SBOM

Problem

A critical vulnerability is announced in library X. Your organization has 800 applications. Which ones contain X? If nobody knows what software is inside each application, answering can take days.

Solution — Software Bill of Materials

An SBOM is a structured inventory of components and their exact versions, commonly a JSON file following a standard such as CycloneDX or SPDX. The build pipeline generates it automatically from resolved dependencies or the built application and stores it with that release. When a dependency is upgraded, the next build gets a new SBOM; each release keeps its own inventory of the versions it actually contains.

Application A
├─ Library X 2.1
├─ Library Y 5.0
└─ Runtime Z

Core idea: an SBOM tells you what software components an application contains.