Validate that Maven Bill-of-Materials (BOM) components actually work together.

Pre-alpha. Not yet suitable for general use.

Bombast is under active development and breaking changes are expected. APIs, CLI options, configuration format, and caching behavior may all change without notice until a stable 1.0 release.

Intended trajectory: Bombast is being built as a principled replacement for the pom-scijava mega-melt, the ad-hoc shell-script process that validates managed components before each pom-scijava release. The goal is to make BOM validation reproducible, configurable, and automatable outside of any single repository's CI infrastructure, and usable for any Maven BOM, not just SciJava's.

Given a Maven BOM (Bill of Materials) coordinate, bombast:

1. Loads all managed components from the BOM.
2. Resolves source code for each component via SCM metadata in the POM.
3. Rewrites component POMs to pin every dependency to the version declared in the BOM, overriding whatever the component's own POM or parent chain says.
4. Optionally tests binary compatibility of the already-published JARs against the pinned dependency set (catches runtime breakage without rebuilding).
5. Rebuilds each component from source and runs its test suite.
6. Reports which components succeeded, failed, or errored, with timing and build logs saved per component.

The result is a clear picture of whether a BOM's declared versions are mutually consistent — before that BOM is shipped.

• Python 3.10+
• Maven (mvn) on PATH
• Git on PATH

System Java is not required—bombast auto-detects and downloads the right version of Java per component via jgo.

As a command-line tool:

uv tool install git+https://github.com/scijava/bombast

As a dependency:

uv add git+https://github.com/scijava/bombast

# Validate all components in pom-scijava 37.0.0
bombast org.scijava:pom-scijava:37.0.0

# Validate only scijava-group artifacts
bombast -i "org.scijava:*" org.scijava:pom-scijava:37.0.0

# Inject a candidate version change, and validate only affected components
bombast -c "org.scijava:scijava-common:2.100.0" -p org.scijava:pom-scijava:37.0.0

# Validate a local BOM under development
bombast /path/to/local/bom

bombast [OPTIONS] BOM

BOM is a Maven G:A:V coordinate or a path to a local directory containing a pom.xml that declares <dependencyManagement>.

Create a bombast.toml for reusable settings:

[filter]
includes = ["org.scijava:*"]
excludes = ["org.scijava:legacy-*"]

[build]
min-java-version = 11
properties = {"skipSomePlugin" = "true"}

[skip-tests]
# Run build but skip tests for known-broken components
components = ["org.example:legacy-lib"]

[remove-tests]
# Remove specific test classes before building
"org.example:flaky-component" = ["FlakyIntegrationTest"]

[components."org.example:component"]
# Override Java version for a specific component
"java-version" = 17

Pass it with --config bombast.toml.

import bombast

report = bombast.validate("org.scijava:pom-scijava:37.0.0")
print(report.summary())

for result in report.failures:
    print(result.component.coordinate, result.status)

Bombast uses a two-pronged approach to enforce BOM versions regardless of what a component's own POM declares:

1. Inject dependency management — the full BOM <dependencyManagement> is inserted directly into each component's POM, taking precedence over anything inherited from parent POMs.
2. Hardcode dependency versions — every <dependency> element that appears in the BOM has its <version> written in directly, overriding any property expressions or omitted-version inheritance.

This is intentionally aggressive: the goal is to test whether the BOM's declared versions actually work, not whether the component happens to pull in compatible versions through its own resolution logic.

Bombast caches two things under ~/.cache/bombast/:

• repos/ — bare Git clones of component repositories, reused across runs.
• success/ — fingerprints of successful builds. If a component's BOM fingerprint hasn't changed since the last successful build, it is skipped (unless the version is a SNAPSHOT).

Unlicense — public domain.