);
+        if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+          jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+        }
+        // sbt can store jars in the target directory
+        const jarNSData = await createJarBom(path, options);
+        if (jarNSData?.bomJson?.components) {
+          pkgList = pkgList.concat(jarNSData?.bomJson?.components);
+          const targetJarNSMapping = {};
+          for (const p of jarNSData.bomJson.components) {
+            if (!p?.purl || !p?.properties?.length) {
+              continue;
+            }
+            const nsProp = p.properties.filter(
+              (prop) => prop.name === "internal:Namespaces",
+            );
+            if (nsProp.length) {
+              targetJarNSMapping[p.purl] = nsProp[0].value;
+            }
           }
+          jarNSMapping = { ...jarNSMapping, ...targetJarNSMapping };
         }
-        jarNSMapping = { ...jarNSMapping, ...targetJarNSMapping };
       }
     }
-  }
-  if (tempCacheDir?.startsWith(getTmpDir())) {
-    safeRmSync(tempCacheDir, {
-      recursive: true,
-      force: true,
-    });
-  }
-
-  if (
-    millFiles?.length &&
-    isPackageManagerAllowed(
-      "mill",
-      ["bazel", "sbt", "gradle", "maven"],
-      options,
-    )
-  ) {
-    const millRootPath = dirname(millFiles[0]);
-    parentComponent = createDefaultParentComponent(
-      millRootPath,
-      "maven",
-      options,
-    );
-    const millCmd = getMillCommand(millRootPath);
-    const millCommonArgs = [
-      "--color",
-      "false",
-      "--disable-callgraph",
-      "--disable-prompt",
-      "--keep-going",
-      "--silent",
-    ];
-    if (!["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) {
-      millCommonArgs.unshift("--no-server");
-    }
-    const millArgs = [...millCommonArgs, "__.ivyDepsTree"];
-    if (DEBUG_MODE) {
-      console.log("Executing", millCmd, "in", millRootPath);
-    }
-    let sresult = safeSpawnSync(millCmd, millArgs, {
-      cwd: millRootPath,
-      shell: isWin,
-      maxBuffer: MAX_BUFFER * 10,
-    });
-    if (sresult.status !== 0 || sresult.error) {
-      if (options.failOnError || DEBUG_MODE) {
-        console.error(sresult.stdout, sresult.stderr);
-      }
-      options.failOnError && process.exit(1);
+    if (tempCacheDir?.startsWith(getTmpDir())) {
+      safeRmSync(tempCacheDir, {
+        recursive: true,
+        force: true,
+      });
     }
-    const millResolveArgs = [...millCommonArgs, "resolve", "__.ivyDepsTree"];
-    if (DEBUG_MODE) {
-      console.log(
-        "Executing",
-        millCmd,
-        millResolveArgs.join(" "),
-        "in",
+
+    if (
+      millFiles?.length &&
+      isPackageManagerAllowed(
+        "mill",
+        ["bazel", "sbt", "gradle", "maven"],
+        options,
+      )
+    ) {
+      const millRootPath = dirname(millFiles[0]);
+      parentComponent = createDefaultParentComponent(
         millRootPath,
+        "maven",
+        options,
       );
-    }
-    sresult = safeSpawnSync(millCmd, millResolveArgs, {
-      cwd: millRootPath,
-      shell: isWin,
-    });
-    if (sresult.status !== 0 || sresult.error) {
-      if (options.failOnError || DEBUG_MODE) {
-        console.error(sresult.stdout, sresult.stderr);
-      }
-      options.failOnError && process.exit(1);
-    }
-    const sstdout = sresult.stdout;
-    if (sstdout) {
-      parentComponent.components = [];
-      const modules = sstdout
-        .trim()
-        .split("\n")
-        .map((a) => a.substring(0, a.lastIndexOf(".")))
-        .filter((a) =>
-          ["true", "1"].includes(readEnvironmentVariable("MILL_EXCLUDE_TEST"))
-            ? !a.endsWith(".test")
-            : true,
-        );
-      const moduleBomRefs = [];
-      const packages = new Map();
-      const relations = new Map();
-      relations.set(parentComponent["bom-ref"], []);
-      for (const module of modules) {
-        moduleBomRefs.push(
-          parseMillDependency(module, packages, relations, millRootPath),
-        );
+      const millCmd = getMillCommand(millRootPath);
+      const millCommonArgs = [
+        "--color",
+        "false",
+        "--disable-callgraph",
+        "--disable-prompt",
+        "--keep-going",
+        "--silent",
+      ];
+      if (!["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) {
+        millCommonArgs.unshift("--no-server");
       }
-      for (const module of moduleBomRefs) {
-        parentComponent.components.push(packages.get(module));
-        relations.get(parentComponent["bom-ref"]).push(module);
-        packages.delete(module);
+      const millArgs = [...millCommonArgs, "__.ivyDepsTree"];
+      if (DEBUG_MODE) {
+        console.log("Executing", millCmd, "in", millRootPath);
       }
-      const newDependencies = [];
-      for (const [ref, dependsOn] of relations.entries()) {
-        newDependencies.push({
-          ref,
-          dependsOn,
+      let sresult = safeSpawnSync(millCmd, millArgs, {
+        cwd: millRootPath,
+        shell: isWin,
+        maxBuffer: MAX_BUFFER * 10,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        deferFailOnError(options, {
+          ecosystem: "java",
+          tool: "mill",
+          exitCode:
+            typeof sresult.status === "number" ? sresult.status : undefined,
+          detail: "the mill ivyDepsTree command failed",
         });
       }
+      const millResolveArgs = [...millCommonArgs, "resolve", "__.ivyDepsTree"];
       if (DEBUG_MODE) {
         console.log(
-          `Obtained ${packages.size} components and ${relations.size} dependencies from mill.`,
+          "Executing",
+          millCmd,
+          millResolveArgs.join(" "),
+          "in",
+          millRootPath,
         );
       }
-      pkgList = pkgList.concat(...packages.values());
-      dependencies = mergeDependencies(
-        dependencies,
-        newDependencies,
-        parentComponent,
-      );
-    }
-    if (
-      (!readEnvironmentVariable("MILL_SHUTDOWN_SERVER") &&
-        ["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) ||
-      ["true", "1"].includes(readEnvironmentVariable("MILL_SHUTDOWN_SERVER"))
-    ) {
-      if (DEBUG_MODE) {
-        console.log("Shutting down mill server...");
-      }
-      const sresult = safeSpawnSync(millCmd, ["shutdown"], {
+      sresult = safeSpawnSync(millCmd, millResolveArgs, {
         cwd: millRootPath,
         shell: isWin,
       });
@@ -1841,11 +1956,97 @@ export async function createJavaBom(path, options) {
         if (options.failOnError || DEBUG_MODE) {
           console.error(sresult.stdout, sresult.stderr);
         }
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "java",
+          tool: "mill",
+          exitCode:
+            typeof sresult.status === "number" ? sresult.status : undefined,
+          detail: "the mill resolve command failed",
+        });
+      }
+      const sstdout = sresult.stdout;
+      if (sstdout) {
+        parentComponent.components = [];
+        const modules = sstdout
+          .trim()
+          .split("\n")
+          .map((a) => a.substring(0, a.lastIndexOf(".")))
+          .filter((a) =>
+            ["true", "1"].includes(readEnvironmentVariable("MILL_EXCLUDE_TEST"))
+              ? !a.endsWith(".test")
+              : true,
+          );
+        const moduleBomRefs = [];
+        const packages = new Map();
+        const relations = new Map();
+        relations.set(parentComponent["bom-ref"], []);
+        for (const module of modules) {
+          moduleBomRefs.push(
+            parseMillDependency(module, packages, relations, millRootPath),
+          );
+        }
+        for (const module of moduleBomRefs) {
+          parentComponent.components.push(packages.get(module));
+          relations.get(parentComponent["bom-ref"]).push(module);
+          packages.delete(module);
+        }
+        const newDependencies = [];
+        for (const [ref, dependsOn] of relations.entries()) {
+          newDependencies.push({
+            ref,
+            dependsOn,
+          });
+        }
+        if (DEBUG_MODE) {
+          console.log(
+            `Obtained ${packages.size} components and ${relations.size} dependencies from mill.`,
+          );
+        }
+        pkgList = pkgList.concat(...packages.values());
+        dependencies = mergeDependencies(
+          dependencies,
+          newDependencies,
+          parentComponent,
+        );
       }
+      if (
+        (!readEnvironmentVariable("MILL_SHUTDOWN_SERVER") &&
+          ["true", "1"].includes(readEnvironmentVariable("MILL_USE_SERVER"))) ||
+        ["true", "1"].includes(readEnvironmentVariable("MILL_SHUTDOWN_SERVER"))
+      ) {
+        if (DEBUG_MODE) {
+          console.log("Shutting down mill server...");
+        }
+        const sresult = safeSpawnSync(millCmd, ["shutdown"], {
+          cwd: millRootPath,
+          shell: isWin,
+        });
+        if (sresult.status !== 0 || sresult.error) {
+          if (options.failOnError || DEBUG_MODE) {
+            console.error(sresult.stdout, sresult.stderr);
+          }
+          deferFailOnError(options, {
+            ecosystem: "java",
+            tool: "mill",
+            exitCode:
+              typeof sresult.status === "number" ? sresult.status : undefined,
+            detail: "shutting down the mill server failed",
+          });
+        }
+      }
+    }
+  } catch (err) {
+    if (!isDeferredFailOnError(err)) {
+      throw err;
     }
+    // The deferred fail-on-error abort kept everything collected so far;
+    // the incomplete-result fallbacks stayed skipped.
+    thoughtLog(
+      "Completing the java BOM with the components collected before the deferred failure.",
+    );
   }
-
+  // Deduplication and metadata belong to whatever was collected, so they run
+  // on the deferred path too.
   pkgList = trimComponents(pkgList);
   pkgList = await getMvnMetadata(pkgList, jarNSMapping, options.deep);
   return buildBomNSData(options, pkgList, "maven", {