Support for Java 20 (and 21)

[greyfairer]

After building a project with

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>20</source>
                    <target>20</target>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.7.6</version>
                <configuration>
                   [...]
                </configuration>
                <executions>
                    <execution>
                        <id>generate-bom</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

CycloneDX fails with: Unsupported class file major version 64

[ERROR] Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom (generate-bom) on project dsalert: Execution generate-bom of goal org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom failed: Unsupported class file major version 64 -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom (generate-bom) on project dsalert: Execution generate-bom of goal org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom failed: Unsupported class file major version 64
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:347)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:330)
   [...]
Caused by: org.apache.maven.plugin.PluginExecutionException: Execution generate-bom of goal org.cyclonedx:cyclonedx-maven-plugin:2.7.6:makeAggregateBom failed: Unsupported class file major version 64
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:133)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:342)
   [...]
Caused by: java.lang.IllegalArgumentException: Unsupported class file major version 64
    at org.objectweb.asm.ClassReader.<init> (ClassReader.java:199)
    at org.objectweb.asm.ClassReader.<init> (ClassReader.java:180)
    at org.objectweb.asm.ClassReader.<init> (ClassReader.java:166)
    at org.apache.maven.shared.dependency.analyzer.asm.DependencyClassFileVisitor.visitClass (DependencyClassFileVisitor.java:60)
    at org.apache.maven.shared.dependency.analyzer.ClassFileVisitorUtils.visitClass (ClassFileVisitorUtils.java:149)
    at org.apache.maven.shared.dependency.analyzer.ClassFileVisitorUtils.acceptDirectory (ClassFileVisitorUtils.java:133)
    at org.apache.maven.shared.dependency.analyzer.ClassFileVisitorUtils.accept (ClassFileVisitorUtils.java:69)
    at org.apache.maven.shared.dependency.analyzer.asm.ASMDependencyAnalyzer.analyze (ASMDependencyAnalyzer.java:48)
    at org.apache.maven.shared.dependency.analyzer.DefaultProjectDependencyAnalyzer.buildDependencyClasses (DefaultProjectDependencyAnalyzer.java:235)
    at org.apache.maven.shared.dependency.analyzer.DefaultProjectDependencyAnalyzer.buildMainDependencyClasses (DefaultProjectDependencyAnalyzer.java:220)
    at org.apache.maven.shared.dependency.analyzer.DefaultProjectDependencyAnalyzer.analyze (DefaultProjectDependencyAnalyzer.java:73)
    at org.cyclonedx.maven.CycloneDxMojo.doProjectDependencyAnalysis (CycloneDxMojo.java:86)
    at org.cyclonedx.maven.CycloneDxAggregateMojo.prepareMavenDependencyAnalysis (CycloneDxAggregateMojo.java:197)
   [...]

I did some digging, and you appear to use the latest version of maven-dependency-plugin 1.13, but there is an open issue https://issues.apache.org/jira/browse/MDEP-848 to upgrade objectweb.asm to fix this:

    <dependency>
      <groupId>org.ow2.asm</groupId>
      <artifactId>asm</artifactId>
      <version>9.5</version>
    </dependency>

Apparently, this would also make it compatible with Java 21

[greyfairer]

A workaround is to add and bump the dependency explicitly in the plugin config.
This seems to work for me:

            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.7.6</version>
                <configuration>
                   [...]
                </configuration>
                <executions>
                    <execution>
                        <id>generate-bom</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
                <dependencies>
                    <dependency>
                        <groupId>org.ow2.asm</groupId>
                        <artifactId>asm</artifactId>
                        <version>9.5</version>
                    </dependency>
                </dependencies>
            </plugin>