sbomify

No entries match these filters. Clear filters

1. v26.11.0 Nov 3, 2026 · issue 130

   sbomify adds AI-advisory approval gates, agent-token triage queuing, cross-product release linking, CRA Article 14CRA Article 14A mandatory incident-reporting obligation in the EU Cyber Resilience Act requiring manufacturers of products with digital elements to notify authorities of actively exploited vulnerabilities within 24 hours of discovery. reporting, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-aware vulnerability Trends⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONDockergit

   Docker copy

   $ docker pull ghcr.io/sbomify/sbomify:v26.11.0

   git copy

   $ git clone --branch v26.11.0 https://github.com/sbomify/sbomify.git
   # already have the repo? check out this version:
   $ git checkout v26.11.0

   published under the project's GitHub account · checked 4 Nov

   • Adds human-review gates for AI agent actions: changes an AI agent makes to a published advisory now require human approval before they go live, and agent tokens can queue triage decisions for human review by submitting with review=true.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • A release can now link to another product's release, with linked releases manageable from the release page.
   • sbomify now prepares, tracks, and records CRA Article 14 reports for submission to ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences.'s portal.
   • The trust center advisory page is redesigned around an 'Am I affected?' workflow.
   • VEX improvements: VEX-suppressed findings are now shown everywhere vulnerabilities are counted, including the Trends tab; the VEX statement cap is raised to 50,000 with a warning displayed when that limit is approached; and the VEX review view now shows which versions a submission applies to.

   +3 more show less

   • Each API token's type is now shown in the token list.
   • Vulnerability IDs are now linked to sbomify Insights.
   • The manufacturer's keyless Sigstore signature is now preserved on CRA export bundles.
   • Adds human-review gates for AI agent actions: changes an AI agent makes to a published advisory now require human approval before they go live, and agent tokens can queue triage decisions for human review by submitting with review=true.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • A release can now link to another product's release, with linked releases manageable from the release page.
   • sbomify now prepares, tracks, and records CRA Article 14 reports for submission to ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences.'s portal.

   5 more in Everything

2. 26.10.0 Oct 26, 2026 · issue 121

   API surface changed: +3 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +3 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + PATCH /api/v1/advisories/{advisory_id}/products/{product_id}/status
   • + PATCH /api/v1/advisories/{advisory_id}/statuses/{status_id}
   • + POST /api/v1/advisories/{advisory_id}/products
   • ~ GET /api/v1/advisories/{advisory_id}: response schema changed
   • ~ PATCH /api/v1/advisories/{advisory_id}: request body changed; response schema changed
   • ~ POST /api/v1/advisories/: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/publish: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/updates: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/withdraw: response schema changed
   • New endpoint PATCH /api/v1/advisories/{advisory_id}/products/{product_id}/status⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint PATCH /api/v1/advisories/{advisory_id}/statuses/{status_id}
   • New endpoint POST /api/v1/advisories/{advisory_id}/products

   3 details in Everything

3. v26.10.0 Oct 24, 2026 · issue 120

   sbomify v26.10.0 adds a Vulnerabilities page, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. approval queue for AI agents, Operator role, Vanta integration, and live WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v26.10.0 https://github.com/sbomify/sbomify.git
   # already have the repo? check out this version:
   $ git checkout v26.10.0

   └──▷ USE IT
   Enable Vanta integration in a self-hosted deployment to sync compliance frameworks and controls.
   .env copy

   VANTA_*=<your-vanta-credentials>

   Tune Redis connection pool limits to support higher concurrency in a self-hosted instance.
   .env copy

   REDIS_CACHE_MAX_CONNECTIONS=50
   REDIS_CACHE_POOL_TIMEOUT=10

   • Adds Vanta integration, enabled via new VANTA_* environment variables, to sync frameworks and controls from Vanta with optional Trust Center publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds REDIS_CACHE_MAX_CONNECTIONS and REDIS_CACHE_POOL_TIMEOUT environment variables to tune Redis connection pooling, LOG_MAX_SIZE and LOG_MAX_FILE environment variables for log rotation control, and KEYCLOAK_PUBLIC_URL environment variable for self-hosted Keycloak configuration.
   • Adds history_limit query parameter and all_runs_total field to GET /plugins/assessments/{sbom_id}, capping all_runs at 50 runs.
   • Adds Invitations API on both v1 and v2.
   • Adds a Vulnerabilities page with a deduplicated list of open findings, release and SBOM-version filters, and Fix/Triage prompts for coding agents.

   +5 more show less

   • Adds a VEX approval queue where AI agents submit VEX rulings using a new AI-agent token and a human approves or rejects them on the Review tab.
   • Adds an Operator role that grants read access to the entire workspace and the ability to triage findings, without permission to change anything else.
   • Adds live UI updates over WebSocket via the new ws/user/ route.
   • Adds per-product advisory status editing after an advisory is created, bulk delete for advisories, custom ID prefix support for advisories, and Markdown support for advisories.
   • Adds an assessments requirements matrix view.
   • Adds Vanta integration, enabled via new VANTA_* environment variables, to sync frameworks and controls from Vanta with optional Trust Center publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds REDIS_CACHE_MAX_CONNECTIONS and REDIS_CACHE_POOL_TIMEOUT environment variables to tune Redis connection pooling, LOG_MAX_SIZE and LOG_MAX_FILE environment variables for log rotation control, and KEYCLOAK_PUBLIC_URL environment variable for self-hosted Keycloak configuration.
   • Adds Invitations API on both v1 and v2.
   • Adds a Vulnerabilities page with a deduplicated list of open findings, release and SBOM-version filters, and Fix/Triage prompts for coding agents.
   • Adds a VEX approval queue where AI agents submit VEX rulings using a new AI-agent token and a human approves or rejects them on the Review tab.

   +3 more show less

   • Adds an Operator role that grants read access to the entire workspace and the ability to triage findings, without permission to change anything else.
   • Adds live UI updates over WebSocket via the new ws/user/ route.
   • Adds an assessments requirements matrix view.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Token hashing migration access_tokens.0012 cannot be rolled back — old releases cannot authenticate API tokens after it runs.
   • !The findings migration drops the vulnerability_scanning_findings table; old pods in a rolling deploy will fail. Run manage.py backfill_findings --missing-only to rebuild findings.
   • !POST /api/v1/licensing/custom-licenses is removed.
   • !Creating an access request now requires authentication and takes no request body; all access-request routes enforce token scopes.
   • !GET /plugins/assessments/{sbom_id} caps all_runs at 50; use history_limit and all_runs_total for full history.
   • !GET /workspaces/ now shows members, invitations, and billing data only to admins.
   • !The branding PATCH endpoint now only accepts null for icon and logo fields.
   • !PATCH /advisories/{id} now rejects unknown fields with 422.
   • !/releases/{id}/artifacts?mode=available now requires the release:manage scope.
   • !Environment variables TEAMS_*_ROLES are renamed to WORKSPACE_*_ROLES; old names work as aliases for now.
   • !KEYCLOAK_WEBHOOK_SECRET environment variable is removed.
   • !Custom DRAMATIQ_BROKER overrides must be updated.
   • !Custom domains now require outbound HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. from workers; rotating SECRET_KEY requires domains to be re-verified.
   • !The first Stripe sync moves ended paid plans to Community, making their private products and components public.
   • !Pending Owner invitations now grant Admin instead of Owner — re-send affected invitations.
   • !The new ws/user/ WebSocket route must be forwarded in reverse proxy configuration.
4. 26.10.0 Oct 23, 2026 · issue 117

   API surface changed: +7 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +7 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions
   • + GET /api/v1/vulnerability-scanning/vex-submissions/{submission_id}
   • + GET /api/v1/vulnerability-scanning/workspaces/{team_key}/fix-prompt
   • + GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vex-submissions
   • + GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerabilities
   • + POST /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions
   • + POST /api/v1/vulnerability-scanning/vex-submissions/{submission_id}/withdraw
   • ~ GET /api/v1/advisories/{advisory_id}: response schema changed
   • ~ PATCH /api/v1/advisories/{advisory_id}: response schema changed
   • ~ POST /api/v1/advisories/: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/publish: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/updates: response schema changed
   • ~ POST /api/v1/advisories/{advisory_id}/withdraw: response schema changed
   • ~ POST /api/v1/sboms/upload-file/{component_id}: param review (query) added; response schema changed
   • New endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /api/v1/vulnerability-scanning/vex-submissions/{submission_id}
   • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/fix-prompt
   • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vex-submissions
   • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerabilities

   +3 more show less

   • New endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions
   • New endpoint POST /api/v1/vulnerability-scanning/vex-submissions/{submission_id}/withdraw
   • POST /api/v1/sboms/upload-file/{component_id}: param review (query) added

   8 details in Everything

5. 26.10.0 Oct 13, 2026 · issue 106

   API surface changed: +3 endpoints, −1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +3 endpoints, −1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /api/v1/workspaces/{team_key}/invitations/{invitation_id}
   • + GET /api/v1/workspaces/{team_key}/invitations
   • + POST /api/v1/workspaces/{team_key}/invitations
   • ~ GET /api/v1/plugins/assessments/{sbom_id}: param history_limit (query) added; response schema changed
   • ~ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda: response schema changed
   • ~ POST /api/v1/billing/change-plan/: response schema changed
   • ~ POST /api/v1/teams/{team_key}/access-request: request body changed; response schema changed
   • ~ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda: response schema changed
   • − POST /api/v1/licensing/custom-licenses (breaking)
   • New endpoint DELETE /api/v1/workspaces/{team_key}/invitations/{invitation_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /api/v1/workspaces/{team_key}/invitations
   • New endpoint POST /api/v1/workspaces/{team_key}/invitations
   • GET /api/v1/plugins/assessments/{sbom_id}: param history_limit (query) added

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removed endpoint POST /api/v1/licensing/custom-licenses
6. announced Sep 24, 2026 · issue 085

   sbomify-action v26.9.0 adds TeamCity/Jenkins/CircleCI/Travis CI support, document publishing via DOCUMENT_FILE, and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format. round-trip fidelity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Upload a signed pentest report from a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. pipeline so it appears in the platform Trust Center without manual hand-off.
   .github/workflows/sbom.yml copy

   - uses: sbomify/sbomify-action@v26.9.0
     env:
       TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
       COMPONENT_ID: ${{ vars.DOCS_COMPONENT_ID }}
       DOCUMENT_FILE: reports/pentest-2026.pdf
       DOCUMENT_TYPE: pentest-report
       DOCUMENT_VERSION: "2026.1"

   Run sbomify-action on any CI system (Jenkins, CircleCI, Travis, etc.) as a container — WORKDIR /workspace means no -w flag is needed.
   copy

   $ docker run --rm \
     -v "$(pwd):/workspace" \
     -e SBOMIFY_TOKEN=$SBOMIFY_TOKEN \
     ghcr.io/sbomify/sbomify-action:v26.9.0

   • Adds DOCUMENT_FILE, DOCUMENT_TYPE, DOCUMENT_VERSION, DOCUMENT_NAME, and DOCUMENT_COMPLIANCE_SUBCATEGORY env vars to publish arbitrary documents (pentest reports, compliance PDFs, NDAs) directly from a pipeline without manual upload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds native CI platform support for TeamCity (teamcity, priority 40), Jenkins (jenkins, priority 50), CircleCI (circleci, priority 60), and Travis CI (travis, priority 70) via a new CIPlatform abstraction, enabling accurate VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. (branch, repo URL, ref) in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. produced on those systems.
   • On Jenkins, reads CHANGE_BRANCH in preference to BRANCH_NAME for PR builds; on Travis CI reads TRAVIS_PULL_REQUEST_BRANCH in preference to TRAVIS_BRANCH, so the SBOM ref is the source branch rather than the merge target or job name.
   • CircleCI builds now read CIRCLE_TAG and CIRCLE_PROJECT_REPONAME so VERSION_FROM_RELEASE_TAG and NORMALIZE_VERSION work correctly on tag-triggered jobs.
   • Adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3.0 JSON-schema validation using the bundled 3.0.1 schema, so SPDX 3 documents are no longer silently passed to upload without a schema check.

   +3 more show less

   • Adds a WORKDIR /workspace to the container image so docker run -v "$PWD:/workspace" … ghcr.io/sbomify/sbomify-action:v26.9.0 is a complete invocation with no -w flag required.
   • SPDX 3.1 documents now receive an explicit unsupported error naming accepted versions instead of 'could not detect spdx spec version' or silence.
   • Audit trail paths under the working directory are now recorded relative to it (e.g. src/requirements.txt) rather than as absolute paths exposing the build machine's directory layout and username.
   • Adds DOCUMENT_FILE, DOCUMENT_TYPE, DOCUMENT_VERSION, DOCUMENT_NAME, and DOCUMENT_COMPLIANCE_SUBCATEGORY env vars to publish arbitrary documents (pentest reports, compliance PDFs, NDAs) directly from a pipeline without manual upload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds native CI platform support for TeamCity (teamcity, priority 40), Jenkins (jenkins, priority 50), CircleCI (circleci, priority 60), and Travis CI (travis, priority 70) via a new CIPlatform abstraction, enabling accurate VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. (branch, repo URL, ref) in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. produced on those systems.
   • On Jenkins, reads CHANGE_BRANCH in preference to BRANCH_NAME for PR builds; on Travis CI reads TRAVIS_PULL_REQUEST_BRANCH in preference to TRAVIS_BRANCH, so the SBOM ref is the source branch rather than the merge target or job name.
   • Adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3.0 JSON-schema validation using the bundled 3.0.1 schema, so SPDX 3 documents are no longer silently passed to upload without a schema check.

   4 more in Everything

7. announced Sep 24, 2026 · issue 085

   sbomify: Adds DATA_UPLOAD_MAX_MEMORY_SIZE_MB config key to set the SBOM upload size ceiling, defaulting to 100 MB and enforced at the point stated rather than silently rejected by the framework.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Deploy sbomify to Kubernetes with a real backing database and object storage, without bundling ephemeral in-chart services.
   copy

   $ helm install sbomify ./charts/sbomify \
     --namespace sbomify --create-namespace \
     --set app.baseUrl=https://sbom.example.com \
     --set database.host=pg.internal

   Raise the SBOM upload ceiling beyond the default 100 MB for environments ingesting very large Yocto image SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   .env copy

   DATA_UPLOAD_MAX_MEMORY_SIZE_MB=200

   • Launches /api/v2/ with renamed resource paths (artifacts instead of sboms, workspaces instead of teams, one path per resource) to replace the deprecated /api/v1/ surface.
   • Exposes security advisory create/read/delete and workspace plugin enable/disable over the API, previously only reachable through the UI.
   • Ships a Helm chart at charts/sbomify in the repository, deploying Caddy, gunicorn/uvicorn, Dramatiq workers, a cron scheduler, and a pre-traffic migration job; supports workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. on AWS and GCP to eliminate static object-storage credentials.
   • Validates SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 documents against the official SPDX 3.0.1 schema on upload, naming validation failures rather than surfacing a generic parse error; SPDX 3.0/3.0.0 documents are left intentionally lenient, and SPDX 3.1 receives an explicit refusal naming accepted versions (2.2, 2.3, 3.0.x).
   • Automatically converts SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3 SBOMs to a scanner-readable format for osv-scanner and Dependency Track rather than returning a skip instructing the user to run syft convert manually.

   +8 more show less

   • Serves the three CSAF 2.0CSAF 2.0An OASIS open standard for machine-readable vulnerability advisories, defining a JSON schema that lets vendors publish and consumers automate ingestion of patch and disclosure data at scale. discovery documents and populates the security.txt CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. field derived from the workspace's own domain, making CSAF publications machine-discoverable for the first time.
   • Adds a workspace toggle for vulnerability posture visibility on public Trust Center release pages, which previously exposed severity counts and all findings by ID, package, and version to anyone with the link with no opt-in.
   • Stores findings in a dedicated database table enabling server-side search, severity, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. state, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. filtering and pagination — replacing in-process Python aggregation over raw scan JSON blobs.
   • Enables triage directly from the vulnerabilities panel with a user-chosen row count, replacing a multi-page, unfiltered five-at-a-time workflow.
   • Activates the CISA 2026 Minimum Elements scoring plugin (replacing the 2021 NTIA elements), which had been implemented but never registered and therefore had never run for any user.
   • Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Type I / Type II certification badge display to Trust Center workspaces, earned only when a file-backed document is attached to a published company-wide component.
   • All API error responses now carry an error_code field; previously around two hundred responses returned null, and thirty-four server-side errors returned HTTP 400 instead of 500.
   • Every /api/v1/ response now includes an RFC 9745 Deprecation header, and v1 operations are struck through in /api/v1/docs.
   • Launches /api/v2/ with renamed resource paths (artifacts instead of sboms, workspaces instead of teams, one path per resource) to replace the deprecated /api/v1/ surface.
   • Exposes security advisory create/read/delete and workspace plugin enable/disable over the API, previously only reachable through the UI.
   • Ships a Helm chart at charts/sbomify in the repository, deploying Caddy, gunicorn/uvicorn, Dramatiq workers, a cron scheduler, and a pre-traffic migration job; supports workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. on AWS and GCP to eliminate static object-storage credentials.
   • Serves the three CSAF 2.0CSAF 2.0An OASIS open standard for machine-readable vulnerability advisories, defining a JSON schema that lets vendors publish and consumers automate ingestion of patch and disclosure data at scale. discovery documents and populates the security.txt CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. field derived from the workspace's own domain, making CSAF publications machine-discoverable for the first time.
   • Adds a workspace toggle for vulnerability posture visibility on public Trust Center release pages, which previously exposed severity counts and all findings by ID, package, and version to anyone with the link with no opt-in.

   +3 more show less

   • Stores findings in a dedicated database table enabling server-side search, severity, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. state, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. filtering and pagination — replacing in-process Python aggregation over raw scan JSON blobs.
   • Activates the CISA 2026 Minimum Elements scoring plugin (replacing the 2021 NTIA elements), which had been implemented but never registered and therefore had never run for any user.
   • Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Type I / Type II certification badge display to Trust Center workspaces, earned only when a file-backed document is attached to a published company-wide component.

   5 more in Everything

8. v26.9.0 Sep 23, 2026 · issue 083

   sbomify v26.9.0 adds a security advisories API, SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable./scanning support, a Kubernetes Helm chart, CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. discovery via security.txt, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v26.9.0 https://github.com/sbomify/sbomify.git
   # already have the repo? check out this version:
   $ git checkout v26.9.0

   • Adds a security advisories API, including creation and deletion of advisories through the same endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables and disables a workspace's plugins over the API.
   • Exposes public CSAF discovery through security.txt.
   • Adds is_default_workspace field alongside is_default_team in the API and on-screen copy.
   • Serves a v2 API that uses workspace terminology from the same views.

   +14 more show less

   • Scores CISA 2026 minimum elements and registers a new compliance plugin.
   • Scans SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3 documents through a derived copy instead of skipping them.
   • Sends SPDX documents to Dependency Track through a derived CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. copy.
   • Validates SPDX 3.0.1 claims against the vendored schema with clear version-edge messages.
   • Honours VEX statements carried inside an SPDX 3 document about itself.
   • Closes advisory-to-release gaps in the many-to-many model.
   • Keeps OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. publish tokens off the expiry bell so they do not expire.
   • Gives each vulnerability finding a dedicated detail row.
   • Shows gated documents with a request-access gate on the trust center.
   • Adds certification badges on the trust center.
   • Makes a document's name and version unique per component.
   • Makes the request body upload ceiling reachable and configurable.
   • Lets a document be made workspace-wide from its own page.
   • Pins the CRA audit logger so a raised LOG_LEVEL cannot silence it.
   • Adds a security advisories API, including creation and deletion of advisories through the same endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables and disables a workspace's plugins over the API.
   • Exposes public CSAF discovery through security.txt.
   • Adds is_default_workspace field alongside is_default_team in the API and on-screen copy.
   • Serves a v2 API that uses workspace terminology from the same views.

   +4 more show less

   • Scores CISA 2026 minimum elements and registers a new compliance plugin.
   • Shows gated documents with a request-access gate on the trust center.
   • Adds certification badges on the trust center.
   • Lets a document be made workspace-wide from its own page.

   10 more in Everything

9. 26.9.0 Sep 18, 2026 · issue 078

   API surface changed: +2 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +2 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /api/v1/plugins/workspaces/{team_key}/settings
   • + PUT /api/v1/plugins/workspaces/{team_key}/settings
   • ~ GET /api/v1/documents/{document_id}: response schema changed
   • ~ GET /api/v1/plugins/assessments/{sbom_id}: param findings_limit (query) added; param include_history (query) added
   • ~ PATCH /api/v1/documents/{document_id}: response schema changed
   • ~ POST /api/v1/documents/: response schema changed
   • New endpoint GET /api/v1/plugins/workspaces/{team_key}/settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint PUT /api/v1/plugins/workspaces/{team_key}/settings
   • GET /api/v1/plugins/assessments/{sbom_id}: param findings_limit (query) added; param include_history (query) added

   3 details in Everything

10. 26.8.0 Sep 14, 2026 · issue 074
    API change

    • + DELETE /api/v1/advisories/{advisory_id}
    • + GET /api/v1/advisories/
    • + GET /api/v1/advisories/public/{workspace_key}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf
    • + GET /api/v1/advisories/{advisory_id}
    • + PATCH /api/v1/advisories/{advisory_id}
    • + POST /api/v1/advisories/
    • + POST /api/v1/advisories/{advisory_id}/publish
    • + POST /api/v1/advisories/{advisory_id}/updates
    • + POST /api/v1/advisories/{advisory_id}/withdraw
    • ~ DELETE /api/v1/components/{component_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ DELETE /api/v1/releases/{release_id}: response schema changed
    • ~ GET /api/v1/components: response schema changed
    • ~ GET /api/v1/components/{component_id}/documents: response schema changed
    • ~ GET /api/v1/components/{component_id}/releases: response schema changed
    • ~ GET /api/v1/controls/catalogs/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/controls/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/csv: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv: response schema changed
    • ~ GET /api/v1/controls/controls/{control_id}/mappings/: response schema changed
    • ~ GET /api/v1/dashboard/summary: response schema changed
    • ~ GET /api/v1/exports/findings.csv: response schema changed
    • ~ GET /api/v1/exports/inventory.csv: response schema changed
    • ~ GET /api/v1/exports/licenses.csv: response schema changed
    • ~ GET /api/v1/exports/vulnerabilities.csv: response schema changed
    • ~ GET /api/v1/products: response schema changed
    • ~ GET /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ GET /api/v1/products/{product_id}/links: response schema changed
    • ~ GET /api/v1/releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends: response schema changed
    • ~ GET /api/v1/workspaces/: response schema changed
    • ~ GET /api/v1/workspaces/{team_key}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}/metadata: response schema changed
    • ~ PATCH /api/v1/products/{product_id}: response schema changed
    • ~ PATCH /api/v1/releases/{release_id}: response schema changed
    • ~ PATCH /api/v1/workspaces/{team_key}: response schema changed
    • ~ POST /api/v1/components: response schema changed
    • ~ POST /api/v1/products: response schema changed
    • ~ POST /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ POST /api/v1/products/{product_id}/links: response schema changed
    • ~ POST /api/v1/releases: response schema changed
    • ~ POST /api/v1/releases/{release_id}/artifacts: response schema changed
    • ~ PUT /api/v1/components/{component_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ PUT /api/v1/releases/{release_id}: response schema changed
    • ~ PUT /api/v1/workspaces/{team_key}: response schema changed
    • ⚠ DELETE /api/v1/auth/oidc/github/bindings/{binding_id}
    • ⚠ DELETE /api/v1/components/{component_id}
    • ⚠ DELETE /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ DELETE /api/v1/controls/evidence/{evidence_id}/
    • ⚠ DELETE /api/v1/documents/{document_id}
    • ⚠ DELETE /api/v1/documents/{document_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/products/{product_id}
    • ⚠ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ DELETE /api/v1/products/{product_id}/links/{link_id}
    • ⚠ DELETE /api/v1/releases/{release_id}
    • ⚠ DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id}
    • ⚠ DELETE /api/v1/sboms/sbom/{sbom_id}
    • ⚠ DELETE /api/v1/sboms/{sbom_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/domain
    • ⚠ DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ GET /api/v1/access-requests/pending
    • ⚠ GET /api/v1/auth/oidc/github/bindings
    • ⚠ GET /api/v1/billing/plans/
    • ⚠ GET /api/v1/billing/usage/
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/oscal-export
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/sbom-status
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/staleness
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ GET /api/v1/components
    • ⚠ GET /api/v1/components/{component_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/events
    • ⚠ GET /api/v1/components/{component_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ GET /api/v1/components/{component_id}/documents
    • ⚠ GET /api/v1/components/{component_id}/metadata
    • ⚠ GET /api/v1/components/{component_id}/releases
    • ⚠ GET /api/v1/components/{component_id}/sboms
    • ⚠ GET /api/v1/controls/automation/mappings/
    • ⚠ GET /api/v1/controls/catalogs/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/controls/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/csv
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv
    • ⚠ GET /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ GET /api/v1/controls/controls/{control_id}/mappings/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/{product_id}/
    • ⚠ GET /api/v1/dashboard/summary
    • ⚠ GET /api/v1/documents/{document_id}
    • ⚠ GET /api/v1/documents/{document_id}/download
    • ⚠ GET /api/v1/documents/{document_id}/download/signed
    • ⚠ GET /api/v1/documents/{document_id}/releases
    • ⚠ GET /api/v1/exports/findings.csv
    • ⚠ GET /api/v1/exports/inventory.csv
    • ⚠ GET /api/v1/exports/licenses.csv
    • ⚠ GET /api/v1/exports/vulnerabilities.csv
    • ⚠ GET /api/v1/internal/domains
    • ⚠ GET /api/v1/licensing/licenses
    • ⚠ GET /api/v1/notifications/
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}/badge
    • ⚠ GET /api/v1/plugins/registered
    • ⚠ GET /api/v1/products
    • ⚠ GET /api/v1/products/{product_id}
    • ⚠ GET /api/v1/products/{product_id}/cbom/download
    • ⚠ GET /api/v1/products/{product_id}/cle/events
    • ⚠ GET /api/v1/products/{product_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ GET /api/v1/products/{product_id}/download
    • ⚠ GET /api/v1/products/{product_id}/eol-readiness
    • ⚠ GET /api/v1/products/{product_id}/identifiers
    • ⚠ GET /api/v1/products/{product_id}/links
    • ⚠ GET /api/v1/releases
    • ⚠ GET /api/v1/releases/{release_id}
    • ⚠ GET /api/v1/releases/{release_id}/artifacts
    • ⚠ GET /api/v1/releases/{release_id}/cbom/download
    • ⚠ GET /api/v1/releases/{release_id}/cle/events
    • ⚠ GET /api/v1/releases/{release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ GET /api/v1/releases/{release_id}/download
    • ⚠ GET /api/v1/releases/{release_id}/vex/download
    • ⚠ GET /api/v1/sboms/component/{component_id}/meta
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ GET /api/v1/sboms/{sbom_id}
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv
    • ⚠ GET /api/v1/sboms/{sbom_id}/download
    • ⚠ GET /api/v1/sboms/{sbom_id}/download/signed
    • ⚠ GET /api/v1/sboms/{sbom_id}/releases
    • ⚠ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda
    • ⚠ GET /api/v1/user/export
    • ⚠ GET /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends
    • ⚠ GET /api/v1/workspaces/
    • ⚠ GET /api/v1/workspaces/{team_key}
    • ⚠ GET /api/v1/workspaces/{team_key}/branding
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ GET /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PATCH /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ PATCH /api/v1/components/{component_id}
    • ⚠ PATCH /api/v1/components/{component_id}/metadata
    • ⚠ PATCH /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ PATCH /api/v1/documents/{document_id}
    • ⚠ PATCH /api/v1/products/{product_id}
    • ⚠ PATCH /api/v1/releases/{release_id}
    • ⚠ PATCH /api/v1/sboms/component/{component_id}/meta
    • ⚠ PATCH /api/v1/workspaces/{team_key}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/branding/{field}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/domain
    • ⚠ PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ POST /api/v1/access-requests/{request_id}/approve
    • ⚠ POST /api/v1/access-requests/{request_id}/reject
    • ⚠ POST /api/v1/access-requests/{request_id}/revoke
    • ⚠ POST /api/v1/auth/oidc/github/bindings
    • ⚠ POST /api/v1/auth/oidc/github/exchange
    • ⚠ POST /api/v1/billing/change-plan/
    • ⚠ POST /api/v1/compliance/cra/product/{product_id}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/export
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/generate/{kind}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/refresh
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ POST /api/v1/components
    • ⚠ POST /api/v1/components/{component_id}/cle/events
    • ⚠ POST /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ POST /api/v1/controls/automation/sync/
    • ⚠ POST /api/v1/controls/catalogs/activate/
    • ⚠ POST /api/v1/controls/catalogs/import-oscal/
    • ⚠ POST /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ POST /api/v1/controls/mappings/
    • ⚠ POST /api/v1/controls/mappings/bulk/
    • ⚠ POST /api/v1/controls/status/bulk/
    • ⚠ POST /api/v1/documents/
    • ⚠ POST /api/v1/documents/{document_id}/releases
    • ⚠ POST /api/v1/licensing/custom-licenses
    • ⚠ POST /api/v1/licensing/license-expressions/validate
    • ⚠ POST /api/v1/notifications/clear/
    • ⚠ POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun
    • ⚠ POST /api/v1/products
    • ⚠ POST /api/v1/products/{product_id}/cle/events
    • ⚠ POST /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ POST /api/v1/products/{product_id}/identifiers
    • ⚠ POST /api/v1/products/{product_id}/links
    • ⚠ POST /api/v1/releases
    • ⚠ POST /api/v1/releases/{release_id}/artifacts
    • ⚠ POST /api/v1/releases/{release_id}/cle/events
    • ⚠ POST /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata
    • ⚠ POST /api/v1/sboms/artifact/spdx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/vex/{component_id}
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ POST /api/v1/sboms/upload-file/{component_id}
    • ⚠ POST /api/v1/sboms/{sbom_id}/releases
    • ⚠ POST /api/v1/teams/{team_key}/access-request
    • ⚠ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda
    • ⚠ POST /api/v1/user/delete
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview
    • ⚠ POST /api/v1/vulnerability-scanning/triage/bulk
    • ⚠ POST /api/v1/workspaces/{team_key}/branding/upload/{file_type}
    • ⚠ POST /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ POST /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ PUT /api/v1/components/{component_id}
    • ⚠ PUT /api/v1/controls/controls/{control_id}/status/
    • ⚠ PUT /api/v1/products/{product_id}
    • ⚠ PUT /api/v1/products/{product_id}/identifiers
    • ⚠ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ PUT /api/v1/products/{product_id}/links
    • ⚠ PUT /api/v1/products/{product_id}/links/{link_id}
    • ⚠ PUT /api/v1/releases/{release_id}
    • ⚠ PUT /api/v1/workspaces/{team_key}
    • ⚠ PUT /api/v1/workspaces/{team_key}/branding
    • ⚠ PUT /api/v1/workspaces/{team_key}/domain
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint GET /api/v1/access-requests/pending (still works)
    • !Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint GET /api/v1/billing/plans/ (still works)
    • !Deprecated endpoint GET /api/v1/billing/usage/ (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works)
    • !Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/dashboard/summary (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/exports/findings.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/inventory.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/licenses.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works)
    • !Deprecated endpoint GET /api/v1/internal/domains (still works)
    • !Deprecated endpoint GET /api/v1/licensing/licenses (still works)
    • !Deprecated endpoint GET /api/v1/notifications/ (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works)
    • !Deprecated endpoint GET /api/v1/plugins/registered (still works)
    • !Deprecated endpoint GET /api/v1/products (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint GET /api/v1/releases (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works)
    • !Deprecated endpoint GET /api/v1/user/export (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/ (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works)
    • !Deprecated endpoint POST /api/v1/billing/change-plan/ (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/components (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works)
    • !Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works)
    • !Deprecated endpoint POST /api/v1/notifications/clear/ (still works)
    • !Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works)
    • !Deprecated endpoint POST /api/v1/products (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint POST /api/v1/releases (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works)
    • !Deprecated endpoint POST /api/v1/user/delete (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint PUT /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint PUT /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works)
11. 26.8.0 Sep 13, 2026 · issue 073

    API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + DELETE /api/v1/advisories/{advisory_id}
    • + GET /api/v1/advisories/
    • + GET /api/v1/advisories/public/{workspace_key}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf
    • + GET /api/v1/advisories/{advisory_id}
    • + PATCH /api/v1/advisories/{advisory_id}
    • + POST /api/v1/advisories/
    • + POST /api/v1/advisories/{advisory_id}/publish
    • + POST /api/v1/advisories/{advisory_id}/updates
    • + POST /api/v1/advisories/{advisory_id}/withdraw
    • ~ DELETE /api/v1/components/{component_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ DELETE /api/v1/releases/{release_id}: response schema changed
    • ~ GET /api/v1/components: response schema changed
    • ~ GET /api/v1/components/{component_id}/documents: response schema changed
    • ~ GET /api/v1/components/{component_id}/releases: response schema changed
    • ~ GET /api/v1/controls/catalogs/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/controls/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/csv: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv: response schema changed
    • ~ GET /api/v1/controls/controls/{control_id}/mappings/: response schema changed
    • ~ GET /api/v1/dashboard/summary: response schema changed
    • ~ GET /api/v1/exports/findings.csv: response schema changed
    • ~ GET /api/v1/exports/inventory.csv: response schema changed
    • ~ GET /api/v1/exports/licenses.csv: response schema changed
    • ~ GET /api/v1/exports/vulnerabilities.csv: response schema changed
    • ~ GET /api/v1/products: response schema changed
    • ~ GET /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ GET /api/v1/products/{product_id}/links: response schema changed
    • ~ GET /api/v1/releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends: response schema changed
    • ~ GET /api/v1/workspaces/: response schema changed
    • ~ GET /api/v1/workspaces/{team_key}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}/metadata: response schema changed
    • ~ PATCH /api/v1/products/{product_id}: response schema changed
    • ~ PATCH /api/v1/releases/{release_id}: response schema changed
    • ~ PATCH /api/v1/workspaces/{team_key}: response schema changed
    • ~ POST /api/v1/components: response schema changed
    • ~ POST /api/v1/products: response schema changed
    • ~ POST /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ POST /api/v1/products/{product_id}/links: response schema changed
    • ~ POST /api/v1/releases: response schema changed
    • ~ POST /api/v1/releases/{release_id}/artifacts: response schema changed
    • ~ PUT /api/v1/components/{component_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ PUT /api/v1/releases/{release_id}: response schema changed
    • ~ PUT /api/v1/workspaces/{team_key}: response schema changed
    • ⚠ DELETE /api/v1/auth/oidc/github/bindings/{binding_id}
    • ⚠ DELETE /api/v1/components/{component_id}
    • ⚠ DELETE /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ DELETE /api/v1/controls/evidence/{evidence_id}/
    • ⚠ DELETE /api/v1/documents/{document_id}
    • ⚠ DELETE /api/v1/documents/{document_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/products/{product_id}
    • ⚠ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ DELETE /api/v1/products/{product_id}/links/{link_id}
    • ⚠ DELETE /api/v1/releases/{release_id}
    • ⚠ DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id}
    • ⚠ DELETE /api/v1/sboms/sbom/{sbom_id}
    • ⚠ DELETE /api/v1/sboms/{sbom_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/domain
    • ⚠ DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ GET /api/v1/access-requests/pending
    • ⚠ GET /api/v1/auth/oidc/github/bindings
    • ⚠ GET /api/v1/billing/plans/
    • ⚠ GET /api/v1/billing/usage/
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/oscal-export
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/sbom-status
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/staleness
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ GET /api/v1/components
    • ⚠ GET /api/v1/components/{component_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/events
    • ⚠ GET /api/v1/components/{component_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ GET /api/v1/components/{component_id}/documents
    • ⚠ GET /api/v1/components/{component_id}/metadata
    • ⚠ GET /api/v1/components/{component_id}/releases
    • ⚠ GET /api/v1/components/{component_id}/sboms
    • ⚠ GET /api/v1/controls/automation/mappings/
    • ⚠ GET /api/v1/controls/catalogs/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/controls/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/csv
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv
    • ⚠ GET /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ GET /api/v1/controls/controls/{control_id}/mappings/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/{product_id}/
    • ⚠ GET /api/v1/dashboard/summary
    • ⚠ GET /api/v1/documents/{document_id}
    • ⚠ GET /api/v1/documents/{document_id}/download
    • ⚠ GET /api/v1/documents/{document_id}/download/signed
    • ⚠ GET /api/v1/documents/{document_id}/releases
    • ⚠ GET /api/v1/exports/findings.csv
    • ⚠ GET /api/v1/exports/inventory.csv
    • ⚠ GET /api/v1/exports/licenses.csv
    • ⚠ GET /api/v1/exports/vulnerabilities.csv
    • ⚠ GET /api/v1/internal/domains
    • ⚠ GET /api/v1/licensing/licenses
    • ⚠ GET /api/v1/notifications/
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}/badge
    • ⚠ GET /api/v1/plugins/registered
    • ⚠ GET /api/v1/products
    • ⚠ GET /api/v1/products/{product_id}
    • ⚠ GET /api/v1/products/{product_id}/cbom/download
    • ⚠ GET /api/v1/products/{product_id}/cle/events
    • ⚠ GET /api/v1/products/{product_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ GET /api/v1/products/{product_id}/download
    • ⚠ GET /api/v1/products/{product_id}/eol-readiness
    • ⚠ GET /api/v1/products/{product_id}/identifiers
    • ⚠ GET /api/v1/products/{product_id}/links
    • ⚠ GET /api/v1/releases
    • ⚠ GET /api/v1/releases/{release_id}
    • ⚠ GET /api/v1/releases/{release_id}/artifacts
    • ⚠ GET /api/v1/releases/{release_id}/cbom/download
    • ⚠ GET /api/v1/releases/{release_id}/cle/events
    • ⚠ GET /api/v1/releases/{release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ GET /api/v1/releases/{release_id}/download
    • ⚠ GET /api/v1/releases/{release_id}/vex/download
    • ⚠ GET /api/v1/sboms/component/{component_id}/meta
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ GET /api/v1/sboms/{sbom_id}
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv
    • ⚠ GET /api/v1/sboms/{sbom_id}/download
    • ⚠ GET /api/v1/sboms/{sbom_id}/download/signed
    • ⚠ GET /api/v1/sboms/{sbom_id}/releases
    • ⚠ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda
    • ⚠ GET /api/v1/user/export
    • ⚠ GET /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends
    • ⚠ GET /api/v1/workspaces/
    • ⚠ GET /api/v1/workspaces/{team_key}
    • ⚠ GET /api/v1/workspaces/{team_key}/branding
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ GET /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PATCH /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ PATCH /api/v1/components/{component_id}
    • ⚠ PATCH /api/v1/components/{component_id}/metadata
    • ⚠ PATCH /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ PATCH /api/v1/documents/{document_id}
    • ⚠ PATCH /api/v1/products/{product_id}
    • ⚠ PATCH /api/v1/releases/{release_id}
    • ⚠ PATCH /api/v1/sboms/component/{component_id}/meta
    • ⚠ PATCH /api/v1/workspaces/{team_key}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/branding/{field}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/domain
    • ⚠ PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ POST /api/v1/access-requests/{request_id}/approve
    • ⚠ POST /api/v1/access-requests/{request_id}/reject
    • ⚠ POST /api/v1/access-requests/{request_id}/revoke
    • ⚠ POST /api/v1/auth/oidc/github/bindings
    • ⚠ POST /api/v1/auth/oidc/github/exchange
    • ⚠ POST /api/v1/billing/change-plan/
    • ⚠ POST /api/v1/compliance/cra/product/{product_id}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/export
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/generate/{kind}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/refresh
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ POST /api/v1/components
    • ⚠ POST /api/v1/components/{component_id}/cle/events
    • ⚠ POST /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ POST /api/v1/controls/automation/sync/
    • ⚠ POST /api/v1/controls/catalogs/activate/
    • ⚠ POST /api/v1/controls/catalogs/import-oscal/
    • ⚠ POST /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ POST /api/v1/controls/mappings/
    • ⚠ POST /api/v1/controls/mappings/bulk/
    • ⚠ POST /api/v1/controls/status/bulk/
    • ⚠ POST /api/v1/documents/
    • ⚠ POST /api/v1/documents/{document_id}/releases
    • ⚠ POST /api/v1/licensing/custom-licenses
    • ⚠ POST /api/v1/licensing/license-expressions/validate
    • ⚠ POST /api/v1/notifications/clear/
    • ⚠ POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun
    • ⚠ POST /api/v1/products
    • ⚠ POST /api/v1/products/{product_id}/cle/events
    • ⚠ POST /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ POST /api/v1/products/{product_id}/identifiers
    • ⚠ POST /api/v1/products/{product_id}/links
    • ⚠ POST /api/v1/releases
    • ⚠ POST /api/v1/releases/{release_id}/artifacts
    • ⚠ POST /api/v1/releases/{release_id}/cle/events
    • ⚠ POST /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata
    • ⚠ POST /api/v1/sboms/artifact/spdx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/vex/{component_id}
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ POST /api/v1/sboms/upload-file/{component_id}
    • ⚠ POST /api/v1/sboms/{sbom_id}/releases
    • ⚠ POST /api/v1/teams/{team_key}/access-request
    • ⚠ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda
    • ⚠ POST /api/v1/user/delete
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview
    • ⚠ POST /api/v1/vulnerability-scanning/triage/bulk
    • ⚠ POST /api/v1/workspaces/{team_key}/branding/upload/{file_type}
    • ⚠ POST /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ POST /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ PUT /api/v1/components/{component_id}
    • ⚠ PUT /api/v1/controls/controls/{control_id}/status/
    • ⚠ PUT /api/v1/products/{product_id}
    • ⚠ PUT /api/v1/products/{product_id}/identifiers
    • ⚠ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ PUT /api/v1/products/{product_id}/links
    • ⚠ PUT /api/v1/products/{product_id}/links/{link_id}
    • ⚠ PUT /api/v1/releases/{release_id}
    • ⚠ PUT /api/v1/workspaces/{team_key}
    • ⚠ PUT /api/v1/workspaces/{team_key}/branding
    • ⚠ PUT /api/v1/workspaces/{team_key}/domain
    • New endpoint DELETE /api/v1/advisories/{advisory_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint GET /api/v1/advisories/
    • New endpoint GET /api/v1/advisories/public/{workspace_key}
    • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf

    +6 more show less

    • New endpoint GET /api/v1/advisories/{advisory_id}
    • New endpoint PATCH /api/v1/advisories/{advisory_id}
    • New endpoint POST /api/v1/advisories/
    • New endpoint POST /api/v1/advisories/{advisory_id}/publish
    • New endpoint POST /api/v1/advisories/{advisory_id}/updates
    • New endpoint POST /api/v1/advisories/{advisory_id}/withdraw

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint GET /api/v1/access-requests/pending (still works)
    • !Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint GET /api/v1/billing/plans/ (still works)
    • !Deprecated endpoint GET /api/v1/billing/usage/ (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works)
    • !Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/dashboard/summary (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/exports/findings.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/inventory.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/licenses.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works)
    • !Deprecated endpoint GET /api/v1/internal/domains (still works)
    • !Deprecated endpoint GET /api/v1/licensing/licenses (still works)
    • !Deprecated endpoint GET /api/v1/notifications/ (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works)
    • !Deprecated endpoint GET /api/v1/plugins/registered (still works)
    • !Deprecated endpoint GET /api/v1/products (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint GET /api/v1/releases (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works)
    • !Deprecated endpoint GET /api/v1/user/export (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/ (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works)
    • !Deprecated endpoint POST /api/v1/billing/change-plan/ (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/components (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works)
    • !Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works)
    • !Deprecated endpoint POST /api/v1/notifications/clear/ (still works)
    • !Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works)
    • !Deprecated endpoint POST /api/v1/products (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint POST /api/v1/releases (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works)
    • !Deprecated endpoint POST /api/v1/user/delete (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint PUT /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint PUT /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works)
12. 26.8.0 Sep 12, 2026 · issue 072
    API change

    • + DELETE /api/v1/advisories/{advisory_id}
    • + GET /api/v1/advisories/
    • + GET /api/v1/advisories/public/{workspace_key}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf
    • + GET /api/v1/advisories/{advisory_id}
    • + PATCH /api/v1/advisories/{advisory_id}
    • + POST /api/v1/advisories/
    • + POST /api/v1/advisories/{advisory_id}/publish
    • + POST /api/v1/advisories/{advisory_id}/updates
    • + POST /api/v1/advisories/{advisory_id}/withdraw
    • ~ DELETE /api/v1/components/{component_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ DELETE /api/v1/releases/{release_id}: response schema changed
    • ~ GET /api/v1/components: response schema changed
    • ~ GET /api/v1/components/{component_id}/documents: response schema changed
    • ~ GET /api/v1/components/{component_id}/releases: response schema changed
    • ~ GET /api/v1/controls/catalogs/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/controls/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/csv: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv: response schema changed
    • ~ GET /api/v1/controls/controls/{control_id}/mappings/: response schema changed
    • ~ GET /api/v1/dashboard/summary: response schema changed
    • ~ GET /api/v1/exports/findings.csv: response schema changed
    • ~ GET /api/v1/exports/inventory.csv: response schema changed
    • ~ GET /api/v1/exports/licenses.csv: response schema changed
    • ~ GET /api/v1/exports/vulnerabilities.csv: response schema changed
    • ~ GET /api/v1/products: response schema changed
    • ~ GET /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ GET /api/v1/products/{product_id}/links: response schema changed
    • ~ GET /api/v1/releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends: response schema changed
    • ~ GET /api/v1/workspaces/: response schema changed
    • ~ GET /api/v1/workspaces/{team_key}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}/metadata: response schema changed
    • ~ PATCH /api/v1/products/{product_id}: response schema changed
    • ~ PATCH /api/v1/releases/{release_id}: response schema changed
    • ~ PATCH /api/v1/workspaces/{team_key}: response schema changed
    • ~ POST /api/v1/components: response schema changed
    • ~ POST /api/v1/products: response schema changed
    • ~ POST /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ POST /api/v1/products/{product_id}/links: response schema changed
    • ~ POST /api/v1/releases: response schema changed
    • ~ POST /api/v1/releases/{release_id}/artifacts: response schema changed
    • ~ PUT /api/v1/components/{component_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ PUT /api/v1/releases/{release_id}: response schema changed
    • ~ PUT /api/v1/workspaces/{team_key}: response schema changed
    • ⚠ DELETE /api/v1/auth/oidc/github/bindings/{binding_id}
    • ⚠ DELETE /api/v1/components/{component_id}
    • ⚠ DELETE /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ DELETE /api/v1/controls/evidence/{evidence_id}/
    • ⚠ DELETE /api/v1/documents/{document_id}
    • ⚠ DELETE /api/v1/documents/{document_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/products/{product_id}
    • ⚠ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ DELETE /api/v1/products/{product_id}/links/{link_id}
    • ⚠ DELETE /api/v1/releases/{release_id}
    • ⚠ DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id}
    • ⚠ DELETE /api/v1/sboms/sbom/{sbom_id}
    • ⚠ DELETE /api/v1/sboms/{sbom_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/domain
    • ⚠ DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ GET /api/v1/access-requests/pending
    • ⚠ GET /api/v1/auth/oidc/github/bindings
    • ⚠ GET /api/v1/billing/plans/
    • ⚠ GET /api/v1/billing/usage/
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/oscal-export
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/sbom-status
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/staleness
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ GET /api/v1/components
    • ⚠ GET /api/v1/components/{component_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/events
    • ⚠ GET /api/v1/components/{component_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ GET /api/v1/components/{component_id}/documents
    • ⚠ GET /api/v1/components/{component_id}/metadata
    • ⚠ GET /api/v1/components/{component_id}/releases
    • ⚠ GET /api/v1/components/{component_id}/sboms
    • ⚠ GET /api/v1/controls/automation/mappings/
    • ⚠ GET /api/v1/controls/catalogs/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/controls/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/csv
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv
    • ⚠ GET /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ GET /api/v1/controls/controls/{control_id}/mappings/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/{product_id}/
    • ⚠ GET /api/v1/dashboard/summary
    • ⚠ GET /api/v1/documents/{document_id}
    • ⚠ GET /api/v1/documents/{document_id}/download
    • ⚠ GET /api/v1/documents/{document_id}/download/signed
    • ⚠ GET /api/v1/documents/{document_id}/releases
    • ⚠ GET /api/v1/exports/findings.csv
    • ⚠ GET /api/v1/exports/inventory.csv
    • ⚠ GET /api/v1/exports/licenses.csv
    • ⚠ GET /api/v1/exports/vulnerabilities.csv
    • ⚠ GET /api/v1/internal/domains
    • ⚠ GET /api/v1/licensing/licenses
    • ⚠ GET /api/v1/notifications/
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}/badge
    • ⚠ GET /api/v1/plugins/registered
    • ⚠ GET /api/v1/products
    • ⚠ GET /api/v1/products/{product_id}
    • ⚠ GET /api/v1/products/{product_id}/cbom/download
    • ⚠ GET /api/v1/products/{product_id}/cle/events
    • ⚠ GET /api/v1/products/{product_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ GET /api/v1/products/{product_id}/download
    • ⚠ GET /api/v1/products/{product_id}/eol-readiness
    • ⚠ GET /api/v1/products/{product_id}/identifiers
    • ⚠ GET /api/v1/products/{product_id}/links
    • ⚠ GET /api/v1/releases
    • ⚠ GET /api/v1/releases/{release_id}
    • ⚠ GET /api/v1/releases/{release_id}/artifacts
    • ⚠ GET /api/v1/releases/{release_id}/cbom/download
    • ⚠ GET /api/v1/releases/{release_id}/cle/events
    • ⚠ GET /api/v1/releases/{release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ GET /api/v1/releases/{release_id}/download
    • ⚠ GET /api/v1/releases/{release_id}/vex/download
    • ⚠ GET /api/v1/sboms/component/{component_id}/meta
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ GET /api/v1/sboms/{sbom_id}
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv
    • ⚠ GET /api/v1/sboms/{sbom_id}/download
    • ⚠ GET /api/v1/sboms/{sbom_id}/download/signed
    • ⚠ GET /api/v1/sboms/{sbom_id}/releases
    • ⚠ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda
    • ⚠ GET /api/v1/user/export
    • ⚠ GET /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends
    • ⚠ GET /api/v1/workspaces/
    • ⚠ GET /api/v1/workspaces/{team_key}
    • ⚠ GET /api/v1/workspaces/{team_key}/branding
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ GET /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PATCH /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ PATCH /api/v1/components/{component_id}
    • ⚠ PATCH /api/v1/components/{component_id}/metadata
    • ⚠ PATCH /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ PATCH /api/v1/documents/{document_id}
    • ⚠ PATCH /api/v1/products/{product_id}
    • ⚠ PATCH /api/v1/releases/{release_id}
    • ⚠ PATCH /api/v1/sboms/component/{component_id}/meta
    • ⚠ PATCH /api/v1/workspaces/{team_key}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/branding/{field}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/domain
    • ⚠ PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ POST /api/v1/access-requests/{request_id}/approve
    • ⚠ POST /api/v1/access-requests/{request_id}/reject
    • ⚠ POST /api/v1/access-requests/{request_id}/revoke
    • ⚠ POST /api/v1/auth/oidc/github/bindings
    • ⚠ POST /api/v1/auth/oidc/github/exchange
    • ⚠ POST /api/v1/billing/change-plan/
    • ⚠ POST /api/v1/compliance/cra/product/{product_id}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/export
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/generate/{kind}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/refresh
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ POST /api/v1/components
    • ⚠ POST /api/v1/components/{component_id}/cle/events
    • ⚠ POST /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ POST /api/v1/controls/automation/sync/
    • ⚠ POST /api/v1/controls/catalogs/activate/
    • ⚠ POST /api/v1/controls/catalogs/import-oscal/
    • ⚠ POST /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ POST /api/v1/controls/mappings/
    • ⚠ POST /api/v1/controls/mappings/bulk/
    • ⚠ POST /api/v1/controls/status/bulk/
    • ⚠ POST /api/v1/documents/
    • ⚠ POST /api/v1/documents/{document_id}/releases
    • ⚠ POST /api/v1/licensing/custom-licenses
    • ⚠ POST /api/v1/licensing/license-expressions/validate
    • ⚠ POST /api/v1/notifications/clear/
    • ⚠ POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun
    • ⚠ POST /api/v1/products
    • ⚠ POST /api/v1/products/{product_id}/cle/events
    • ⚠ POST /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ POST /api/v1/products/{product_id}/identifiers
    • ⚠ POST /api/v1/products/{product_id}/links
    • ⚠ POST /api/v1/releases
    • ⚠ POST /api/v1/releases/{release_id}/artifacts
    • ⚠ POST /api/v1/releases/{release_id}/cle/events
    • ⚠ POST /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata
    • ⚠ POST /api/v1/sboms/artifact/spdx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/vex/{component_id}
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ POST /api/v1/sboms/upload-file/{component_id}
    • ⚠ POST /api/v1/sboms/{sbom_id}/releases
    • ⚠ POST /api/v1/teams/{team_key}/access-request
    • ⚠ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda
    • ⚠ POST /api/v1/user/delete
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview
    • ⚠ POST /api/v1/vulnerability-scanning/triage/bulk
    • ⚠ POST /api/v1/workspaces/{team_key}/branding/upload/{file_type}
    • ⚠ POST /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ POST /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ PUT /api/v1/components/{component_id}
    • ⚠ PUT /api/v1/controls/controls/{control_id}/status/
    • ⚠ PUT /api/v1/products/{product_id}
    • ⚠ PUT /api/v1/products/{product_id}/identifiers
    • ⚠ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ PUT /api/v1/products/{product_id}/links
    • ⚠ PUT /api/v1/products/{product_id}/links/{link_id}
    • ⚠ PUT /api/v1/releases/{release_id}
    • ⚠ PUT /api/v1/workspaces/{team_key}
    • ⚠ PUT /api/v1/workspaces/{team_key}/branding
    • ⚠ PUT /api/v1/workspaces/{team_key}/domain
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint GET /api/v1/access-requests/pending (still works)
    • !Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint GET /api/v1/billing/plans/ (still works)
    • !Deprecated endpoint GET /api/v1/billing/usage/ (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works)
    • !Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/dashboard/summary (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/exports/findings.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/inventory.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/licenses.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works)
    • !Deprecated endpoint GET /api/v1/internal/domains (still works)
    • !Deprecated endpoint GET /api/v1/licensing/licenses (still works)
    • !Deprecated endpoint GET /api/v1/notifications/ (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works)
    • !Deprecated endpoint GET /api/v1/plugins/registered (still works)
    • !Deprecated endpoint GET /api/v1/products (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint GET /api/v1/releases (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works)
    • !Deprecated endpoint GET /api/v1/user/export (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/ (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works)
    • !Deprecated endpoint POST /api/v1/billing/change-plan/ (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/components (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works)
    • !Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works)
    • !Deprecated endpoint POST /api/v1/notifications/clear/ (still works)
    • !Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works)
    • !Deprecated endpoint POST /api/v1/products (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint POST /api/v1/releases (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works)
    • !Deprecated endpoint POST /api/v1/user/delete (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint PUT /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint PUT /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works)
13. 26.8.0 Sep 11, 2026 · issue 071
    API change

    • + DELETE /api/v1/advisories/{advisory_id}
    • + GET /api/v1/advisories/
    • + GET /api/v1/advisories/public/{workspace_key}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf
    • + GET /api/v1/advisories/{advisory_id}
    • + PATCH /api/v1/advisories/{advisory_id}
    • + POST /api/v1/advisories/
    • + POST /api/v1/advisories/{advisory_id}/publish
    • + POST /api/v1/advisories/{advisory_id}/updates
    • + POST /api/v1/advisories/{advisory_id}/withdraw
    • ~ DELETE /api/v1/components/{component_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ DELETE /api/v1/releases/{release_id}: response schema changed
    • ~ GET /api/v1/components: response schema changed
    • ~ GET /api/v1/components/{component_id}/documents: response schema changed
    • ~ GET /api/v1/components/{component_id}/releases: response schema changed
    • ~ GET /api/v1/controls/catalogs/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/controls/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/csv: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv: response schema changed
    • ~ GET /api/v1/controls/controls/{control_id}/mappings/: response schema changed
    • ~ GET /api/v1/dashboard/summary: response schema changed
    • ~ GET /api/v1/exports/findings.csv: response schema changed
    • ~ GET /api/v1/exports/inventory.csv: response schema changed
    • ~ GET /api/v1/exports/licenses.csv: response schema changed
    • ~ GET /api/v1/exports/vulnerabilities.csv: response schema changed
    • ~ GET /api/v1/products: response schema changed
    • ~ GET /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ GET /api/v1/products/{product_id}/links: response schema changed
    • ~ GET /api/v1/releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends: response schema changed
    • ~ GET /api/v1/workspaces/: response schema changed
    • ~ GET /api/v1/workspaces/{team_key}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}/metadata: response schema changed
    • ~ PATCH /api/v1/products/{product_id}: response schema changed
    • ~ PATCH /api/v1/releases/{release_id}: response schema changed
    • ~ PATCH /api/v1/workspaces/{team_key}: response schema changed
    • ~ POST /api/v1/components: response schema changed
    • ~ POST /api/v1/products: response schema changed
    • ~ POST /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ POST /api/v1/products/{product_id}/links: response schema changed
    • ~ POST /api/v1/releases: response schema changed
    • ~ POST /api/v1/releases/{release_id}/artifacts: response schema changed
    • ~ PUT /api/v1/components/{component_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ PUT /api/v1/releases/{release_id}: response schema changed
    • ~ PUT /api/v1/workspaces/{team_key}: response schema changed
    • ⚠ DELETE /api/v1/auth/oidc/github/bindings/{binding_id}
    • ⚠ DELETE /api/v1/components/{component_id}
    • ⚠ DELETE /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ DELETE /api/v1/controls/evidence/{evidence_id}/
    • ⚠ DELETE /api/v1/documents/{document_id}
    • ⚠ DELETE /api/v1/documents/{document_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/products/{product_id}
    • ⚠ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ DELETE /api/v1/products/{product_id}/links/{link_id}
    • ⚠ DELETE /api/v1/releases/{release_id}
    • ⚠ DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id}
    • ⚠ DELETE /api/v1/sboms/sbom/{sbom_id}
    • ⚠ DELETE /api/v1/sboms/{sbom_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/domain
    • ⚠ DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ GET /api/v1/access-requests/pending
    • ⚠ GET /api/v1/auth/oidc/github/bindings
    • ⚠ GET /api/v1/billing/plans/
    • ⚠ GET /api/v1/billing/usage/
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/oscal-export
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/sbom-status
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/staleness
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ GET /api/v1/components
    • ⚠ GET /api/v1/components/{component_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/events
    • ⚠ GET /api/v1/components/{component_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ GET /api/v1/components/{component_id}/documents
    • ⚠ GET /api/v1/components/{component_id}/metadata
    • ⚠ GET /api/v1/components/{component_id}/releases
    • ⚠ GET /api/v1/components/{component_id}/sboms
    • ⚠ GET /api/v1/controls/automation/mappings/
    • ⚠ GET /api/v1/controls/catalogs/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/controls/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/csv
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv
    • ⚠ GET /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ GET /api/v1/controls/controls/{control_id}/mappings/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/{product_id}/
    • ⚠ GET /api/v1/dashboard/summary
    • ⚠ GET /api/v1/documents/{document_id}
    • ⚠ GET /api/v1/documents/{document_id}/download
    • ⚠ GET /api/v1/documents/{document_id}/download/signed
    • ⚠ GET /api/v1/documents/{document_id}/releases
    • ⚠ GET /api/v1/exports/findings.csv
    • ⚠ GET /api/v1/exports/inventory.csv
    • ⚠ GET /api/v1/exports/licenses.csv
    • ⚠ GET /api/v1/exports/vulnerabilities.csv
    • ⚠ GET /api/v1/internal/domains
    • ⚠ GET /api/v1/licensing/licenses
    • ⚠ GET /api/v1/notifications/
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}/badge
    • ⚠ GET /api/v1/plugins/registered
    • ⚠ GET /api/v1/products
    • ⚠ GET /api/v1/products/{product_id}
    • ⚠ GET /api/v1/products/{product_id}/cbom/download
    • ⚠ GET /api/v1/products/{product_id}/cle/events
    • ⚠ GET /api/v1/products/{product_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ GET /api/v1/products/{product_id}/download
    • ⚠ GET /api/v1/products/{product_id}/eol-readiness
    • ⚠ GET /api/v1/products/{product_id}/identifiers
    • ⚠ GET /api/v1/products/{product_id}/links
    • ⚠ GET /api/v1/releases
    • ⚠ GET /api/v1/releases/{release_id}
    • ⚠ GET /api/v1/releases/{release_id}/artifacts
    • ⚠ GET /api/v1/releases/{release_id}/cbom/download
    • ⚠ GET /api/v1/releases/{release_id}/cle/events
    • ⚠ GET /api/v1/releases/{release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ GET /api/v1/releases/{release_id}/download
    • ⚠ GET /api/v1/releases/{release_id}/vex/download
    • ⚠ GET /api/v1/sboms/component/{component_id}/meta
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ GET /api/v1/sboms/{sbom_id}
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv
    • ⚠ GET /api/v1/sboms/{sbom_id}/download
    • ⚠ GET /api/v1/sboms/{sbom_id}/download/signed
    • ⚠ GET /api/v1/sboms/{sbom_id}/releases
    • ⚠ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda
    • ⚠ GET /api/v1/user/export
    • ⚠ GET /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends
    • ⚠ GET /api/v1/workspaces/
    • ⚠ GET /api/v1/workspaces/{team_key}
    • ⚠ GET /api/v1/workspaces/{team_key}/branding
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ GET /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PATCH /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ PATCH /api/v1/components/{component_id}
    • ⚠ PATCH /api/v1/components/{component_id}/metadata
    • ⚠ PATCH /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ PATCH /api/v1/documents/{document_id}
    • ⚠ PATCH /api/v1/products/{product_id}
    • ⚠ PATCH /api/v1/releases/{release_id}
    • ⚠ PATCH /api/v1/sboms/component/{component_id}/meta
    • ⚠ PATCH /api/v1/workspaces/{team_key}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/branding/{field}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/domain
    • ⚠ PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ POST /api/v1/access-requests/{request_id}/approve
    • ⚠ POST /api/v1/access-requests/{request_id}/reject
    • ⚠ POST /api/v1/access-requests/{request_id}/revoke
    • ⚠ POST /api/v1/auth/oidc/github/bindings
    • ⚠ POST /api/v1/auth/oidc/github/exchange
    • ⚠ POST /api/v1/billing/change-plan/
    • ⚠ POST /api/v1/compliance/cra/product/{product_id}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/export
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/generate/{kind}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/refresh
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ POST /api/v1/components
    • ⚠ POST /api/v1/components/{component_id}/cle/events
    • ⚠ POST /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ POST /api/v1/controls/automation/sync/
    • ⚠ POST /api/v1/controls/catalogs/activate/
    • ⚠ POST /api/v1/controls/catalogs/import-oscal/
    • ⚠ POST /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ POST /api/v1/controls/mappings/
    • ⚠ POST /api/v1/controls/mappings/bulk/
    • ⚠ POST /api/v1/controls/status/bulk/
    • ⚠ POST /api/v1/documents/
    • ⚠ POST /api/v1/documents/{document_id}/releases
    • ⚠ POST /api/v1/licensing/custom-licenses
    • ⚠ POST /api/v1/licensing/license-expressions/validate
    • ⚠ POST /api/v1/notifications/clear/
    • ⚠ POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun
    • ⚠ POST /api/v1/products
    • ⚠ POST /api/v1/products/{product_id}/cle/events
    • ⚠ POST /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ POST /api/v1/products/{product_id}/identifiers
    • ⚠ POST /api/v1/products/{product_id}/links
    • ⚠ POST /api/v1/releases
    • ⚠ POST /api/v1/releases/{release_id}/artifacts
    • ⚠ POST /api/v1/releases/{release_id}/cle/events
    • ⚠ POST /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata
    • ⚠ POST /api/v1/sboms/artifact/spdx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/vex/{component_id}
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ POST /api/v1/sboms/upload-file/{component_id}
    • ⚠ POST /api/v1/sboms/{sbom_id}/releases
    • ⚠ POST /api/v1/teams/{team_key}/access-request
    • ⚠ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda
    • ⚠ POST /api/v1/user/delete
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview
    • ⚠ POST /api/v1/vulnerability-scanning/triage/bulk
    • ⚠ POST /api/v1/workspaces/{team_key}/branding/upload/{file_type}
    • ⚠ POST /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ POST /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ PUT /api/v1/components/{component_id}
    • ⚠ PUT /api/v1/controls/controls/{control_id}/status/
    • ⚠ PUT /api/v1/products/{product_id}
    • ⚠ PUT /api/v1/products/{product_id}/identifiers
    • ⚠ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ PUT /api/v1/products/{product_id}/links
    • ⚠ PUT /api/v1/products/{product_id}/links/{link_id}
    • ⚠ PUT /api/v1/releases/{release_id}
    • ⚠ PUT /api/v1/workspaces/{team_key}
    • ⚠ PUT /api/v1/workspaces/{team_key}/branding
    • ⚠ PUT /api/v1/workspaces/{team_key}/domain
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint GET /api/v1/access-requests/pending (still works)
    • !Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint GET /api/v1/billing/plans/ (still works)
    • !Deprecated endpoint GET /api/v1/billing/usage/ (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works)
    • !Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/dashboard/summary (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/exports/findings.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/inventory.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/licenses.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works)
    • !Deprecated endpoint GET /api/v1/internal/domains (still works)
    • !Deprecated endpoint GET /api/v1/licensing/licenses (still works)
    • !Deprecated endpoint GET /api/v1/notifications/ (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works)
    • !Deprecated endpoint GET /api/v1/plugins/registered (still works)
    • !Deprecated endpoint GET /api/v1/products (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint GET /api/v1/releases (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works)
    • !Deprecated endpoint GET /api/v1/user/export (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/ (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works)
    • !Deprecated endpoint POST /api/v1/billing/change-plan/ (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/components (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works)
    • !Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works)
    • !Deprecated endpoint POST /api/v1/notifications/clear/ (still works)
    • !Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works)
    • !Deprecated endpoint POST /api/v1/products (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint POST /api/v1/releases (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works)
    • !Deprecated endpoint POST /api/v1/user/delete (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint PUT /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint PUT /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works)
14. 26.8.0 Sep 10, 2026 · issue 070

    API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + DELETE /api/v1/advisories/{advisory_id}
    • + GET /api/v1/advisories/
    • + GET /api/v1/advisories/public/{workspace_key}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • + GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf
    • + GET /api/v1/advisories/{advisory_id}
    • + PATCH /api/v1/advisories/{advisory_id}
    • + POST /api/v1/advisories/
    • + POST /api/v1/advisories/{advisory_id}/publish
    • + POST /api/v1/advisories/{advisory_id}/updates
    • + POST /api/v1/advisories/{advisory_id}/withdraw
    • ~ DELETE /api/v1/components/{component_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ DELETE /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ DELETE /api/v1/releases/{release_id}: response schema changed
    • ~ GET /api/v1/components: response schema changed
    • ~ GET /api/v1/components/{component_id}/documents: response schema changed
    • ~ GET /api/v1/components/{component_id}/releases: response schema changed
    • ~ GET /api/v1/controls/catalogs/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/controls/: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/csv: response schema changed
    • ~ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv: response schema changed
    • ~ GET /api/v1/controls/controls/{control_id}/mappings/: response schema changed
    • ~ GET /api/v1/dashboard/summary: response schema changed
    • ~ GET /api/v1/exports/findings.csv: response schema changed
    • ~ GET /api/v1/exports/inventory.csv: response schema changed
    • ~ GET /api/v1/exports/licenses.csv: response schema changed
    • ~ GET /api/v1/exports/vulnerabilities.csv: response schema changed
    • ~ GET /api/v1/products: response schema changed
    • ~ GET /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ GET /api/v1/products/{product_id}/links: response schema changed
    • ~ GET /api/v1/releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap: response schema changed
    • ~ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends: response schema changed
    • ~ GET /api/v1/workspaces/: response schema changed
    • ~ GET /api/v1/workspaces/{team_key}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}: response schema changed
    • ~ PATCH /api/v1/components/{component_id}/metadata: response schema changed
    • ~ PATCH /api/v1/products/{product_id}: response schema changed
    • ~ PATCH /api/v1/releases/{release_id}: response schema changed
    • ~ PATCH /api/v1/workspaces/{team_key}: response schema changed
    • ~ POST /api/v1/components: response schema changed
    • ~ POST /api/v1/products: response schema changed
    • ~ POST /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ POST /api/v1/products/{product_id}/links: response schema changed
    • ~ POST /api/v1/releases: response schema changed
    • ~ POST /api/v1/releases/{release_id}/artifacts: response schema changed
    • ~ PUT /api/v1/components/{component_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers: response schema changed
    • ~ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links: response schema changed
    • ~ PUT /api/v1/products/{product_id}/links/{link_id}: response schema changed
    • ~ PUT /api/v1/releases/{release_id}: response schema changed
    • ~ PUT /api/v1/workspaces/{team_key}: response schema changed
    • ⚠ DELETE /api/v1/auth/oidc/github/bindings/{binding_id}
    • ⚠ DELETE /api/v1/components/{component_id}
    • ⚠ DELETE /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ DELETE /api/v1/controls/evidence/{evidence_id}/
    • ⚠ DELETE /api/v1/documents/{document_id}
    • ⚠ DELETE /api/v1/documents/{document_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/products/{product_id}
    • ⚠ DELETE /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ DELETE /api/v1/products/{product_id}/links/{link_id}
    • ⚠ DELETE /api/v1/releases/{release_id}
    • ⚠ DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id}
    • ⚠ DELETE /api/v1/sboms/sbom/{sbom_id}
    • ⚠ DELETE /api/v1/sboms/{sbom_id}/releases/{release_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ DELETE /api/v1/workspaces/{team_key}/domain
    • ⚠ DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ GET /api/v1/access-requests/pending
    • ⚠ GET /api/v1/auth/oidc/github/bindings
    • ⚠ GET /api/v1/billing/plans/
    • ⚠ GET /api/v1/billing/usage/
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/oscal-export
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/sbom-status
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/staleness
    • ⚠ GET /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ GET /api/v1/components
    • ⚠ GET /api/v1/components/{component_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/events
    • ⚠ GET /api/v1/components/{component_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ GET /api/v1/components/{component_id}/documents
    • ⚠ GET /api/v1/components/{component_id}/metadata
    • ⚠ GET /api/v1/components/{component_id}/releases
    • ⚠ GET /api/v1/components/{component_id}/sboms
    • ⚠ GET /api/v1/controls/automation/mappings/
    • ⚠ GET /api/v1/controls/catalogs/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/controls/
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/csv
    • ⚠ GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv
    • ⚠ GET /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ GET /api/v1/controls/controls/{control_id}/mappings/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/
    • ⚠ GET /api/v1/controls/public/{workspace_key}/{product_id}/
    • ⚠ GET /api/v1/dashboard/summary
    • ⚠ GET /api/v1/documents/{document_id}
    • ⚠ GET /api/v1/documents/{document_id}/download
    • ⚠ GET /api/v1/documents/{document_id}/download/signed
    • ⚠ GET /api/v1/documents/{document_id}/releases
    • ⚠ GET /api/v1/exports/findings.csv
    • ⚠ GET /api/v1/exports/inventory.csv
    • ⚠ GET /api/v1/exports/licenses.csv
    • ⚠ GET /api/v1/exports/vulnerabilities.csv
    • ⚠ GET /api/v1/internal/domains
    • ⚠ GET /api/v1/licensing/licenses
    • ⚠ GET /api/v1/notifications/
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}
    • ⚠ GET /api/v1/plugins/assessments/{sbom_id}/badge
    • ⚠ GET /api/v1/plugins/registered
    • ⚠ GET /api/v1/products
    • ⚠ GET /api/v1/products/{product_id}
    • ⚠ GET /api/v1/products/{product_id}/cbom/download
    • ⚠ GET /api/v1/products/{product_id}/cle/events
    • ⚠ GET /api/v1/products/{product_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ GET /api/v1/products/{product_id}/download
    • ⚠ GET /api/v1/products/{product_id}/eol-readiness
    • ⚠ GET /api/v1/products/{product_id}/identifiers
    • ⚠ GET /api/v1/products/{product_id}/links
    • ⚠ GET /api/v1/releases
    • ⚠ GET /api/v1/releases/{release_id}
    • ⚠ GET /api/v1/releases/{release_id}/artifacts
    • ⚠ GET /api/v1/releases/{release_id}/cbom/download
    • ⚠ GET /api/v1/releases/{release_id}/cle/events
    • ⚠ GET /api/v1/releases/{release_id}/cle/events/{event_id}
    • ⚠ GET /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ GET /api/v1/releases/{release_id}/download
    • ⚠ GET /api/v1/releases/{release_id}/vex/download
    • ⚠ GET /api/v1/sboms/component/{component_id}/meta
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ GET /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ GET /api/v1/sboms/{sbom_id}
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory
    • ⚠ GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv
    • ⚠ GET /api/v1/sboms/{sbom_id}/download
    • ⚠ GET /api/v1/sboms/{sbom_id}/download/signed
    • ⚠ GET /api/v1/sboms/{sbom_id}/releases
    • ⚠ GET /api/v1/teams/{team_key}/access-request/{request_id}/nda
    • ⚠ GET /api/v1/user/export
    • ⚠ GET /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries
    • ⚠ GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends
    • ⚠ GET /api/v1/workspaces/
    • ⚠ GET /api/v1/workspaces/{team_key}
    • ⚠ GET /api/v1/workspaces/{team_key}/branding
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ GET /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PATCH /api/v1/compliance/cra/{assessment_id}/step/{step}
    • ⚠ PATCH /api/v1/components/{component_id}
    • ⚠ PATCH /api/v1/components/{component_id}/metadata
    • ⚠ PATCH /api/v1/controls/catalogs/{catalog_id}/
    • ⚠ PATCH /api/v1/documents/{document_id}
    • ⚠ PATCH /api/v1/products/{product_id}
    • ⚠ PATCH /api/v1/releases/{release_id}
    • ⚠ PATCH /api/v1/sboms/component/{component_id}/meta
    • ⚠ PATCH /api/v1/workspaces/{team_key}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/branding/{field}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id}
    • ⚠ PATCH /api/v1/workspaces/{team_key}/domain
    • ⚠ PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id}
    • ⚠ POST /api/v1/access-requests/{request_id}/approve
    • ⚠ POST /api/v1/access-requests/{request_id}/reject
    • ⚠ POST /api/v1/access-requests/{request_id}/revoke
    • ⚠ POST /api/v1/auth/oidc/github/bindings
    • ⚠ POST /api/v1/auth/oidc/github/exchange
    • ⚠ POST /api/v1/billing/change-plan/
    • ⚠ POST /api/v1/compliance/cra/product/{product_id}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/export
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/generate/{kind}
    • ⚠ POST /api/v1/compliance/cra/{assessment_id}/refresh
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/events
    • ⚠ POST /api/v1/component-releases/{component_release_id}/cle/support-definitions
    • ⚠ POST /api/v1/components
    • ⚠ POST /api/v1/components/{component_id}/cle/events
    • ⚠ POST /api/v1/components/{component_id}/cle/support-definitions
    • ⚠ POST /api/v1/controls/automation/sync/
    • ⚠ POST /api/v1/controls/catalogs/activate/
    • ⚠ POST /api/v1/controls/catalogs/import-oscal/
    • ⚠ POST /api/v1/controls/controls/{control_id}/evidence/
    • ⚠ POST /api/v1/controls/mappings/
    • ⚠ POST /api/v1/controls/mappings/bulk/
    • ⚠ POST /api/v1/controls/status/bulk/
    • ⚠ POST /api/v1/documents/
    • ⚠ POST /api/v1/documents/{document_id}/releases
    • ⚠ POST /api/v1/licensing/custom-licenses
    • ⚠ POST /api/v1/licensing/license-expressions/validate
    • ⚠ POST /api/v1/notifications/clear/
    • ⚠ POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun
    • ⚠ POST /api/v1/products
    • ⚠ POST /api/v1/products/{product_id}/cle/events
    • ⚠ POST /api/v1/products/{product_id}/cle/support-definitions
    • ⚠ POST /api/v1/products/{product_id}/identifiers
    • ⚠ POST /api/v1/products/{product_id}/links
    • ⚠ POST /api/v1/releases
    • ⚠ POST /api/v1/releases/{release_id}/artifacts
    • ⚠ POST /api/v1/releases/{release_id}/cle/events
    • ⚠ POST /api/v1/releases/{release_id}/cle/support-definitions
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata
    • ⚠ POST /api/v1/sboms/artifact/spdx/{component_id}
    • ⚠ POST /api/v1/sboms/artifact/vex/{component_id}
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/provenance
    • ⚠ POST /api/v1/sboms/sbom/{sbom_id}/signature
    • ⚠ POST /api/v1/sboms/upload-file/{component_id}
    • ⚠ POST /api/v1/sboms/{sbom_id}/releases
    • ⚠ POST /api/v1/teams/{team_key}/access-request
    • ⚠ POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda
    • ⚠ POST /api/v1/user/delete
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/triage
    • ⚠ POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview
    • ⚠ POST /api/v1/vulnerability-scanning/triage/bulk
    • ⚠ POST /api/v1/workspaces/{team_key}/branding/upload/{file_type}
    • ⚠ POST /api/v1/workspaces/{team_key}/contact-profiles
    • ⚠ POST /api/v1/workspaces/{team_key}/suppliers
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}
    • ⚠ PUT /api/v1/compliance/cra/{assessment_id}/signature
    • ⚠ PUT /api/v1/components/{component_id}
    • ⚠ PUT /api/v1/controls/controls/{control_id}/status/
    • ⚠ PUT /api/v1/products/{product_id}
    • ⚠ PUT /api/v1/products/{product_id}/identifiers
    • ⚠ PUT /api/v1/products/{product_id}/identifiers/{identifier_id}
    • ⚠ PUT /api/v1/products/{product_id}/links
    • ⚠ PUT /api/v1/products/{product_id}/links/{link_id}
    • ⚠ PUT /api/v1/releases/{release_id}
    • ⚠ PUT /api/v1/workspaces/{team_key}
    • ⚠ PUT /api/v1/workspaces/{team_key}/branding
    • ⚠ PUT /api/v1/workspaces/{team_key}/domain
    • New endpoint DELETE /api/v1/advisories/{advisory_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint GET /api/v1/advisories/
    • New endpoint GET /api/v1/advisories/public/{workspace_key}
    • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id}
    • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf

    +6 more show less

    • New endpoint GET /api/v1/advisories/{advisory_id}
    • New endpoint PATCH /api/v1/advisories/{advisory_id}
    • New endpoint POST /api/v1/advisories/
    • New endpoint POST /api/v1/advisories/{advisory_id}/publish
    • New endpoint POST /api/v1/advisories/{advisory_id}/updates
    • New endpoint POST /api/v1/advisories/{advisory_id}/withdraw

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint GET /api/v1/access-requests/pending (still works)
    • !Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint GET /api/v1/billing/plans/ (still works)
    • !Deprecated endpoint GET /api/v1/billing/usage/ (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works)
    • !Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works)
    • !Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works)
    • !Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works)
    • !Deprecated endpoint GET /api/v1/dashboard/summary (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/exports/findings.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/inventory.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/licenses.csv (still works)
    • !Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works)
    • !Deprecated endpoint GET /api/v1/internal/domains (still works)
    • !Deprecated endpoint GET /api/v1/licensing/licenses (still works)
    • !Deprecated endpoint GET /api/v1/notifications/ (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works)
    • !Deprecated endpoint GET /api/v1/plugins/registered (still works)
    • !Deprecated endpoint GET /api/v1/products (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint GET /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint GET /api/v1/releases (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works)
    • !Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works)
    • !Deprecated endpoint GET /api/v1/user/export (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works)
    • !Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/ (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works)
    • !Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works)
    • !Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works)
    • !Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works)
    • !Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works)
    • !Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works)
    • !Deprecated endpoint POST /api/v1/billing/change-plan/ (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works)
    • !Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/components (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/ (still works)
    • !Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works)
    • !Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works)
    • !Deprecated endpoint POST /api/v1/notifications/clear/ (still works)
    • !Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works)
    • !Deprecated endpoint POST /api/v1/products (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint POST /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint POST /api/v1/releases (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works)
    • !Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works)
    • !Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works)
    • !Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works)
    • !Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works)
    • !Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works)
    • !Deprecated endpoint POST /api/v1/user/delete (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works)
    • !Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works)
    • !Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works)
    • !Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works)
    • !Deprecated endpoint PUT /api/v1/components/{component_id} (still works)
    • !Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works)
    • !Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works)
    • !Deprecated endpoint PUT /api/v1/releases/{release_id} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works)
    • !Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works)
15. v26.8.0 Aug 25, 2026 · issue 057

    sbomify v26.8.0 adds malicious-package detection, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 capture, ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. flagging, OpenChain Telco conformance, vulnerability risk acceptance, patch SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments./CRA KPIs, and a redesigned Trust Center.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.8.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.8.0

    └──▷ HOW TO FIND IT
    Trigger an on-demand plugin assessment re-run after uploading a new SBOM, without waiting for the next scheduled scan.
    📍In the sbomify UI, open the artifact's Plugin Assessments panel and click Re-run next to the assessment you want to refresh.
    Record formal risk acceptance for a vulnerability finding — capturing an owner and expiry — so the risk appears tracked rather than ignored in compliance reports.
    📍On a vulnerability's detail page, open the Risk Acceptance panel, enter the owner name and expiry date, then click Accept.
    Publish a security advisory to the Trust Center with per-product gating, so only relevant products expose the advisory to external consumers.
    📍In the sbomify UI, open Advisories › New Advisory, select the affected products and version range in the modal, then toggle Publish to Trust Center per product before saving.
    • Captures EPSS scores and CVSS 4.0 from both scanner paths, surfacing richer severity data on findings.
    • Surfaces malicious packages as their own distinct vulnerability class, separate from CVE-based findings.
    • Flags ENISA EUVD exploited findings alongside existing CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. badges on vulnerability views.
    • Adds suppressed-findings toggle plus state and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. filters on the internal vulnerability drill-down.
    • Adds formal risk acceptance for vulnerabilities, recording an owner and an expiry date.

    +23 more show less

    • Adds a patch SLA matrix and five CRA KPIs to the vulnerability posture view.
    • Adds an OpenChain Telco SBOM Guide v1.1 conformance plugin.
    • Adds vulnerability lifecycle tracking for age and Mean Time To Remediate (MTTR).
    • Introduces an SBOM freshness window and stale flag to signal outdated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Enables on-demand assessment re-runs for plugins without waiting for a scheduled scan.
    • Adds risk categories for SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license identifiers in the licensing view.
    • Links advisory IDs directly to the upstream database that holds them.
    • Maps the New Advisory modal onto products and releases, with version selection and range-picking.
    • Pins the Art. 13(15) retention floor on compliance export packages.
    • Captures the EU Authorized Representative field and includes it on the Declaration of Conformity.
    • Redesigns the Trust Center with per-product advisory gating for published advisories.
    • Adds a searchable products table and drill-down cleanup to the Trust Center.
    • Adds end-of-life transition readiness tracking, announcement, and final artifact handling.
    • Adds hour-scale expiry presets and an arbitrary custom TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. for access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Warns users before access tokens expire.
    • Turns the navbar search into a navigation spotlight.
    • Consolidates the CI/CD integration dialog into a single command with a 7-day token embedded.
    • Adds per-IP rate limiting for anonymous and public endpoints.
    • Adds a supplier list entity to teams for collecting artifacts from external suppliers.
    • Validates CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. identifiers and makes identifier values copyable in the UI.
    • Distinguishes nothing scanned from nothing found in vulnerability results.
    • Settings are reorganized into one page per section with tabs across the top.
    • Consolidates plugin access to a single entry point in Settings.

    28 details in Everything

16. announced Aug 25, 2026 · issue 058

    sbomify-action v26.8.0 shrinks image 80%, adds SBOMIFY_FETCH_RUNTIMES, SBOMIFY_CLEARLY_CACHED_URL, git submodule discovery, and cross-run enrichment caching.

    └──▷ USE IT
    Run sbomify-action in an air-gapped CI environment without fetching external runtime bundles.
    .github/workflows/sbom.yml copy

    - uses: sbomify/sbomify-action@v26.8.0
      env:
        SBOMIFY_TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
        SBOMIFY_FETCH_RUNTIMES: '0'

    Point sbomify-action at a self-hosted clearly-cached instance to avoid a public-internet dependency during enrichment.
    .github/workflows/sbom.yml copy

    - uses: sbomify/sbomify-action@v26.8.0
      env:
        SBOMIFY_TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
        SBOMIFY_CLEARLY_CACHED_URL: 'http://clearly-cached.internal:8080'

    Bootstrap a workflow for your repository interactively without writing YAML by hand.
    copy

    $ docker run --rm -it \
      -v "$(pwd):/github/workspace" \
      -w /github/workspace \
      -e SBOMIFY_TOKEN=$SBOMIFY_TOKEN \
      ghcr.io/sbomify/sbomify-action \
      sbomify-action wizard

    • Adds SBOMIFY_FETCH_RUNTIMES=0 env var to opt out of on-demand tool fetching in air-gapped environments.
    • Adds SBOMIFY_CLEARLY_CACHED_URL env var to point the action at a self-hosted or local clearly-cached proxy instead of the default clearly-cached.sbomify.com.
    • Introduces clearly-cached, a public caching proxy at clearly-cached.sbomify.com that sits in front of ClearlyDefined, returning a flat 0.4KB projection of license fields; resolves 76 of 76 packages in 5s warm vs 31 of 76 in 474s direct.
    • Per-ecosystem tool bundles are now fetched from sbomify/sbom-tools at runtime, pinned by digest, verified, and attested, replacing tools baked into the image; the container image drops from 515MB to 106MB.
    • Generator fallback chain is now strict inside the image: a generator that claims a project and then fails aborts the run instead of silently falling through to a lower-quality scanner.

    +6 more show less

    • Discovery now detects lock files inside git submodules (via .gitmodules or vendored clones), annotates them clearly, and leaves them deselected by default with an explanation.
    • Enrichment lookups across all twelve sources are now cached across runs; transient failures and 429s are not persisted; negative results expire in one day rather than one month.
    • Adds first-class lock-file and manifest support for Gradle (gradle.lockfile), Swift (Package.swift), PHP (composer.json via a proper Composer bundle), Rust crates with only Cargo.toml, .NET project files, Haskell, Erlang, and Clojure.
    • Manifests listing version ranges now read the adjacent lock file to record the versions actually shipped.
    • Component version is now sourced from the release tag when the workflow runs on a tag; pre-releases are marked as pre-releases when published to sbomify.
    • Supports running directly from PyPI with no install step via pipx run sbomify-action or uvx sbomify-action.

    11 details in Everything

17. announced Aug 25, 2026 · issue 058

    sbomify v26.8.0 adds Security Advisories, gated Trust Center, CRA KPIs, risk_accepted state, and CSV exports

    └──▷ HOW TO FIND IT
    Set patch SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. targets by severity so CRA KPIs are computable from day one without opening workspace settings manually.
    📍In the workspace Settings, go to the CRA section and set patch SLA targets: Critical: 7 days, High: 30 days, Medium: 90 days. Once saved, the five KPIs (mean time to triage, mean time to remediate, open criticals with KEV split, patch SLA compliance, VEX publication latency) become visible on the findings dashboard.
    Export all findings for a specific product release to CSV for auditor or procurement review, matching exactly what the dashboard shows.
    📍In the product release view, open the Exports section and download the Findings CSV. The export applies live VEX suppressions and latest-per-component data, so the row counts match the dashboard beside it. Unreadable artifacts appear as explicit rows rather than being silently omitted.
    Publish a gated security advisory so only customers under NDA for a specific product can read it, without revealing the advisory's existence to others.
    📍In the Security Advisories module, create a new advisory with severity, CVSS vector, affected version range (e.g. >= 11.2.0, < 11.2.4-h20), fixed version range, and timeline entries. Set visibility to Gated, attach it to the relevant product, then publish to the Trust Center. Readers without a workspace-level NDA grant and access to that product receive a 404.
    • New Security Advisories module lets you author vendor advisories with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector, affected/fixed version ranges, product associations, and a timestamped timeline, published directly to your Trust Center.
    • Advisories support three visibility states — Private, Public, and Gated — where Gated requires both a workspace-level NDA grant and a link to a product the reader can already access; per-advisory product filtering redacts names the reader is not entitled to see.
    • New CRA patch SLA targets, defaulting to Critical 7 / High 30 / Medium 90 days, gate five computable KPIs: mean time to triage, mean time to remediate, open criticals with KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. split, patch SLA compliance, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. publication latency.
    • New risk_accepted finding state requires a business justification, named risk owner, and expiry date; publishes downstream as exploitable with a will_not_fix response in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. rather than not_affected, to avoid false claims.
    • Malicious packages are now a distinct structural category, reclassified at read time across all historical scans without rescanning, and no longer fall through to a default medium severity.

    +12 more show less

    • Four new CSV exports covering inventory, licenses, findings, and vulnerabilities, scoped to workspace, product, release, or component, reading the same latest-per-component data and live VEX suppressions as the dashboard.
    • New OpenChain Telco SBOM Guide v1.1 conformance plugin checks the clauses the Guide mandates.
    • SBOM freshness windows: components can now carry a freshness expectation and SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. that age past it are flagged as stale.
    • EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and CVSS 4.0 are now captured from both scanner paths; ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. exploited flag appears alongside CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal..
    • Empty or unreadable scan results are now three distinct states — recognized nothing, scanner error, unreadable spec version — none of which render as a clean bill of health.
    • CRA wizard now captures EU Authorized Representative details and mandate per Article 22/25, rendering them on the Declaration of Conformity; missing mandatory fields are surfaced loudly rather than silently omitted.
    • Export packages now pin a retention floor at creation per Article 13(15), so a later product change cannot silently shorten a previously exported compliance record.
    • End-of-life readiness check surfaces unpatched critical and high findings, drafts an EOL announcement through the advisory channel, and pins the final SBOM and VEX to a versioned release instead of a floating latest pointer.
    • security.txt generation follows BSI TR-03183-3 shape with separate CSIRT contact and report-page slots, an optional CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. pointer, and an Expires field clamped to at most one year; shares data with the CRA wizard.
    • Trust Center redesigned with a filter sidebar, dense advisory table with per-product version rows rendering version ranges as comparison strings (e.g. >= 11.2.0, < 11.2.4-h20), live faceting, and a JavaScript-free plain form fallback.
    • CI/CD integration dialog generates a single copy-paste command; clicking to include a token mints one scoped to publishing only, with a 7-day TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and a descriptive name, minted on click rather than on dialog open.
    • Navbar search upgraded to a navigation spotlight allowing jump-to for any product, component, or page.

    17 details in Everything

18. 26.8.0 Aug 20, 2026 · issue 051

    API surface changed: +4 endpoints

    API change

    API surface changed: +4 endpoints

    • + GET /api/v1/exports/findings.csv
    • + GET /api/v1/exports/inventory.csv
    • + GET /api/v1/exports/licenses.csv
    • + GET /api/v1/exports/vulnerabilities.csv
    • New endpoint GET /api/v1/exports/findings.csv
    • New endpoint GET /api/v1/exports/inventory.csv
    • New endpoint GET /api/v1/exports/licenses.csv
    • New endpoint GET /api/v1/exports/vulnerabilities.csv

    4 details in Everything

19. 26.7.1 Aug 10, 2026 · issue 041

    sbomify now publishes an API — 187 endpoints across 17 areas: Artifacts, Controls, Cle, …

    • Artifacts (23 endpoints) — create, read, update, delete
    • Controls (21 endpoints) — create, read, update, delete
    • Cle (20 endpoints) — create, read
    • Workspaces (20 endpoints) — Manage workspace settings, members, branding, and collaboration features.
    • Products (19 endpoints) — Structure your software inventory with products that group components and are organised by releases.

    +4 more show less

    • Releases (19 endpoints) — Tag and manage product releases with downloadable artifacts and version tracking.
    • Compliance (17 endpoints) — create, read, update
    • Components (11 endpoints) — Organize and manage software components that contain SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and documents.
    • 9 more areas: Vulnerability Scanning, Access Requests, Oidc Trusted Publishing, Plugins, Billing, Licensing, Notifications, User, Internal

    9 details in Everything

20. v26.7.1 Jul 30, 2026 · issue 041

    sbomify v26.7.1 adds end-to-end VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. authoring/ingestion, CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. support, and Trust Center posture downloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.7.1 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.7.1

    • Component SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. list endpoint gains version and format filtering parameters.
    • Adds VEX end-to-end workflow: author, upload, and ingest VEX documents in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage., and CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. formats.
    • Adds in-product VEX triage and lifecycle management, with opt-in Dependency-Track triage sync auto-pinned to releases.
    • Adds scheduled drift detection for stale VEX statements and uncovered High/Critical findings.
    • Adds CBOM (Cryptography Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts.) ingestion across every lineage, with CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. registry normalization and a workspace dashboard.

    +4 more show less

    • Extends Trust Center to expose VEX and CBOM downloads and a vulnerability posture panel.
    • Enforces workspace-scoped token binding across the workspaces API.
    • Adds PostHog per-artifact analytics tracking VEX, CBOM, and HBOM uploads, downloads, deletions, and release pulls.
    • Adds OpenGrep SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. workflow to the CI pipeline.

    9 details in Everything

21. v26.7.0 Jul 7, 2026 · release notes

    sbomify v26.7.0 adds CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. support with backfill command, can() authz, and token rate limiting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.7.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.7.0

    • Adds bom_type=cbom auto-detection and tagging on upload for Crypto-asset BOMs
    • Adds the backfill command to re-tag stored CBOMs and run PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. assessments
    • Introduces the can() authorization front door, migrating all inline role checks onto it
    • Adds per-token API rate limiting returning HTTP 429 with Retry-After header and stricter limits on upload endpoints
    • Exposes X-RateLimit-* response headers on token-authenticated API responses

    +11 more show less

    • Adds bulk API-token revocation capability in the UI
    • Surfaces last_used_at tracking for access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. in the UI
    • Adds structured audit logging for token-auth events
    • Adds PQC readiness classification and a PQC assessment plugin with a component posture card
    • Adds a read API endpoint for crypto-asset inventory derived from uploaded CBOMs
    • Enforces API-token action scoping within can()
    • Confines OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./CI bots to their bound component on release endpoints
    • Enforces token read/workspace scopes across list, artifact, and component endpoints
    • Adds owner-only delete and guest upload restrictions
    • Adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.-native cross-document linking for aggregates
    • Enables faster cold aggregate builds via parallel fetching with cache GC

    16 details in Everything

22. v26.3.0 Jun 12, 2026 · release notes

    sbomify v26.3.0 adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. trusted publishing and removes the Project layer from the hierarchy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.3.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.3.0

    • verify_item_access now reads roles directly from the database instead of the session cache.
    • Authenticated binding-management API for OIDC workflows, including private-repo bindings via deferred ID pinning using org/repo claims.
    • Accepts string repository_id and owner_id claims in GitHub OIDC tokens and tolerates clock skew during verification.
    • Replaced the Project layer with a Product → Component hierarchy, accompanied by an automatic data migration.
    • NinjaAPI now enforces CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. requirements for cookie/session authentication; bearer-token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it./OIDC) requests remain exempt.

    +5 more show less

    • List endpoints now require authentication and reject invalid bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
    • Member-ship enforcement on branding reads with redaction of private product names.
    • Signed artifact downloads re-check current access permissions at request time.
    • Component creation returns DUPLICATE_NAME error code on name collision.
    • CRA documentation renders correctly in non-GFM markdown viewers and generates PDFs via WeasyPrint bundled in the distroless production image.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Project layer has been removed; the hierarchy is now strictly Product → Component.
    • !Personal access tokensPersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. default to a 90-day expiration lifetime.
    • !CSRF protection is enforced on all cookie/session API requests.
    • !List endpoints previously open or anonymously accessible now require authentication.
23. v26.2.0 May 7, 2026 · release notes

    v26.2.0 adds EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. compliance wizard, Component Lifecycle Events API, SBOM signature endpoints, and CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims./SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.2.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.2.0

    • Adds CRA Compliance Wizard with scope screening, BSI guidance, EN 18031 opt-in, and public Declaration of Conformity page
    • Adds /api/v1/cle/ TEATEATiny Encryption Algorithm, a symmetric block cipher designed by Wheeler and Needham in 1994, valued for its minimal code footprint and simplicity, making it attractive for embedded or constrained environments. CLE endpoint for multi-level Component Lifecycle Events management
    • Adds upload/download API endpoints for SBOM signatures and provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. attestations
    • Adds sbom-verification plugin supporting sigstore verification (replaces github-attestation)
    • Enables requires_release flag on plugins to tie execution to specific releases

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbom-verification plugin replaces github-attestation plugin; existing github-attestation configurations will fail
24. v26.1.0 Apr 2, 2026 · release notes

    sbomify v26.1.0 adds CRA Compliance Wizard, RFC 9116 security.txt support, and Chainguard distroless Python images

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v26.1.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v26.1.0

    • is_builtin field for plugin lifecycle reconciliation
    • CRA Compliance Wizard guided workflow for EU Cyber Resilience Act readiness
    • RFC 9116 security.txt support for Trust Center pages
    • Chainguard Distroless Python production Docker images

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbom component type merged into bom with automatic data migration
    • !Versioning switched from SemVer to CalVer (YY.MINOR.PATCH)
25. v0.27.0 Feb 24, 2026 · release notes

    sbomify v0.27.0 adds TEATEATiny Encryption Algorithm, a symmetric block cipher designed by Wheeler and Needham in 1994, valued for its minimal code footprint and simplicity, making it attractive for embedded or constrained environments. API support, SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0 format, scoped personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., and user self-deletion with GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.27.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    • Adds full Transparency Exchange API (TEA) support including the well-known endpoint, dynamic URL generation with request parameter support, and dynamic API versioning
    • Adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3.0 format support with detection, validation, and schema handling for all built-in assessment plugins (NTIA, CISA, BSI, FDA, checksum, GitHub attestation)
    • Adds GET /api/v1/user/export GDPR data export endpoint accessible during the self-deletion grace period
    • Personal access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. are now scoped to workspaces (workspace_id) for finer-grained API access control
    • Adds User Self-Deletion capability with a 14-day soft-delete grace period, Stripe customer deletion, Keycloak user disabling, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. re-authentication prevention

    +1 more show less

    • SBOM upload limit increased to 100MB

    6 details in Everything

26. v0.26.0 Feb 16, 2026 · release notes

    sbomify v0.26.0 adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. dashboard updates, BSI compliance plugin, and account self-deletion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    └──▷ HOW TO FIND IT
    Monitor SBOM generation status in real-time without page refresh.
    📍Connect the dashboard frontend to the WebSocket endpoint (Django Channels + Redis)
    Add BSI TR-03183-2 checks using the new plugin architecture.
    📍Install and configure the BSI TR-03183-2 compliance plugin via the dependency system
    • WebSocket real-time updates for live dashboard data via Django Channels and Redis
    • New BSI TR-03183-2 compliance plugin with a new plugin dependency system
    • Component visibility gating & document access control capabilities

    3 details in Everything

27. v0.25 Jan 20, 2026 · release notes

    sbomify v0.25 adds Sigstore attestation verification, SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. download support, compliance badges, and product lifecycle tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.25

    └──▷ TRY IT
    Download an SBOM in the new SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 format via the API.
    copy

    $ curl -H 'Authorization: Bearer <token>' https://sbomify.app/api/sboms/<id>/download?format=spdx_2_3

    View the compliance status badge on your product's public page via the UI.
    📍Navigate to Products › <Product Name> › Compliance tab in the console.
    • GitHub Attestation Plugin verifies SBOM attestations via Sigstore/cosign with automatic retry logic
    • Download SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDX 2.3 format (in addition to existing CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. support)
    • Product Lifecycle tracks release date, end-of-support, and end-of-life dates
    • Contact Role Flags allow marking contacts as authors, security contacts, or technical contacts
    • Compliance Badges display compliance status on product listings and public pages

    +1 more show less

    • Copy Badge Button generates markdown badge snippets for READMEs

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API error messages no longer leak team/resource info, returning generic Access denied; use the error_code field instead.
28. v0.24 Jan 14, 2026 · release notes

    sbomify v0.24 adds a plugin-based compliance assessment framework with built-in NTIA, CISA, CRA, and FDA plugins

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.24

    └──▷ HOW TO FIND IT
    Enable compliance assessments for your team in the UI.
    📍Navigate to Settings → Plugins and toggle the plugins you wish to enable for SBOM upload validation.
    • Adds Settings → Plugins UI entry to enable the new plugin-based compliance assessment framework that runs automatically on SBOM upload
    • Introduces built-in compliance plugins for NTIA Minimum Elements, CISA 2025 Minimum Elements, EU Cyber Resilience Act (CRA), FDA Medical Device Cybersecurity, and Checksum Verification
    • Enables per-team plugin enablement with feature gating based on billing plans
    • Renames Contact profiles to use a 3-level hierarchy (Profile → Entity → Contact) aligned with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. specification

    4 details in Everything

29. v0.23 Jan 4, 2026 · release notes

    sbomify v0.23 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.3 and 1.4 generation support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.23

30. v0.21 Dec 19, 2025 · release notes

    Adds Keycloak login theme, workspace switcher modal, vulnerability trends dashboard, and enhanced security logging in v0.21

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.21

    • Custom Keycloak login theme with Tailwind CSS styling is now supported
    • Adds Workspace switcher via a modal interface in the sidebar
    • Introduces Vulnerability trends dashboard with interactive charts for visualizing security data over time

    3 details in Everything

31. v0.20 Dec 12, 2025 · release notes

    sbomify v0.20 adds custom domain routing for Trust Center pages and a streamlined onboarding wizard.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.20

    └──▷ HOW TO FIND IT
    Configure a custom domain like trust.example.com for your workspace's public Trust Center pages.
    📍Navigate to Workspace Settings › Branding, enter your CNAME in the Custom Domain field, and follow the DNS validation steps provided in the UI.
    • Adds CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin.-based custom domain support for public Trust Center pages
    • Adds a single-step SBOM identity onboarding wizard with automatic redirect on first login
    • Allows editing workspace names directly from the settings page
    • Implements database-backed token URLs for team invitations to replace previous methods

    4 details in Everything

32. v0.19 Dec 5, 2025 · release notes

    sbomify v0.19 adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema./1.7 support, custom domains, and vulnerability scanning dashboard.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.19

    • released_at field for release date tracking
    • Global Components - Workspace-level reusable components
    • Contact Profiles - Reusable supplier information for SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Workspace Visibility Controls - Public/private toggle
    • Custom Domain Support

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !STATICFILES_STORAGE → STORAGES setting update required
33. v0.18 Oct 31, 2025 · release notes

    sbomify v0.18 adds user onboarding with email notifications and promo code support for Stripe

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.18

    └──▷ USE IT
    Run sbomify commands using the new UV dependency manager
    shell copy

    uv run sbomify --help

    • Adds a comprehensive user onboarding system that sends email notifications to new users
    • Adds promo code support for Stripe checkout, allowing discount codes during payment

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python commands now require uv run instead of poetry run due to migration from Poetry to UV
    • !Django apps are no longer in the root directory; they are now located under sbomify/apps/
    • !ASGIASGIA Python async web server interface specification that defines how servers and applications exchange HTTP and WebSocket messages; cyber tools use it to serve high-concurrency APIs without blocking on I/O. server is now Uvicorn instead of Gunicorn for handling requests
34. v0.17 Aug 14, 2025 · release notes

    sbomify v0.17 adds vulnerability scanning via Dependency Track and OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories., a new metrics dashboard, and product description fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.17

    • Adds Vulnerability Scanning Integration with Dependency Track and OSV support, including team-level configuration and automated weekly scans
    • Introduces a Vulnerability Dashboard for real-time metrics, historical tracking, and time series analysis
    • Adds optional product description fields to products for documentation and organization

    3 details in Everything

35. v0.16.6 Jul 18, 2025 · release notes

    sbomify v0.16.6 adds signed URLs for private SBOM access and SIGNED_URL_SALT env var.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.6 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.16.6

    └──▷ TRY IT
    Configure the sbomify service to generate secure, time-limited URLs for sharing private SBOM components.
    copy

    $ export SIGNED_URL_SALT="$(openssl rand -hex 32)"

    • Adds SIGNED_URL_SALT environment variable to enable secure, time-limited signed URL access for private SBOM components
    • Enables automatic inclusion of document and product links as external references in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Adds inline editing functionality with form validation for existing documents

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SIGNED_URL_SALT environment variable is now required for production; omitting it will prevent signed URL functionality
36. v0.16 Jul 14, 2025 · release notes

    sbomify v0.16 introduces NTIA compliance validation, versioned release management, and product identifier support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.16

    └──▷ TRY IT
    Validate an existing SBOM against NTIA standards and retrieve the compliance report.
    copy

    $ curl -X POST https://<instance>/api/v1/sboms/<sbom_id>/ntia-compliance \
      -H 'Authorization: Bearer <token>'

    Create a new beta release to organize specific SBOM versions.
    copy

    $ curl -X POST https://<instance>/api/v1/releases \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"version": "v0.2.0-beta", "status": "beta"}'

    Generate a consolidated SBOM for a specific release to distribute to clients.
    copy

    $ curl -o sbom.json https://<instance>/api/v1/releases/<release_id>/download

    • /api/v1/releases API to create versioned releases (e.g., v1.0.0, beta) with automatic latest updates
    • Support for marking releases as alpha, beta, or RC via the new release status field
    • /api/v1/releases/{id}/download endpoint generates consolidated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. containing only artifacts from a specific release
    • products.<CPE> and products.<PURL> fields added to product configuration for discoverability

    4 details in Everything

37. v0.15 Jul 4, 2025 · release notes

    sbomify v0.15 adds a documents hub for specs/reports and configurable S3 buckets via AWS_DOCUMENTS_* env vars

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.15

    • AWS_DOCUMENTS_* environment variables added to configure separate S3 buckets for documents, distinct from SBOM storage
    • Documents hub capability: upload, version, and share specs, manuals, and compliance reports alongside SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.

    2 details in Everything

38. v0.14 Jul 1, 2025 · release notes

    sbomify v0.14 adds one-click Project SBOM zip export and prevents accidental public items

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.14

    └──▷ HOW TO FIND IT
    Download all project SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for a specific product at once.
    📍Navigate to the Product page and click One-click SBOM export.
    • Adds One-click SBOM export to download a zip of every Project SBOM from a Product page
    • Adds built-in checks that stop users from making a private item public by mistake

    2 details in Everything

39. v0.13 Jun 25, 2025 · release notes

    v0.13 introduces comprehensive CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API endpoints and Vue.js component architecture overhaul with enhanced billing system

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.13

    • Migrated from Django views to modern REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for all CRUD operations on Products, Projects, and Components
    • Implemented standardized API schemas and validation for the new REST API
    • Added reusable Vue.js components including StandardCard.vue, StatCard.vue, and SbomsTable.vue with advanced filtering

    3 details in Everything

40. v0.12 Jun 20, 2025 · release notes

    SBOMify v0.12 adds OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories.-powered CVE scanning, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license validation, and new license management API endpoints

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.12

    └──▷ HOW TO FIND IT
    Scan an uploaded SBOM for known vulnerabilities using the new OSV integration
    📍Navigate to the Vulnerability Dashboard in the UI after uploading a new SBOM to view severity scores and details.
    • CVE integration using the OSV database for automated vulnerability scanning of SBOM components
    • Real-time validation of complex license expressions against SPDX standards

    2 details in Everything

41. v0.10.0 May 16, 2025 · release notes

    Adds async background processing via Dramatiq/Redis and a dedicated sbomify-worker service for SBOM license analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ USE IT
    Run the new background worker to offload SBOM license analysis tasks.
    shell copy

    sbomify-worker sbomify.tasks

    Populate the database with dummy data for local development or integration testing.
    shell copy

    python manage.py create_test_sbom_environment

    • sbomify-worker service runs poetry run dramatiq sbomify.tasks to process background jobs like SBOM license analysis
    • Configurable Redis connection via the REDIS_URL environment variable with Django caches wired through django-redis
    • Management command create_test_sbom_environment for generating test data

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum supported Python version is raised to 3.12
    • !Redis is now a hard requirement and a worker process must be deployed alongside the web app
    • !Docker build targets renamed; custom dev Dockerfiles were removed
42. v0.9.0 May 14, 2025 · release notes

    sbomify v0.9.0 adds billing module with Stripe caching and new release scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ USE IT
    Check if billing is active before processing a subscription event.
    python copy

    from sbomify.billing.config import is_billing_enabled
    if is_billing_enabled():
        limit = get_unlimited_plan_limits()

    • Introduce billing configuration module with is_billing_enabled() and get_unlimited_plan_limits() helpers
    • Add billing services for fetching Stripe prices with caching via get_stripe_prices()
    • Add bin/generate-favicons script for automated favicon generation
    • Add bin/release.sh for controlled Django migration and release workflow
    • Update static asset path from /code/static/ to /code/staticfiles/ for JS builds

    5 details in Everything

43. v0.7.0 May 6, 2025 · release notes

    sbomify v0.7.0 adds automated Keycloak bootstrapping via bin/keycloak-bootstrap.sh and new .env configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ USE IT
    Bootstrap a local Keycloak instance for development without manual setup steps.
    shell copy

    ./bin/keycloak-bootstrap.sh

    • Adds bin/keycloak-bootstrap.sh script to automatically manage and bootstrap Keycloak in development environments.
    • Introduces new environment variables in .env.example for controlling Keycloak configuration without manual setup.

    2 details in Everything

44. v0.6.0 Mar 3, 2025 · release notes

    sbomify v0.6.0 adds Stripe billing with plan limits and a notifications API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/sbomify/sbomify.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • stripe integration with plan-based usage limits on resource creation (products, projects, components)
    • New POST /notifications endpoint for the dedicated notifications system

    2 details in Everything