Software Bill of Materials
An SBOM is a software bill of materials listing all dependencies (direct and transitive) with versions/licenses/vulnerability info.
Purpose
Track the full dependency picture, supporting vulnerability response and compliance audits.
Mechanism
Formats: SPDX/CycloneDX. Lists component names, versions, suppliers, licenses, and dependency relationships. Generation tools scan package managers and build outputs. Matching SBOMs against vulnerability databases quickly pinpoints affected components.
Use cases
- Dependency tracking
- Vulnerability response
- Compliance