stackabletech · dervoeti · Sep 10, 2026 · Sep 10, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -27,7 +27,21 @@ All notable changes to this project will be documented in this file.
 - kafka: Exclude the non-runtime configurations and the projects that are not shipped from the SBOM ([#1630]).
 - opensearch: Exclude the test framework, the test fixtures, the QA projects and the benchmarks from the SBOM of `3.1.0` and `3.4.0` ([#1630]).
 - opensearch: Restrict the SBOM of the Prometheus exporter to the runtime dependencies ([#1630]).
-- opensearch-dashboards: Exclude the devDependencies from the SBOM ([#1630]).
+- opensearch-dashboards: Pass `--required-only` to cdxgen ([#1630]). This turned out to have no
+  effect, see [#1635].
+- opensearch-dashboards: Pass `--type js` to cdxgen instead of the non-existing `--target` option.
+  cdxgen silently ignored it and auto-detected every ecosystem in the source tree, which added the
+  GitHub Actions workflows and the Gradle and Python files of the build tooling to the SBOM
+  ([#1635]).
+- kafka: Include the `releaseOnly` configuration in the SBOM of `4.1.1` and `4.2.1`. The `core` and
+  `tools` projects declare the Log4j runtime bindings there, so they were shipped in `libs/` without
+  being part of the SBOM ([#1635]).
+- kafka: Exclude the `generator`, integration test and Connect test plugin projects from the SBOM ([#1635]).
+- opensearch: Exclude the `build-tools` project and the remaining unshipped projects from the SBOM of `3.1.0`
+  and `3.4.0` ([#1635]).
+- airflow, superset: Add the missing purls to all packages that are installed from a local wheel or
+  a direct URL, and normalize the names in the purls as defined in the Python packaging
+  specification ([#1635]).
 - hbase: Exclude the optional npm dependencies from the web UI SBOM ([#1630]).
 - airflow, superset: Create the Python SBOM from a separate environment, so that neither cyclonedx-bom nor its dependencies end up in the SBOM and in the image ([#1630]).
 - airflow, superset: Add the missing purl to the Airflow and Superset packages in the Python SBOM. They are installed from a locally built wheel, and without a purl they show up twice in the image SBOM ([#1630]).
@@ -46,6 +60,7 @@ All notable changes to this project will be documented in this file.
 [#1620]: https://github.com/stackabletech/docker-images/pull/1620
 [#1623]: https://github.com/stackabletech/docker-images/pull/1623
 [#1630]: https://github.com/stackabletech/docker-images/pull/1630
+[#1635]: https://github.com/stackabletech/docker-images/pull/1635
 
 ## [26.7.0] - 2026-07-21
 

diff --git a/airflow/Dockerfile b/airflow/Dockerfile
@@ -234,15 +234,25 @@ rm -rf /tmp/sbom-venv
 
 # Post-process the SBOM:
 #   * Break circular dependencies by removing the apache-airflow dependency from the providers.
-#   * Add the missing purl to the Airflow packages. They are installed from a locally built
-#     wheel, so cyclonedx-py records the file URL of that wheel instead of a purl.
-jq '.dependencies |= map(if .ref | test("^apache-airflow-providers-") then
+#   * Add the missing purls. Packages that are installed from a local wheel or a direct URL
+#     (apache-airflow, opa-auth-manager, pip) get no purl from cyclonedx-py, because it records
+#     the file URL instead. Without a purl they show up twice in the image SBOM.
+#   * Normalize the names in the purls as defined in the Python packaging specification.
+#     cyclonedx-py keeps the name as it is written in the metadata (`pkg:pypi/zope.event`),
+#     while Syft normalizes it (`pkg:pypi/zope-event`), which again results in duplicates.
+jq 'def normalize_name: ascii_downcase | gsub("[-_.]+"; "-");
+.dependencies |= map(if .ref | test("^apache-airflow-providers-") then
     .dependsOn |= map(select(. != "apache-airflow=='${PRODUCT_VERSION}'"))
 else
     .
 end)
-| .components |= map(if (.purl | not) and (.name | test("^apache[-_]airflow")) then
-    .purl = "pkg:pypi/" + (.name | ascii_downcase | gsub("[-_.]+"; "-")) + "@" + .version
+| .components |= map(if (.purl | not) and (.name != null) and (.version != null) then
+    .purl = "pkg:pypi/" + (.name | normalize_name) + "@" + .version
+else
+    .
+end
+| if (.purl // "") | startswith("pkg:pypi/") then
+    .purl |= sub("^pkg:pypi/(?<name>[^@]+)"; "pkg:pypi/" + (.name | normalize_name))
 else
     .
 end)' /tmp/sbom.json > /stackable/app/airflow-${PRODUCT_VERSION}.cdx.json

diff --git a/kafka/stackable/patches/3.9.1/0001-Add-CycloneDX-plugin.patch b/kafka/stackable/patches/3.9.1/0001-Add-CycloneDX-plugin.patch
@@ -1,17 +1,17 @@
-From 7e4a1e655312dd26f33bf0cb3a9e2d2b4b152f96 Mon Sep 17 00:00:00 2001
+From c7a4c4cd14dac4be0f195d2e1ff1f6e38e12758d Mon Sep 17 00:00:00 2001
 From: Lukas Voetmand <lukas.voetmand@stackable.tech>
 Date: Thu, 17 Oct 2024 11:01:40 +0200
 Subject: Add CycloneDX plugin
 
 ---
- build.gradle | 44 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 44 insertions(+)
+ build.gradle | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index 6b4725d542..f60df17046 100644
+index 6b4725d5429..41954b3d3a6 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -48,6 +48,50 @@ plugins {
+@@ -48,6 +48,57 @@ plugins {
    //  We are going to drop JDK8 support. Hence, the spotless is upgrade to newest version and be applied only if the build env is compatible with JDK 11.
    //  spotless 6.15.0+ has issue in runtime with JDK8 even through we define it with `apply:false`. see https://github.com/diffplug/spotless/issues/2156 for more details
    id 'com.diffplug.spotless' version "6.14.0" apply false
@@ -30,11 +30,18 @@ index 6b4725d542..f60df17046 100644
 +    // The file format generated, can be xml, json or all for generating both. Defaults to 'all'
 +    outputFormat = "json"
 +    includeConfigs = ["runtimeClasspath"]
-+    // Exclude test components. This list needs to be checked and, if it changed, updated for every new Kafka version.
-+    // The list can be obtained by running `gradle projects | grep upgrade-system-tests`
-+    // The jmh-benchmarks project is not shipped either and pulls in JMH, JUnit and Mockito.
++    // Exclude the projects that are not shipped. This list needs to be checked and, if it changed,
++    // updated for every new Kafka version. The list of projects can be obtained by running
++    // `gradle projects`.
++    //   * jmh-benchmarks pulls in JMH, JUnit and Mockito.
++    //   * generator is a build-time code generator for the message protocol. It pulls in Jackson,
++    //     but its own dependencies never reach the distribution.
++    //   * connect:test-plugins pulls in JGit, Bouncy Castle, Apache MINA sshd and commons-codec,
++    //     none of which are shipped.
 +    skipProjects = [
++      'generator',
 +      'jmh-benchmarks',
++      'test-plugins',
 +      'upgrade-system-tests-0100',
 +      'upgrade-system-tests-0101',
 +      'upgrade-system-tests-0102',

diff --git a/kafka/stackable/patches/3.9.1/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch b/kafka/stackable/patches/3.9.1/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch
@@ -1,4 +1,4 @@
-From d750e93a81170a7f762618d31627507269002c0c Mon Sep 17 00:00:00 2001
+From f0ec37c057c7c37997f4bf71f1b4e475e8621e6c Mon Sep 17 00:00:00 2001
 From: Lars Francke <git@lars-francke.de>
 Date: Thu, 12 Dec 2024 10:09:47 +0100
 Subject: Change Gradle to use the Nexus Build Repo
@@ -8,7 +8,7 @@ Subject: Change Gradle to use the Nexus Build Repo
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index f60df17046..056088da5d 100644
+index 41954b3d3a6..6461e7cd37e 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -20,7 +20,9 @@ import java.nio.charset.StandardCharsets
@@ -22,7 +22,7 @@ index f60df17046..056088da5d 100644
    }
    apply from: "$rootDir/gradle/dependencies.gradle"
 
-@@ -170,7 +172,9 @@ ext {
+@@ -177,7 +179,9 @@ ext {
  allprojects {
 
    repositories {

diff --git a/kafka/stackable/patches/3.9.1/0003-Build-custom-Stackable-version.patch b/kafka/stackable/patches/3.9.1/0003-Build-custom-Stackable-version.patch
@@ -1,4 +1,4 @@
-From 89fe680ede7726e0df32f0ba1fb90a4216af7c69 Mon Sep 17 00:00:00 2001
+From f6c5706e8ce7d409384213db19b7be96e2c84296 Mon Sep 17 00:00:00 2001
 From: dervoeti <lukas.krug@stackable.tech>
 Date: Wed, 18 Jun 2025 12:17:53 +0200
 Subject: Build custom Stackable version
@@ -15,7 +15,7 @@ Subject: Build custom Stackable version
  8 files changed, 8 insertions(+), 8 deletions(-)
 
 diff --git a/docs/configuration.html b/docs/configuration.html
-index f7c99623de..266236b54a 100644
+index f7c99623de9..266236b54aa 100644
 --- a/docs/configuration.html
 +++ b/docs/configuration.html
 @@ -296,7 +296,7 @@
@@ -28,7 +28,7 @@ index f7c99623de..266236b54a 100644
        </tbody></table>
      </li>
 diff --git a/docs/js/templateData.js b/docs/js/templateData.js
-index a1ed4601c7..57c854db36 100644
+index a1ed4601c78..57c854db36d 100644
 --- a/docs/js/templateData.js
 +++ b/docs/js/templateData.js
 @@ -19,6 +19,6 @@ limitations under the License.
@@ -40,7 +40,7 @@ index a1ed4601c7..57c854db36 100644
      "scalaVersion": "2.13"
  };
 diff --git a/gradle.properties b/gradle.properties
-index 05598137fd..3f660d4ee5 100644
+index 05598137fd5..3f660d4ee51 100644
 --- a/gradle.properties
 +++ b/gradle.properties
 @@ -23,7 +23,7 @@ group=org.apache.kafka
@@ -53,7 +53,7 @@ index 05598137fd..3f660d4ee5 100644
  # Adding swaggerVersion in gradle.properties to have a single version in place for swagger
  # New version of Swagger 2.2.14 requires minimum JDK 11.
 diff --git a/streams/quickstart/java/pom.xml b/streams/quickstart/java/pom.xml
-index 3d404de9c3..92735dffbc 100644
+index 3d404de9c37..92735dffbc8 100644
 --- a/streams/quickstart/java/pom.xml
 +++ b/streams/quickstart/java/pom.xml
 @@ -26,7 +26,7 @@
@@ -66,7 +66,7 @@ index 3d404de9c3..92735dffbc 100644
      </parent>
 
 diff --git a/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml b/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
-index 26af0e1dc3..b55640c1f0 100644
+index 26af0e1dc39..b55640c1f01 100644
 --- a/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
 +++ b/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
 @@ -29,7 +29,7 @@
@@ -79,7 +79,7 @@ index 26af0e1dc3..b55640c1f0 100644
      </properties>
 
 diff --git a/streams/quickstart/pom.xml b/streams/quickstart/pom.xml
-index f524e00445..05e8eee91a 100644
+index f524e00445f..05e8eee91a4 100644
 --- a/streams/quickstart/pom.xml
 +++ b/streams/quickstart/pom.xml
 @@ -22,7 +22,7 @@
@@ -92,7 +92,7 @@ index f524e00445..05e8eee91a 100644
      <name>Kafka Streams :: Quickstart</name>
 
 diff --git a/tests/kafkatest/__init__.py b/tests/kafkatest/__init__.py
-index a8e4d4515c..36068eeb1a 100644
+index a8e4d4515ce..36068eeb1ab 100644
 --- a/tests/kafkatest/__init__.py
 +++ b/tests/kafkatest/__init__.py
 @@ -22,4 +22,4 @@
@@ -102,7 +102,7 @@ index a8e4d4515c..36068eeb1a 100644
 -__version__ = '3.9.1'
 +__version__ = '3.9.1-stackable0.0.0-dev'
 diff --git a/tests/kafkatest/version.py b/tests/kafkatest/version.py
-index 99cb278226..cd8bcfab4b 100644
+index 99cb2782265..cd8bcfab4b9 100644
 --- a/tests/kafkatest/version.py
 +++ b/tests/kafkatest/version.py
 @@ -122,7 +122,7 @@ def get_version(node=None):

diff --git a/kafka/stackable/patches/3.9.2/0001-Add-CycloneDX-plugin.patch b/kafka/stackable/patches/3.9.2/0001-Add-CycloneDX-plugin.patch
@@ -1,17 +1,17 @@
-From 6264a5a1c4115a92b1fe5b9a6ca9279abd02e59e Mon Sep 17 00:00:00 2001
+From ff9091de32175669976e319117ca5b9e6271dde2 Mon Sep 17 00:00:00 2001
 From: Lukas Voetmand <lukas.voetmand@stackable.tech>
 Date: Thu, 17 Oct 2024 11:01:40 +0200
 Subject: Add CycloneDX plugin
 
 ---
- build.gradle | 44 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 44 insertions(+)
+ build.gradle | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index 381e964d13..38e0f7c215 100644
+index 381e964d13e..c4bbde12405 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -48,6 +48,50 @@ plugins {
+@@ -48,6 +48,57 @@ plugins {
    //  We are going to drop JDK8 support. Hence, the spotless is upgrade to newest version and be applied only if the build env is compatible with JDK 11.
    //  spotless 6.15.0+ has issue in runtime with JDK8 even through we define it with `apply:false`. see https://github.com/diffplug/spotless/issues/2156 for more details
    id 'com.diffplug.spotless' version "6.14.0" apply false
@@ -30,11 +30,18 @@ index 381e964d13..38e0f7c215 100644
 +    // The file format generated, can be xml, json or all for generating both. Defaults to 'all'
 +    outputFormat = "json"
 +    includeConfigs = ["runtimeClasspath"]
-+    // Exclude test components. This list needs to be checked and, if it changed, updated for every new Kafka version.
-+    // The list can be obtained by running `gradle projects | grep upgrade-system-tests`
-+    // The jmh-benchmarks project is not shipped either and pulls in JMH, JUnit and Mockito.
++    // Exclude the projects that are not shipped. This list needs to be checked and, if it changed,
++    // updated for every new Kafka version. The list of projects can be obtained by running
++    // `gradle projects`.
++    //   * jmh-benchmarks pulls in JMH, JUnit and Mockito.
++    //   * generator is a build-time code generator for the message protocol. It pulls in Jackson,
++    //     but its own dependencies never reach the distribution.
++    //   * connect:test-plugins pulls in JGit, Bouncy Castle, Apache MINA sshd and commons-codec,
++    //     none of which are shipped.
 +    skipProjects = [
++      'generator',
 +      'jmh-benchmarks',
++      'test-plugins',
 +      'upgrade-system-tests-0100',
 +      'upgrade-system-tests-0101',
 +      'upgrade-system-tests-0102',

diff --git a/kafka/stackable/patches/3.9.2/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch b/kafka/stackable/patches/3.9.2/0002-Change-Gradle-to-use-the-Nexus-Build-Repo.patch
@@ -1,4 +1,4 @@
-From 5981533c9e29ac164ac09f9821dd99be2f411c48 Mon Sep 17 00:00:00 2001
+From f195fc9a4b3003edafc1197b421f76e5c710ab76 Mon Sep 17 00:00:00 2001
 From: Lars Francke <git@lars-francke.de>
 Date: Thu, 12 Dec 2024 10:09:47 +0100
 Subject: Change Gradle to use the Nexus Build Repo
@@ -8,7 +8,7 @@ Subject: Change Gradle to use the Nexus Build Repo
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/build.gradle b/build.gradle
-index 38e0f7c215..099432834c 100644
+index c4bbde12405..eee73a29454 100644
 --- a/build.gradle
 +++ b/build.gradle
 @@ -20,7 +20,9 @@ import java.nio.charset.StandardCharsets
@@ -22,7 +22,7 @@ index 38e0f7c215..099432834c 100644
    }
    apply from: "$rootDir/gradle/dependencies.gradle"
 
-@@ -170,7 +172,9 @@ ext {
+@@ -177,7 +179,9 @@ ext {
  allprojects {
 
    repositories {

diff --git a/kafka/stackable/patches/3.9.2/0003-Build-custom-Stackable-version.patch b/kafka/stackable/patches/3.9.2/0003-Build-custom-Stackable-version.patch
@@ -1,4 +1,4 @@
-From 944ef05a7468a0437c0da923898aecae983eb5f6 Mon Sep 17 00:00:00 2001
+From ba4b38f28330dad8a60a56698bf51c9dbd8e74bf Mon Sep 17 00:00:00 2001
 From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
 Date: Mon, 1 Jun 2026 08:52:19 +0200
 Subject: Build custom Stackable version
@@ -25,7 +25,7 @@ for d in $(ls -d */); do find $d -type f -exec sed -i 's/3\.9\.2/3.9.2-stackable
  9 files changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/docs/getting-started/upgrade.md b/docs/getting-started/upgrade.md
-index d7347b3ee8..7f888fc90a 100644
+index d7347b3ee83..7f888fc90a1 100644
 --- a/docs/getting-started/upgrade.md
 +++ b/docs/getting-started/upgrade.md
 @@ -58,7 +58,7 @@ If you are upgrading from version 2.4.0 or above, and you have not overridden th
@@ -38,7 +38,7 @@ index d7347b3ee8..7f888fc90a 100644
    * There is a new server configuration, `alter.config.policy.kraft.compatibility.enable`, which ensures that an AlterConfigPolicy is invoked consistently between KRaft and ZooKeeper modes. To enable this behavior, set the property to `true` in `server.properties`. For backward compatibility, the default value is `false`. See [KIP-1252](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=399279475) for more details.
 
 diff --git a/docs/operations/kraft.md b/docs/operations/kraft.md
-index a63ce05d4e..a8caef2d2b 100644
+index a63ce05d4ed..a8caef2d2bb 100644
 --- a/docs/operations/kraft.md
 +++ b/docs/operations/kraft.md
 @@ -275,7 +275,7 @@ In general, the migration process passes through several phases.
@@ -51,7 +51,7 @@ index a63ce05d4e..a8caef2d2b 100644
 
 
 diff --git a/gradle.properties b/gradle.properties
-index 3c674c89c1..24bf3d2259 100644
+index 3c674c89c1d..24bf3d22593 100644
 --- a/gradle.properties
 +++ b/gradle.properties
 @@ -22,7 +22,7 @@ group=org.apache.kafka
@@ -64,7 +64,7 @@ index 3c674c89c1..24bf3d2259 100644
  # Adding swaggerVersion in gradle.properties to have a single version in place for swagger
  # New version of Swagger 2.2.14 requires minimum JDK 11.
 diff --git a/kafka-merge-pr.py b/kafka-merge-pr.py
-index 4ac7434065..4f5f69d872 100755
+index 4ac7434065c..4f5f69d872b 100755
 --- a/kafka-merge-pr.py
 +++ b/kafka-merge-pr.py
 @@ -70,7 +70,7 @@ TEMP_BRANCH_PREFIX = "PR_TOOL"
@@ -77,7 +77,7 @@ index 4ac7434065..4f5f69d872 100755
  ORIGINAL_HEAD = ""
 
 diff --git a/streams/quickstart/java/pom.xml b/streams/quickstart/java/pom.xml
-index f8d1bd9e54..2ee0861269 100644
+index f8d1bd9e54f..2ee08612691 100644
 --- a/streams/quickstart/java/pom.xml
 +++ b/streams/quickstart/java/pom.xml
 @@ -26,7 +26,7 @@
@@ -90,7 +90,7 @@ index f8d1bd9e54..2ee0861269 100644
      </parent>
 
 diff --git a/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml b/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
-index b62ab64acf..3d3d881096 100644
+index b62ab64acfd..3d3d8810966 100644
 --- a/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
 +++ b/streams/quickstart/java/src/main/resources/archetype-resources/pom.xml
 @@ -29,7 +29,7 @@
@@ -103,7 +103,7 @@ index b62ab64acf..3d3d881096 100644
      </properties>
 
 diff --git a/streams/quickstart/pom.xml b/streams/quickstart/pom.xml
-index ac81ea06bb..1686b2bd56 100644
+index ac81ea06bb4..1686b2bd566 100644
 --- a/streams/quickstart/pom.xml
 +++ b/streams/quickstart/pom.xml
 @@ -22,7 +22,7 @@
@@ -116,7 +116,7 @@ index ac81ea06bb..1686b2bd56 100644
      <name>Kafka Streams :: Quickstart</name>
 
 diff --git a/tests/kafkatest/__init__.py b/tests/kafkatest/__init__.py
-index 1362dad9ca..e20c655bbf 100644
+index 1362dad9ca9..e20c655bbf5 100644
 --- a/tests/kafkatest/__init__.py
 +++ b/tests/kafkatest/__init__.py
 @@ -22,4 +22,4 @@
@@ -126,7 +126,7 @@ index 1362dad9ca..e20c655bbf 100644
 -__version__ = '3.9.2'
 +__version__ = '3.9.2-stackable0.0.0-dev'
 diff --git a/tests/kafkatest/version.py b/tests/kafkatest/version.py
-index fa301e6a8d..1980c35d11 100644
+index fa301e6a8dd..1980c35d115 100644
 --- a/tests/kafkatest/version.py
 +++ b/tests/kafkatest/version.py
 @@ -122,7 +122,7 @@ def get_version(node=None):