<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1">
  <metadata>
    <component bom-ref="acme-application-1.0" type="application">
      <name>Acme Application</name>
      <version>1.0</version>
    </component>
  </metadata>
  <components>
    <component bom-ref="pkg:maven/partner/shaded-library@1.0" type="library">
      <name>Partner Shaded Library</name>
      <version>1.0</version>
      <purl>pkg:maven/partner/shaded-library@1.0</purl>
      <components>
        <component bom-ref="pkg:maven/ossproject/library@2.0" type="library">
          <name>Some Opensource Library</name>
          <version>2.0</version>
          <purl>pkg:maven/ossproject/library@2.0</purl>
        </component>
      </components>
    </component>
    <component bom-ref="pkg:maven/acme/library@3.0" type="library">
      <name>Acme Library</name>
      <version>2.0</version>
      <purl>pkg:maven/acme/library@3.0</purl>
    </component>
  </components>
  <dependencies>
    <dependency ref="acme-application-1.0">
      <dependency ref="pkg:maven/partner/shaded-library@1.0"></dependency>
      <dependency ref="pkg:maven/acme/library@3.0"></dependency>
    </dependency>
  </dependencies>
  <compositions>
    <composition bom-ref="composition-1">
      <aggregate>complete</aggregate>
      <assemblies>
        <assembly ref="pkg:maven/partner/shaded-library@1.0"></assembly>
      </assemblies>
      <dependencies>
        <dependency ref="acme-application-1.0"></dependency>
      </dependencies>
    </composition>
    <composition>
      <aggregate>unknown</aggregate>
      <assemblies>
        <assembly ref="pkg:maven/acme/library@3.0"></assembly>
      </assemblies>
    </composition>
    <composition>
      <aggregate>incomplete_first_party_only</aggregate>
      <assemblies>
        <assembly ref="vulnerability-1"></assembly>
      </assemblies>
    </composition>
  </compositions>
  <vulnerabilities>
    <vulnerability bom-ref="vulnerability-1">
      <id>ACME-12345</id>
      <source>
        <name>Acme Inc</name>
      </source>
    </vulnerability>
  </vulnerabilities>
</bom>
