fix: Remove non-shipped dependencies from the SBOMs

CHANGELOG.md

@@ -22,6 +22,15 @@ All notable changes to this project will be documented in this file.
 - superset: Fix the broken builds by excluding the `cypress-base` end-to-end test project from the frontend SBOM ([#1616]).
 - superset: Fix the broken 4.1.4 build by also excluding `packages/superset-ui-switchboard` from the frontend SBOM ([#1620]).
 - superset: Install nvm into `/opt/nvm` so that Node and npm, which are only needed to build the frontend, are no longer shipped in the final image (about 161 MB) ([#1623]).
+- vector: Generate the SBOM with the same feature set the binary is built with, so that the integrations that are not compiled in are no longer reported ([#1630]).
+- base images: Exclude the build-time dependencies from the Rust SBOMs ([#1630]).
+- kafka: Exclude the non-runtime configurations and the projects that are not shipped from the SBOM ([#1630]).
+- opensearch: Exclude the test framework, the test fixtures, the QA projects and the benchmarks from the SBOM of `3.1.0` and `3.4.0` ([#1630]).
+- opensearch: Restrict the SBOM of the Prometheus exporter to the runtime dependencies ([#1630]).
+- opensearch-dashboards: Exclude the devDependencies from the SBOM ([#1630]).
+- hbase: Exclude the optional npm dependencies from the web UI SBOM ([#1630]).
+- airflow, superset: Create the Python SBOM from a separate environment, so that neither cyclonedx-bom nor its dependencies end up in the SBOM and in the image ([#1630]).
+- airflow, superset: Add the missing purl to the Airflow and Superset packages in the Python SBOM. They are installed from a locally built wheel, and without a purl they show up twice in the image SBOM ([#1630]).
 
 ### Removed
 
@@ -36,6 +45,7 @@ All notable changes to this project will be documented in this file.
 [#1616]: https://github.com/stackabletech/docker-images/pull/1616
 [#1620]: https://github.com/stackabletech/docker-images/pull/1620
 [#1623]: https://github.com/stackabletech/docker-images/pull/1623
+[#1630]: https://github.com/stackabletech/docker-images/pull/1630
 
 ## [26.7.0] - 2026-07-21
 

airflow/Dockerfile

@@ -216,22 +216,35 @@ fi
 
 # Needed for pandas S3 integration to e.g. write and read csv and parquet files to/from S3
 # TODO: s3fs may already be installed via the s3fs extra and constraints. Check if this explicit install is still needed.
-uv pip install --python ${VIRTUAL_ENV}/bin/python s3fs==${S3FS_VERSION} cyclonedx-bom==${CYCLONEDX_BOM_VERSION}
+uv pip install --python ${VIRTUAL_ENV}/bin/python s3fs==${S3FS_VERSION}
 # Needed for OIDC
 uv pip install --python ${VIRTUAL_ENV}/bin/python Flask_OIDC==2.2.0 Flask-OpenID==1.3.1
 
 uv pip install --python ${VIRTUAL_ENV}/bin/python /tmp/opa_auth_manager-0.1.0-py3-none-any.whl
 
 # Create the SBOM for Airflow
 # Important: All `pip install` commands must be above this line, otherwise the SBOM will be incomplete
-${VIRTUAL_ENV}/bin/cyclonedx-py environment --spec-version 1.5 --output-file /tmp/sbom.json
-uv pip uninstall cyclonedx-bom
-
-# Break circular dependencies by removing the apache-airflow dependency from the providers
+# cyclonedx-bom is installed into a throw-away environment instead of the Airflow one. It would
+# otherwise be part of the SBOM itself, and uninstalling it afterwards leaves its dependencies
+# behind in the image.
+uv venv /tmp/sbom-venv
+uv pip install --python /tmp/sbom-venv/bin/python cyclonedx-bom==${CYCLONEDX_BOM_VERSION}
+/tmp/sbom-venv/bin/cyclonedx-py environment --spec-version 1.5 --output-file /tmp/sbom.json "${VIRTUAL_ENV}"
+rm -rf /tmp/sbom-venv
+
+# Post-process the SBOM:
+#   * Break circular dependencies by removing the apache-airflow dependency from the providers.
+#   * Add the missing purl to the Airflow packages. They are installed from a locally built
+#     wheel, so cyclonedx-py records the file URL of that wheel instead of a purl.
 jq '.dependencies |= map(if .ref | test("^apache-airflow-providers-") then
     .dependsOn |= map(select(. != "apache-airflow=='${PRODUCT_VERSION}'"))
 else
     .
+end)
+| .components |= map(if (.purl | not) and (.name | test("^apache[-_]airflow")) then
+    .purl = "pkg:pypi/" + (.name | ascii_downcase | gsub("[-_.]+"; "-")) + "@" + .version
+else
+    .
 end)' /tmp/sbom.json > /stackable/app/airflow-${PRODUCT_VERSION}.cdx.json
 
 # Clean up build artifacts and temporary files to reduce image size

hbase/hbase/Dockerfile

@@ -112,6 +112,7 @@ mv hbase-assembly/target/bom.json /stackable/hbase-${NEW_VERSION}/hbase-${NEW_VE
   npm install --package-lock-only --no-audit --no-fund
   cdxgen \
     --type js \
+    --required-only \
     --spec-version "${CDXGEN_SPEC_VERSION}" \
     `# cdxgen would otherwise name the root component after the scratch directory` \
     --project-name hbase-webapps \

kafka/stackable/patches/3.9.1/0001-Add-CycloneDX-plugin.patch

@@ -1,17 +1,17 @@
-From 9f5ef4ff9f1868244326a56ea7c22c5c7c21253c Mon Sep 17 00:00:00 2001
+From 7e4a1e655312dd26f33bf0cb3a9e2d2b4b152f96 Mon Sep 17 00:00:00 2001
 From: Lukas Voetmand <lukas.voetmand@stackable.tech>
 Date: Thu, 17 Oct 2024 11:01:40 +0200
 Subject: Add CycloneDX plugin
 
 ---
- build.gradle | 42 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 42 insertions(+)
+ build.gradle | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index 6b4725d542..f7894f379e 100644
+index 6b4725d542..f60df17046 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -48,6 +48,48 @@ plugins {
+@@ -48,6 +48,50 @@ plugins {
    //  We are going to drop JDK8 support. Hence, the spotless is upgrade to newest version and be applied only if the build env is compatible with JDK 11.
    //  spotless 6.15.0+ has issue in runtime with JDK8 even through we define it with `apply:false`. see https://github.com/diffplug/spotless/issues/2156 for more details
    id 'com.diffplug.spotless' version "6.14.0" apply false
@@ -32,7 +32,9 @@ index 6b4725d542..f7894f379e 100644
 +    includeConfigs = ["runtimeClasspath"]
 +    // Exclude test components. This list needs to be checked and, if it changed, updated for every new Kafka version.
 +    // The list can be obtained by running `gradle projects | grep upgrade-system-tests`
++    // The jmh-benchmarks project is not shipped either and pulls in JMH, JUnit and Mockito.
 +    skipProjects = [
++      'jmh-benchmarks',
 +      'upgrade-system-tests-0100',
 +      'upgrade-system-tests-0101',
 +      'upgrade-system-tests-0102',

kafka/stackable/patches/3.9.1/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch

@@ -1,4 +1,4 @@
-From 4de60cd0100bffdd4b92133840ab25247187763d Mon Sep 17 00:00:00 2001
+From d750e93a81170a7f762618d31627507269002c0c Mon Sep 17 00:00:00 2001
 From: Lars Francke <git@lars-francke.de>
 Date: Thu, 12 Dec 2024 10:09:47 +0100
 Subject: Change Gradle to use the Nexus Build Repo
@@ -8,7 +8,7 @@ Subject: Change Gradle to use the Nexus Build Repo
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index f7894f379e..a176efd936 100644
+index f60df17046..056088da5d 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -20,7 +20,9 @@ import java.nio.charset.StandardCharsets
@@ -22,7 +22,7 @@ index f7894f379e..a176efd936 100644
    }
    apply from: "$rootDir/gradle/dependencies.gradle"
 
-@@ -168,7 +170,9 @@ ext {
+@@ -170,7 +172,9 @@ ext {
  allprojects {
 
    repositories {

kafka/stackable/patches/3.9.2/0001-Add-CycloneDX-plugin.patch

@@ -1,17 +1,17 @@
-From c19817ee82f7b90aac0a8be66e3efe17f268eb35 Mon Sep 17 00:00:00 2001
+From 6264a5a1c4115a92b1fe5b9a6ca9279abd02e59e Mon Sep 17 00:00:00 2001
 From: Lukas Voetmand <lukas.voetmand@stackable.tech>
 Date: Thu, 17 Oct 2024 11:01:40 +0200
 Subject: Add CycloneDX plugin
 
 ---
- build.gradle | 42 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 42 insertions(+)
+ build.gradle | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index 381e964d13..f51f410858 100644
+index 381e964d13..38e0f7c215 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -48,6 +48,48 @@ plugins {
+@@ -48,6 +48,50 @@ plugins {
    //  We are going to drop JDK8 support. Hence, the spotless is upgrade to newest version and be applied only if the build env is compatible with JDK 11.
    //  spotless 6.15.0+ has issue in runtime with JDK8 even through we define it with `apply:false`. see https://github.com/diffplug/spotless/issues/2156 for more details
    id 'com.diffplug.spotless' version "6.14.0" apply false
@@ -32,7 +32,9 @@ index 381e964d13..f51f410858 100644
 +    includeConfigs = ["runtimeClasspath"]
 +    // Exclude test components. This list needs to be checked and, if it changed, updated for every new Kafka version.
 +    // The list can be obtained by running `gradle projects | grep upgrade-system-tests`
++    // The jmh-benchmarks project is not shipped either and pulls in JMH, JUnit and Mockito.
 +    skipProjects = [
++      'jmh-benchmarks',
 +      'upgrade-system-tests-0100',
 +      'upgrade-system-tests-0101',
 +      'upgrade-system-tests-0102',

kafka/stackable/patches/3.9.2/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch

@@ -1,4 +1,4 @@
-From 343021661d7ed166a7555e6bce9da4805340f6cb Mon Sep 17 00:00:00 2001
+From 5981533c9e29ac164ac09f9821dd99be2f411c48 Mon Sep 17 00:00:00 2001
 From: Lars Francke <git@lars-francke.de>
 Date: Thu, 12 Dec 2024 10:09:47 +0100
 Subject: Change Gradle to use the Nexus Build Repo
@@ -8,7 +8,7 @@ Subject: Change Gradle to use the Nexus Build Repo
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index f51f410858..5ccd99e024 100644
+index 38e0f7c215..099432834c 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -20,7 +20,9 @@ import java.nio.charset.StandardCharsets
@@ -22,7 +22,7 @@ index f51f410858..5ccd99e024 100644
    }
    apply from: "$rootDir/gradle/dependencies.gradle"
 
-@@ -168,7 +170,9 @@ ext {
+@@ -170,7 +172,9 @@ ext {
  allprojects {
 
    repositories {

kafka/stackable/patches/4.1.1/0001-Add-CycloneDX-plugin.patch

@@ -1,17 +1,17 @@
-From c995ae95e5f725b19a7f4abdc28a86738aa59bf3 Mon Sep 17 00:00:00 2001
+From 0f9e14c6a625c20a80381cea71de855e4806fab0 Mon Sep 17 00:00:00 2001
 From: Malte Sander <malte.sander.it@gmail.com>
 Date: Thu, 25 Sep 2025 10:47:57 +0200
 Subject: Add CycloneDX plugin
 
 ---
- build.gradle | 41 +++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 41 insertions(+)
+ build.gradle | 47 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index 97250637b7..732c6c2a18 100644
+index 97250637b7..49f691ca79 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -41,6 +41,47 @@ plugins {
+@@ -41,6 +41,53 @@ plugins {
    id 'org.scoverage' version '8.0.3' apply false
    id 'com.gradleup.shadow' version '8.3.6' apply false
    id 'com.diffplug.spotless' version "6.25.0"
@@ -32,7 +32,13 @@ index 97250637b7..732c6c2a18 100644
 +    includeConfigs = ["runtimeClasspath"]
 +    // Exclude test components. This list needs to be checked and, if it changed, updated for every new Kafka version.
 +    // The list can be obtained by running `gradle projects | grep upgrade-system-tests`
++    // The jmh-benchmarks project is not shipped either and pulls in JMH, JUnit and Mockito,
++    // and neither are the test-common projects, which pull in JUnit.
 +    skipProjects = [
++      'jmh-benchmarks',
++      'test-common-internal-api',
++      'test-common-runtime',
++      'test-common-util',
 +      'upgrade-system-tests-0110',
 +      'upgrade-system-tests-10',
 +      'upgrade-system-tests-11',

kafka/stackable/patches/4.1.1/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch

@@ -1,4 +1,4 @@
-From 69d2bc1b5d6ab5232fcd93307426bb254b139d6e Mon Sep 17 00:00:00 2001
+From 55362f3ede127bf2a0a70ef07a01dca0ada37481 Mon Sep 17 00:00:00 2001
 From: Malte Sander <malte.sander.it@gmail.com>
 Date: Thu, 25 Sep 2025 10:50:07 +0200
 Subject: Change Gradle to use the Nexus Build Repo
@@ -8,7 +8,7 @@ Subject: Change Gradle to use the Nexus Build Repo
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index 732c6c2a18..e6c0449952 100644
+index 49f691ca79..d0129928db 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -18,7 +18,9 @@ import java.nio.charset.StandardCharsets
@@ -22,7 +22,7 @@ index 732c6c2a18..e6c0449952 100644
    }
    apply from: "$rootDir/gradle/dependencies.gradle"
 
-@@ -204,7 +206,9 @@ ext {
+@@ -210,7 +212,9 @@ ext {
  allprojects {
 
    repositories {

kafka/stackable/patches/4.1.1/0004-Include-jackson-dataformat-xml-dependency.patch

@@ -1,4 +1,4 @@
-From e908b273dc6844f5cd4e6af5bc16622674457d9d Mon Sep 17 00:00:00 2001
+From 5d5829e4beb6454515eb7c7747aff508f9573028 Mon Sep 17 00:00:00 2001
 From: Malte Sander <malte.sander.it@gmail.com>
 Date: Thu, 25 Sep 2025 11:13:20 +0200
 Subject: Include jackson dataformat xml dependency
@@ -9,10 +9,10 @@ Subject: Include jackson dataformat xml dependency
  2 files changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/build.gradle b/build.gradle
-index e6c0449952..c1aa6e2f55 100644
+index d0129928db..518ab172d1 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -180,13 +180,15 @@ ext {
+@@ -186,13 +186,15 @@ ext {
      libs.slf4jLog4j2,
      libs.junitPlatformLanucher,
      libs.jacksonDatabindYaml,
@@ -29,87 +29,87 @@ index e6c0449952..c1aa6e2f55 100644
    ]
 
    log4j2Libs = [
-@@ -1066,6 +1068,7 @@ project(':core') {
+@@ -1072,6 +1074,7 @@ project(':core') {
      implementation libs.jacksonDataformatCsv
      implementation libs.jacksonJDK8Datatypes
      implementation libs.jacksonDatabindYaml
 +    implementation libs.jacksonDatabindXml
      implementation libs.joptSimple
      implementation libs.jose4j
      implementation libs.metrics
-@@ -1484,6 +1487,7 @@ project(':group-coordinator') {
+@@ -1490,6 +1493,7 @@ project(':group-coordinator') {
      testImplementation project(':server-common').sourceSets.test.output
      testImplementation project(':coordinator-common').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoCore
      testImplementation testLog4j2Libs
-@@ -1606,6 +1610,7 @@ project(':test-common:test-common-runtime') {
+@@ -1612,6 +1616,7 @@ project(':test-common:test-common-runtime') {
      implementation libs.junitPlatformLanucher
      implementation libs.junitJupiter
      implementation libs.jacksonDatabindYaml
 +    implementation libs.jacksonDatabindXml
      implementation libs.slf4jApi
 
      testImplementation libs.junitJupiter
-@@ -2079,6 +2084,7 @@ project(':raft') {
+@@ -2085,6 +2090,7 @@ project(':raft') {
      testImplementation project(':clients')
      testImplementation project(':clients').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoCore
      testImplementation libs.jqwik
-@@ -2176,6 +2182,7 @@ project(':server-common') {
+@@ -2182,6 +2188,7 @@ project(':server-common') {
      testImplementation project(':clients')
      testImplementation project(':clients').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoCore
      testImplementation testLog4j2Libs
-@@ -2317,6 +2324,7 @@ project(':storage') {
+@@ -2323,6 +2330,7 @@ project(':storage') {
      testImplementation project(':transaction-coordinator')
      testImplementation libs.hamcrest
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoCore
      testImplementation libs.bcpkix
-@@ -2634,6 +2642,7 @@ project(':shell') {
+@@ -2640,6 +2648,7 @@ project(':shell') {
      testImplementation project(':server-common')
      testImplementation project(':server-common').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation testLog4j2Libs
 
-@@ -2683,6 +2692,7 @@ project(':streams') {
+@@ -2689,6 +2698,7 @@ project(':streams') {
 
      testImplementation project(':clients').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.bcpkix
      testImplementation libs.hamcrest
-@@ -2828,6 +2838,7 @@ project(':streams:streams-scala') {
+@@ -2834,6 +2844,7 @@ project(':streams:streams-scala') {
      testImplementation project(':streams:test-utils')
 
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoJunitJupiter // supports MockitoExtension
      testImplementation testLog4j2Libs
-@@ -2932,6 +2943,7 @@ project(':streams:test-utils') {
+@@ -2938,6 +2949,7 @@ project(':streams:test-utils') {
 
      testImplementation project(':clients').sourceSets.test.output
      testImplementation libs.jacksonDatabindYaml
 +    testImplementation libs.jacksonDatabindXml
      testImplementation libs.junitJupiter
      testImplementation libs.mockitoCore
      testImplementation libs.hamcrest
-@@ -3610,6 +3622,7 @@ project(':connect:runtime') {
+@@ -3616,6 +3628,7 @@ project(':connect:runtime') {
      testImplementation project(':server-common').sourceSets.test.output
 
      testImplementation libs.jacksonDatabindYaml