Generate CycloneDX 1.6 SBOM to meet CISA 2026 Minimum Elements

Connector/Node.js must produce a CycloneDX 1.6 JSON SBOM for every published npm package version.

To do

• Generate the SBOM as part of the build/release (e.g. @cyclonedx/cyclonedx-npm with --spec-version 1.6).
• Name the file <artifact_name>.cdx.json, matching the *.cdx.json pattern expected by the security team scanners (MXS-5611).
• Metadata: specVersion 1.6, generator tool name/version (metadata.tools), author/supplier MariaDB plc, timestamp, lifecycle build, unique serial number, package_name property identifying the artifact.
• Main component pkg:npm/mariadb@<version> with its SPDX license.
• Every direct and transitive production dependency (from package-lock.json) with version, supplier, valid purl and SPDX license.
• Dependency relationships between components.
• CI: generate and validate the SBOM (CycloneDX 1.6 schema, purl, SPDX) and fail the build if invalid.