Bump generated BOM to CycloneDX v1.5; Add external references

Closes #3602

Signed-off-by: nscuro <[email protected]>

pom.xml

@@ -135,8 +135,6 @@
         <lib.jdbc-driver.mysql.version>8.0.33</lib.jdbc-driver.mysql.version>
         <lib.jdbc-driver.postgresql.version>42.7.3</lib.jdbc-driver.postgresql.version>
         <!-- Maven Plugin Properties -->
-        <plugin.cyclonedx.projectType>application</plugin.cyclonedx.projectType>
-        <plugin.cyclonedx.outputFormat>json</plugin.cyclonedx.outputFormat>
         <plugin.retirejs.breakOnFailure>false</plugin.retirejs.breakOnFailure>
         <plugin.jetty.version>12.0.12</plugin.jetty.version>
         <!-- SonarCloud properties -->
@@ -589,6 +587,61 @@
                     </excludes>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>cyclonedx-aggregate</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>makeAggregateBom</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <projectType>application</projectType>
+                    <schemaVersion>1.5</schemaVersion>
+                    <includeCompileScope>true</includeCompileScope>
+                    <includeProvidedScope>true</includeProvidedScope>
+                    <includeRuntimeScope>true</includeRuntimeScope>
+                    <includeSystemScope>true</includeSystemScope>
+                    <includeTestScope>false</includeTestScope>
+                    <includeLicenseText>false</includeLicenseText>
+                    <outputReactorProjects>true</outputReactorProjects>
+                    <outputFormat>json</outputFormat>
+                    <externalReferences>
+                        <externalReference>
+                            <type>advisories</type>
+                            <url>https://github.com/DependencyTrack/dependency-track/security/advisories</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>chat</type>
+                            <url>https://dependencytrack.org/slack</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>documentation</type>
+                            <url>https://docs.dependencytrack.org/</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>release-notes</type>
+                            <url>https://docs.dependencytrack.org/changelog/</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>security-contact</type>
+                            <url>mailto:[email protected]</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>social</type>
+                            <url>https://www.linkedin.com/company/owasp-dependency-track</url>
+                        </externalReference>
+                        <externalReference>
+                            <type>social</type>
+                            <url>https://x.com/dependencytrack</url>
+                        </externalReference>
+                    </externalReferences>
+                </configuration>
+            </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>

src/main/resources/services.bom.json

@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.4",
+  "specVersion": "1.5",
   "serialNumber": "urn:uuid:d8e07202-6817-42c1-8cae-20254567672f",
   "version": 1,
   "services": [