sbomify — The Cyber Toolchain

sbomify v26.11.0

Tue, 03 Nov 2026 14:16:55 GMT

sbomify adds AI-advisory approval gates, agent-token triage queuing, cross-product release linking, CRA Article 14 reporting, and VEX-aware vulnerability Trends⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds human-review gates for AI agent actions: changes an AI agent makes to a published advisory now require human approval before they go live, and agent tokens can queue triage decisions for human review by submitting with `review=true`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • A release can now link to another product's release, with linked releases manageable from the release page. • sbomify now prepares, tracks, and records CRA Article 14 reports for submission to ENISA's portal. • The trust center advisory page is redesigned around an 'Am I affected?' workflow. • VEX improvements: VEX-suppressed findings are now shown everywhere vulnerabilities are counted, including the Trends tab; the VEX statement cap is raised to 50,000 with a warning displayed when that limit is approached; and the VEX review view now shows which versions a submission applies to. • Each API token's type is now shown in the token list. • Vulnerability IDs are now linked to sbomify Insights. • The manufacturer's keyless Sigstore signature is now preserved on CRA export bundles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.10.0

Mon, 26 Oct 2026 13:50:41 GMT

API surface changed: +3 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PATCH /api/v1/advisories/{advisory_id}/products/{product_id}/status⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PATCH /api/v1/advisories/{advisory_id}/statuses/{status_id} • New endpoint POST /api/v1/advisories/{advisory_id}/products Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.10.0

Sat, 24 Oct 2026 19:31:35 GMT

sbomify v26.10.0 adds a Vulnerabilities page, VEX approval queue for AI agents, Operator role, Vanta integration, and live WebSocket updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Vanta integration, enabled via new `VANTA_*` environment variables, to sync frameworks and controls from Vanta with optional Trust Center publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `REDIS_CACHE_MAX_CONNECTIONS` and `REDIS_CACHE_POOL_TIMEOUT` environment variables to tune Redis connection pooling, `LOG_MAX_SIZE` and `LOG_MAX_FILE` environment variables for log rotation control, and `KEYCLOAK_PUBLIC_URL` environment variable for self-hosted Keycloak configuration. • Adds `history_limit` query parameter and `all_runs_total` field to `GET /plugins/assessments/{sbom_id}`, capping `all_runs` at 50 runs. • Adds Invitations API on both v1 and v2. • Adds a Vulnerabilities page with a deduplicated list of open findings, release and SBOM-version filters, and Fix/Triage prompts for coding agents. • Adds a VEX approval queue where AI agents submit VEX rulings using a new AI-agent token and a human approves or rejects them on the Review tab. • Adds an Operator role that grants read access to the entire workspace and the ability to triage findings, without permission to change anything else. • Adds live UI updates over WebSocket via the new `ws/user/` route. • Adds per-product advisory status editing after an advisory is created, bulk delete for advisories, custom ID prefix support for advisories, and Markdown support for advisories. • Adds an assessments requirements matrix view. Breaking changes: • Token hashing migration `access_tokens.0012` cannot be rolled back — old releases cannot authenticate API tokens after it runs. • The findings migration drops the `vulnerability_scanning_findings` table; old pods in a rolling deploy will fail. Run `manage.py backfill_findings --missing-only` to rebuild findings. • `POST /api/v1/licensing/custom-licenses` is removed. • Creating an access request now requires authentication and takes no request body; all access-request routes enforce token scopes. • `GET /plugins/assessments/{sbom_id}` caps `all_runs` at 50; use `history_limit` and `all_runs_total` for full history. • `GET /workspaces/` now shows members, invitations, and billing data only to admins. • The branding `PATCH` endpoint now only accepts `null` for icon and logo fields. • `PATCH /advisories/{id}` now rejects unknown fields with 422. • `/releases/{id}/artifacts?mode=available` now requires the `release:manage` scope. • Environment variables `TEAMS_*_ROLES` are renamed to `WORKSPACE_*_ROLES`; old names work as aliases for now. • `KEYCLOAK_WEBHOOK_SECRET` environment variable is removed. • Custom `DRAMATIQ_BROKER` overrides must be updated. • Custom domains now require outbound HTTPS from workers; rotating `SECRET_KEY` requires domains to be re-verified. • The first Stripe sync moves ended paid plans to Community, making their private products and components public. • Pending Owner invitations now grant Admin instead of Owner — re-send affected invitations. • The new `ws/user/` WebSocket route must be forwarded in reverse proxy configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.10.0

Fri, 23 Oct 2026 08:09:08 GMT

API surface changed: +7 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/vulnerability-scanning/vex-submissions/{submission_id} • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/fix-prompt • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vex-submissions • New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerabilities • New endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions • New endpoint POST /api/v1/vulnerability-scanning/vex-submissions/{submission_id}/withdraw • POST /api/v1/sboms/upload-file/{component_id}: param review (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.10.0

Tue, 13 Oct 2026 08:15:15 GMT

API surface changed: +3 endpoints, −1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/workspaces/{team_key}/invitations/{invitation_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/workspaces/{team_key}/invitations • New endpoint POST /api/v1/workspaces/{team_key}/invitations • GET /api/v1/plugins/assessments/{sbom_id}: param history_limit (query) added Breaking changes: • Removed endpoint POST /api/v1/licensing/custom-licenses Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.9.0

Wed, 23 Sep 2026 12:06:20 GMT

sbomify v26.9.0 adds a security advisories API, SPDX 3 VEX/scanning support, a Kubernetes Helm chart, CSAF discovery via security.txt, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a security advisories API, including creation and deletion of advisories through the same endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables and disables a workspace's plugins over the API. • Exposes public CSAF discovery through `security.txt`. • Adds `is_default_workspace` field alongside `is_default_team` in the API and on-screen copy. • Serves a v2 API that uses workspace terminology from the same views. • Scores CISA 2026 minimum elements and registers a new compliance plugin. • Scans SPDX 3 documents through a derived copy instead of skipping them. • Sends SPDX documents to Dependency Track through a derived CycloneDX copy. • Validates SPDX 3.0.1 claims against the vendored schema with clear version-edge messages. • Honours VEX statements carried inside an SPDX 3 document about itself. • Closes advisory-to-release gaps in the many-to-many model. • Keeps OIDC publish tokens off the expiry bell so they do not expire. • Gives each vulnerability finding a dedicated detail row. • Shows gated documents with a request-access gate on the trust center. • Adds certification badges on the trust center. • Makes a document's name and version unique per component. • Makes the request body upload ceiling reachable and configurable. • Lets a document be made workspace-wide from its own page. • Pins the CRA audit logger so a raised `LOG_LEVEL` cannot silence it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.9.0

Fri, 18 Sep 2026 07:41:44 GMT

API surface changed: +2 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/plugins/workspaces/{team_key}/settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PUT /api/v1/plugins/workspaces/{team_key}/settings • GET /api/v1/plugins/assessments/{sbom_id}: param findings_limit (query) added; param include_history (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.8.0

Mon, 14 Sep 2026 14:40:20 GMT

Breaking changes: • Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works) • Deprecated endpoint DELETE /api/v1/components/{component_id} (still works) • Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works) • Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works) • Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works) • Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works) • Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works) • Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works) • Deprecated endpoint GET /api/v1/access-requests/pending (still works) • Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works) • Deprecated endpoint GET /api/v1/billing/plans/ (still works) • Deprecated endpoint GET /api/v1/billing/usage/ (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/components (still works) • Deprecated endpoint GET /api/v1/components/{component_id} (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works) • Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works) • Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works) • Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works) • Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works) • Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works) • Deprecated endpoint GET /api/v1/dashboard/summary (still works) • Deprecated endpoint GET /api/v1/documents/{document_id} (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works) • Deprecated endpoint GET /api/v1/exports/findings.csv (still works) • Deprecated endpoint GET /api/v1/exports/inventory.csv (still works) • Deprecated endpoint GET /api/v1/exports/licenses.csv (still works) • Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works) • Deprecated endpoint GET /api/v1/internal/domains (still works) • Deprecated endpoint GET /api/v1/licensing/licenses (still works) • Deprecated endpoint GET /api/v1/notifications/ (still works) • Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works) • Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works) • Deprecated endpoint GET /api/v1/plugins/registered (still works) • Deprecated endpoint GET /api/v1/products (still works) • Deprecated endpoint GET /api/v1/products/{product_id} (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/download (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/links (still works) • Deprecated endpoint GET /api/v1/releases (still works) • Deprecated endpoint GET /api/v1/releases/{release_id} (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works) • Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works) • Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works) • Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works) • Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works) • Deprecated endpoint GET /api/v1/user/export (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works) • Deprecated endpoint GET /api/v1/workspaces/ (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works) • Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works) • Deprecated endpoint PATCH /api/v1/components/{component_id} (still works) • Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works) • Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works) • Deprecated endpoint PATCH /api/v1/products/{product_id} (still works) • Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works) • Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works) • Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works) • Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works) • Deprecated endpoint POST /api/v1/billing/change-plan/ (still works) • Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works) • Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/components (still works) • Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works) • Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works) • Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works) • Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works) • Deprecated endpoint POST /api/v1/controls/mappings/ (still works) • Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works) • Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works) • Deprecated endpoint POST /api/v1/documents/ (still works) • Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works) • Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works) • Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works) • Deprecated endpoint POST /api/v1/notifications/clear/ (still works) • Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works) • Deprecated endpoint POST /api/v1/products (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/links (still works) • Deprecated endpoint POST /api/v1/releases (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works) • Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works) • Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works) • Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works) • Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works) • Deprecated endpoint POST /api/v1/user/delete (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works) • Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works) • Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works) • Deprecated endpoint PUT /api/v1/components/{component_id} (still works) • Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works) • Deprecated endpoint PUT /api/v1/products/{product_id} (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works) • Deprecated endpoint PUT /api/v1/releases/{release_id} (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.8.0

Sun, 13 Sep 2026 14:49:08 GMT

API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/advisories/{advisory_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/advisories/ • New endpoint GET /api/v1/advisories/public/{workspace_key} • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id} • New endpoint GET /api/v1/advisories/public/{workspace_key}/{advisory_id}/csaf • New endpoint GET /api/v1/advisories/{advisory_id} • New endpoint PATCH /api/v1/advisories/{advisory_id} • New endpoint POST /api/v1/advisories/ • New endpoint POST /api/v1/advisories/{advisory_id}/publish • New endpoint POST /api/v1/advisories/{advisory_id}/updates • New endpoint POST /api/v1/advisories/{advisory_id}/withdraw Breaking changes: • Deprecated endpoint DELETE /api/v1/auth/oidc/github/bindings/{binding_id} (still works) • Deprecated endpoint DELETE /api/v1/components/{component_id} (still works) • Deprecated endpoint DELETE /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint DELETE /api/v1/controls/evidence/{evidence_id}/ (still works) • Deprecated endpoint DELETE /api/v1/documents/{document_id} (still works) • Deprecated endpoint DELETE /api/v1/documents/{document_id}/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id}/identifiers/{identifier_id} (still works) • Deprecated endpoint DELETE /api/v1/products/{product_id}/links/{link_id} (still works) • Deprecated endpoint DELETE /api/v1/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/releases/{release_id}/artifacts/{artifact_id} (still works) • Deprecated endpoint DELETE /api/v1/sboms/sbom/{sbom_id} (still works) • Deprecated endpoint DELETE /api/v1/sboms/{sbom_id}/releases/{release_id} (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/domain (still works) • Deprecated endpoint DELETE /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works) • Deprecated endpoint GET /api/v1/access-requests/pending (still works) • Deprecated endpoint GET /api/v1/auth/oidc/github/bindings (still works) • Deprecated endpoint GET /api/v1/billing/plans/ (still works) • Deprecated endpoint GET /api/v1/billing/usage/ (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id} (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/download (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/documents/{kind}/preview (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/export/{package_id}/download (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/oscal-export (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/sbom-status (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/signature (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/staleness (still works) • Deprecated endpoint GET /api/v1/compliance/cra/{assessment_id}/step/{step} (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/components (still works) • Deprecated endpoint GET /api/v1/components/{component_id} (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/documents (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/metadata (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/releases (still works) • Deprecated endpoint GET /api/v1/components/{component_id}/sboms (still works) • Deprecated endpoint GET /api/v1/controls/automation/mappings/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/controls/ (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/csv (still works) • Deprecated endpoint GET /api/v1/controls/catalogs/{catalog_id}/export/summary-csv (still works) • Deprecated endpoint GET /api/v1/controls/controls/{control_id}/evidence/ (still works) • Deprecated endpoint GET /api/v1/controls/controls/{control_id}/mappings/ (still works) • Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/ (still works) • Deprecated endpoint GET /api/v1/controls/public/{workspace_key}/{product_id}/ (still works) • Deprecated endpoint GET /api/v1/dashboard/summary (still works) • Deprecated endpoint GET /api/v1/documents/{document_id} (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/download (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/download/signed (still works) • Deprecated endpoint GET /api/v1/documents/{document_id}/releases (still works) • Deprecated endpoint GET /api/v1/exports/findings.csv (still works) • Deprecated endpoint GET /api/v1/exports/inventory.csv (still works) • Deprecated endpoint GET /api/v1/exports/licenses.csv (still works) • Deprecated endpoint GET /api/v1/exports/vulnerabilities.csv (still works) • Deprecated endpoint GET /api/v1/internal/domains (still works) • Deprecated endpoint GET /api/v1/licensing/licenses (still works) • Deprecated endpoint GET /api/v1/notifications/ (still works) • Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id} (still works) • Deprecated endpoint GET /api/v1/plugins/assessments/{sbom_id}/badge (still works) • Deprecated endpoint GET /api/v1/plugins/registered (still works) • Deprecated endpoint GET /api/v1/products (still works) • Deprecated endpoint GET /api/v1/products/{product_id} (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cbom/download (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/download (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/eol-readiness (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint GET /api/v1/products/{product_id}/links (still works) • Deprecated endpoint GET /api/v1/releases (still works) • Deprecated endpoint GET /api/v1/releases/{release_id} (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/artifacts (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cbom/download (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/events/{event_id} (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/cle/support-definitions (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/download (still works) • Deprecated endpoint GET /api/v1/releases/{release_id}/vex/download (still works) • Deprecated endpoint GET /api/v1/sboms/component/{component_id}/meta (still works) • Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/provenance (still works) • Deprecated endpoint GET /api/v1/sboms/sbom/{sbom_id}/signature (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id} (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/crypto-inventory/cipher-suites.csv (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/download/signed (still works) • Deprecated endpoint GET /api/v1/sboms/{sbom_id}/releases (still works) • Deprecated endpoint GET /api/v1/teams/{team_key}/access-request/{request_id}/nda (still works) • Deprecated endpoint GET /api/v1/user/export (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/triage (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/products-releases (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-drill-down (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-heatmap (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-kpis (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-stats (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-timeseries (still works) • Deprecated endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/vulnerability-trends (still works) • Deprecated endpoint GET /api/v1/workspaces/ (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/branding (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint GET /api/v1/workspaces/{team_key}/suppliers (still works) • Deprecated endpoint PATCH /api/v1/compliance/cra/{assessment_id}/step/{step} (still works) • Deprecated endpoint PATCH /api/v1/components/{component_id} (still works) • Deprecated endpoint PATCH /api/v1/components/{component_id}/metadata (still works) • Deprecated endpoint PATCH /api/v1/controls/catalogs/{catalog_id}/ (still works) • Deprecated endpoint PATCH /api/v1/documents/{document_id} (still works) • Deprecated endpoint PATCH /api/v1/products/{product_id} (still works) • Deprecated endpoint PATCH /api/v1/releases/{release_id} (still works) • Deprecated endpoint PATCH /api/v1/sboms/component/{component_id}/meta (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/branding/{field} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/contact-profiles/{profile_id} (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/domain (still works) • Deprecated endpoint PATCH /api/v1/workspaces/{team_key}/suppliers/{supplier_id} (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/approve (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/reject (still works) • Deprecated endpoint POST /api/v1/access-requests/{request_id}/revoke (still works) • Deprecated endpoint POST /api/v1/auth/oidc/github/bindings (still works) • Deprecated endpoint POST /api/v1/auth/oidc/github/exchange (still works) • Deprecated endpoint POST /api/v1/billing/change-plan/ (still works) • Deprecated endpoint POST /api/v1/compliance/cra/product/{product_id} (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/export (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/findings/{finding_id}/observations (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/generate/{kind} (still works) • Deprecated endpoint POST /api/v1/compliance/cra/{assessment_id}/refresh (still works) • Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/component-releases/{component_release_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/components (still works) • Deprecated endpoint POST /api/v1/components/{component_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/components/{component_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/controls/automation/sync/ (still works) • Deprecated endpoint POST /api/v1/controls/catalogs/activate/ (still works) • Deprecated endpoint POST /api/v1/controls/catalogs/import-oscal/ (still works) • Deprecated endpoint POST /api/v1/controls/controls/{control_id}/evidence/ (still works) • Deprecated endpoint POST /api/v1/controls/mappings/ (still works) • Deprecated endpoint POST /api/v1/controls/mappings/bulk/ (still works) • Deprecated endpoint POST /api/v1/controls/status/bulk/ (still works) • Deprecated endpoint POST /api/v1/documents/ (still works) • Deprecated endpoint POST /api/v1/documents/{document_id}/releases (still works) • Deprecated endpoint POST /api/v1/licensing/custom-licenses (still works) • Deprecated endpoint POST /api/v1/licensing/license-expressions/validate (still works) • Deprecated endpoint POST /api/v1/notifications/clear/ (still works) • Deprecated endpoint POST /api/v1/plugins/assessments/{sbom_id}/{plugin_name}/rerun (still works) • Deprecated endpoint POST /api/v1/products (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint POST /api/v1/products/{product_id}/links (still works) • Deprecated endpoint POST /api/v1/releases (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/artifacts (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/cle/events (still works) • Deprecated endpoint POST /api/v1/releases/{release_id}/cle/support-definitions (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/cyclonedx/{spec_version}/{component_id}/metadata (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/spdx/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/artifact/vex/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/provenance (still works) • Deprecated endpoint POST /api/v1/sboms/sbom/{sbom_id}/signature (still works) • Deprecated endpoint POST /api/v1/sboms/upload-file/{component_id} (still works) • Deprecated endpoint POST /api/v1/sboms/{sbom_id}/releases (still works) • Deprecated endpoint POST /api/v1/teams/{team_key}/access-request (still works) • Deprecated endpoint POST /api/v1/teams/{team_key}/access-request/{request_id}/sign-nda (still works) • Deprecated endpoint POST /api/v1/user/delete (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/triage (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/components/{component_id}/vex-preview (still works) • Deprecated endpoint POST /api/v1/vulnerability-scanning/triage/bulk (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/branding/upload/{file_type} (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/contact-profiles (still works) • Deprecated endpoint POST /api/v1/workspaces/{team_key}/suppliers (still works) • Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/findings/{finding_id} (still works) • Deprecated endpoint PUT /api/v1/compliance/cra/{assessment_id}/signature (still works) • Deprecated endpoint PUT /api/v1/components/{component_id} (still works) • Deprecated endpoint PUT /api/v1/controls/controls/{control_id}/status/ (still works) • Deprecated endpoint PUT /api/v1/products/{product_id} (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/identifiers/{identifier_id} (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/links (still works) • Deprecated endpoint PUT /api/v1/products/{product_id}/links/{link_id} (still works) • Deprecated endpoint PUT /api/v1/releases/{release_id} (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key} (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key}/branding (still works) • Deprecated endpoint PUT /api/v1/workspaces/{team_key}/domain (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.8.0

Sat, 12 Sep 2026 13:30:17 GMT

sbomify 26.8.0

Fri, 11 Sep 2026 14:47:39 GMT

sbomify 26.8.0

Thu, 10 Sep 2026 14:47:57 GMT

sbomify v26.8.0

Tue, 25 Aug 2026 18:08:22 GMT

sbomify v26.8.0 adds malicious-package detection, EPSS/CVSS 4.0 capture, ENISA EUVD flagging, OpenChain Telco conformance, vulnerability risk acceptance, patch SLA/CRA KPIs, and a redesigned Trust Center. • Captures EPSS scores and CVSS 4.0 from both scanner paths, surfacing richer severity data on findings. • Surfaces malicious packages as their own distinct vulnerability class, separate from CVE-based findings. • Flags ENISA EUVD exploited findings alongside existing CISA KEV badges on vulnerability views. • Adds suppressed-findings toggle plus state and KEV filters on the internal vulnerability drill-down. • Adds formal risk acceptance for vulnerabilities, recording an owner and an expiry date. • Adds a patch SLA matrix and five CRA KPIs to the vulnerability posture view. • Adds an OpenChain Telco SBOM Guide v1.1 conformance plugin. • Adds vulnerability lifecycle tracking for age and Mean Time To Remediate (MTTR). • Introduces an SBOM freshness window and stale flag to signal outdated SBOMs. • Enables on-demand assessment re-runs for plugins without waiting for a scheduled scan. • Adds risk categories for SPDX license identifiers in the licensing view. • Links advisory IDs directly to the upstream database that holds them. • Maps the New Advisory modal onto products and releases, with version selection and range-picking. • Pins the Art. 13(15) retention floor on compliance export packages. • Captures the EU Authorized Representative field and includes it on the Declaration of Conformity. • Redesigns the Trust Center with per-product advisory gating for published advisories. • Adds a searchable products table and drill-down cleanup to the Trust Center. • Adds end-of-life transition readiness tracking, announcement, and final artifact handling. • Adds hour-scale expiry presets and an arbitrary custom TTL for access tokens. • Warns users before access tokens expire. • Turns the navbar search into a navigation spotlight. • Consolidates the CI/CD integration dialog into a single command with a 7-day token embedded. • Adds per-IP rate limiting for anonymous and public endpoints. • Adds a supplier list entity to teams for collecting artifacts from external suppliers. • Validates CPE identifiers and makes identifier values copyable in the UI. • Distinguishes 'nothing scanned' from 'nothing found' in vulnerability results. • Settings are reorganized into one page per section with tabs across the top. • Consolidates plugin access to a single entry point in Settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.8.0

Thu, 20 Aug 2026 14:31:25 GMT

API surface changed: +4 endpoints • New endpoint GET /api/v1/exports/findings.csv • New endpoint GET /api/v1/exports/inventory.csv • New endpoint GET /api/v1/exports/licenses.csv • New endpoint GET /api/v1/exports/vulnerabilities.csv Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify 26.7.1

Mon, 10 Aug 2026 10:20:35 GMT

sbomify now publishes an API — 187 endpoints across 17 areas: Artifacts, Controls, Cle, … • Artifacts (23 endpoints) — create, read, update, delete • Controls (21 endpoints) — create, read, update, delete • Cle (20 endpoints) — create, read • Workspaces (20 endpoints) — Manage workspace settings, members, branding, and collaboration features. • Products (19 endpoints) — Structure your software inventory with products that group components and are organised by releases. • Releases (19 endpoints) — Tag and manage product releases with downloadable artifacts and version tracking. • Compliance (17 endpoints) — create, read, update • Components (11 endpoints) — Organize and manage software components that contain SBOMs and documents. • 9 more areas: Vulnerability Scanning, Access Requests, Oidc Trusted Publishing, Plugins, Billing, Licensing, Notifications, User, Internal Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.7.1

Thu, 30 Jul 2026 06:52:34 GMT

sbomify v26.7.1 adds end-to-end VEX authoring/ingestion, CBOM support, and Trust Center posture downloads. • Component SBOMs list endpoint gains `version` and `format` filtering parameters. • Adds VEX end-to-end workflow: author, upload, and ingest VEX documents in CycloneDX, OpenVEX, and CSAF formats. • Adds in-product VEX triage and lifecycle management, with opt-in Dependency-Track triage sync auto-pinned to releases. • Adds scheduled drift detection for stale VEX statements and uncovered High/Critical findings. • Adds CBOM (Cryptography Bill of Materials) ingestion across every lineage, with CycloneDX 1.7 registry normalization and a workspace dashboard. • Extends Trust Center to expose VEX and CBOM downloads and a vulnerability posture panel. • Enforces workspace-scoped token binding across the workspaces API. • Adds PostHog per-artifact analytics tracking VEX, CBOM, and HBOM uploads, downloads, deletions, and release pulls. • Adds OpenGrep SAST workflow to the CI pipeline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.3.0

Fri, 12 Jun 2026 15:25:26 GMT

sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing and removes the Project layer from the hierarchy • `verify_item_access` now reads roles directly from the database instead of the session cache. • Authenticated binding-management API for OIDC workflows, including private-repo bindings via deferred ID pinning using org/repo claims. • Accepts string `repository_id` and `owner_id` claims in GitHub OIDC tokens and tolerates clock skew during verification. • Replaced the 'Project' layer with a 'Product → Component' hierarchy, accompanied by an automatic data migration. • NinjaAPI now enforces CSRF requirements for cookie/session authentication; bearer-token (PAT/OIDC) requests remain exempt. • List endpoints now require authentication and reject invalid bearer tokens. • Member-ship enforcement on branding reads with redaction of private product names. • Signed artifact downloads re-check current access permissions at request time. • Component creation returns `DUPLICATE_NAME` error code on name collision. • CRA documentation renders correctly in non-GFM markdown viewers and generates PDFs via WeasyPrint bundled in the distroless production image. Breaking changes: • The `Project` layer has been removed; the hierarchy is now strictly 'Product → Component'. • Personal access tokens default to a 90-day expiration lifetime. • CSRF protection is enforced on all cookie/session API requests. • List endpoints previously open or anonymously accessible now require authentication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.2.0

Thu, 07 May 2026 18:53:58 GMT

v26.2.0 adds EU CRA compliance wizard, Component Lifecycle Events API, SBOM signature endpoints, and CycloneDX 1.7/SPDX 3.0.1 support • Adds `CRA Compliance Wizard` with scope screening, BSI guidance, EN 18031 opt-in, and public Declaration of Conformity page • Adds `/api/v1/cle/` TEA CLE endpoint for multi-level Component Lifecycle Events management • Adds upload/download API endpoints for SBOM signatures and provenance attestations • Adds `sbom-verification` plugin supporting sigstore verification (replaces `github-attestation`) • Enables `requires_release` flag on plugins to tie execution to specific releases Breaking changes: • `sbom-verification` plugin replaces `github-attestation` plugin; existing `github-attestation` configurations will fail Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v26.1.0

Thu, 02 Apr 2026 12:04:14 GMT

sbomify v26.1.0 adds CRA Compliance Wizard, RFC 9116 security.txt support, and Chainguard distroless Python images • `is_builtin` field for plugin lifecycle reconciliation • CRA Compliance Wizard guided workflow for EU Cyber Resilience Act readiness • RFC 9116 `security.txt` support for Trust Center pages • Chainguard Distroless Python production Docker images Breaking changes: • `sbom` component type merged into `bom` with automatic data migration • Versioning switched from SemVer to CalVer (YY.MINOR.PATCH) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.27.0

Tue, 24 Feb 2026 15:32:09 GMT

sbomify v0.27.0 adds TEA API support, SPDX 3.0 format, scoped personal access tokens, and user self-deletion with GDPR export • Adds full Transparency Exchange API (TEA) support including the well-known endpoint, dynamic URL generation with request parameter support, and dynamic API versioning • Adds SPDX 3.0 format support with detection, validation, and schema handling for all built-in assessment plugins (NTIA, CISA, BSI, FDA, checksum, GitHub attestation) • Adds `GET /api/v1/user/export` GDPR data export endpoint accessible during the self-deletion grace period • Personal access tokens are now scoped to workspaces (`workspace_id`) for finer-grained API access control • Adds User Self-Deletion capability with a 14-day soft-delete grace period, Stripe customer deletion, Keycloak user disabling, and SSO re-authentication prevention • SBOM upload limit increased to 100MB Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.26.0

Mon, 16 Feb 2026 16:51:07 GMT

sbomify v0.26.0 adds WebSocket dashboard updates, BSI compliance plugin, and account self-deletion • `WebSocket` real-time updates for live dashboard data via Django Channels and Redis • New `BSI TR-03183-2` compliance plugin with a new plugin dependency system • Component visibility gating & document access control capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.25

Tue, 20 Jan 2026 16:51:44 GMT

sbomify v0.25 adds Sigstore attestation verification, SPDX 2.3 download support, compliance badges, and product lifecycle tracking. • `GitHub Attestation Plugin` verifies SBOM attestations via `Sigstore/cosign` with automatic retry logic • Download SBOMs in `SPDX 2.3` format (in addition to existing CycloneDX support) • `Product Lifecycle` tracks release date, end-of-support, and end-of-life dates • `Contact Role Flags` allow marking contacts as authors, security contacts, or technical contacts • `Compliance Badges` display compliance status on product listings and public pages • `Copy Badge Button` generates markdown badge snippets for READMEs Breaking changes: • API error messages no longer leak team/resource info, returning generic 'Access denied'; use the `error_code` field instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.24

Wed, 14 Jan 2026 17:49:39 GMT

sbomify v0.24 adds a plugin-based compliance assessment framework with built-in NTIA, CISA, CRA, and FDA plugins • Adds `Settings → Plugins` UI entry to enable the new plugin-based compliance assessment framework that runs automatically on SBOM upload • Introduces built-in compliance plugins for NTIA Minimum Elements, CISA 2025 Minimum Elements, EU Cyber Resilience Act (CRA), FDA Medical Device Cybersecurity, and Checksum Verification • Enables per-team plugin enablement with feature gating based on billing plans • Renames `Contact profiles` to use a 3-level hierarchy (Profile → Entity → Contact) aligned with CycloneDX specification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.23

Sun, 04 Jan 2026 08:50:47 GMT

sbomify v0.23 adds CycloneDX 1.3 and 1.4 generation support • Adds full support for CycloneDX versions 1.3 and 1.4, including JSON schemas and validators. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.21

Fri, 19 Dec 2025 18:45:05 GMT

Adds Keycloak login theme, workspace switcher modal, vulnerability trends dashboard, and enhanced security logging in v0.21 • `Custom Keycloak login theme` with Tailwind CSS styling is now supported • Adds `Workspace switcher` via a modal interface in the sidebar • Introduces `Vulnerability trends dashboard` with interactive charts for visualizing security data over time Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.20

Fri, 12 Dec 2025 16:35:17 GMT

sbomify v0.20 adds custom domain routing for Trust Center pages and a streamlined onboarding wizard. • Adds CNAME-based custom domain support for public Trust Center pages • Adds a single-step SBOM identity onboarding wizard with automatic redirect on first login • Allows editing workspace names directly from the settings page • Implements database-backed token URLs for team invitations to replace previous methods Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.19

Fri, 05 Dec 2025 16:28:15 GMT

sbomify v0.19 adds CycloneDX 1.6/1.7 support, custom domains, and vulnerability scanning dashboard. • `released_at` field for release date tracking • Global Components - Workspace-level reusable components • Contact Profiles - Reusable supplier information for SBOMs • Workspace Visibility Controls - Public/private toggle • Custom Domain Support Breaking changes: • `STATICFILES_STORAGE` → `STORAGES` setting update required Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.18

Fri, 31 Oct 2025 09:35:35 GMT

sbomify v0.18 adds user onboarding with email notifications and promo code support for Stripe • Adds a comprehensive user onboarding system that sends email notifications to new users • Adds promo code support for Stripe checkout, allowing discount codes during payment Breaking changes: • Python commands now require `uv run` instead of `poetry run` due to migration from Poetry to UV • Django apps are no longer in the root directory; they are now located under `sbomify/apps/` • ASGI server is now Uvicorn instead of Gunicorn for handling requests Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.17

Thu, 14 Aug 2025 15:17:00 GMT

sbomify v0.17 adds vulnerability scanning via Dependency Track and OSV, a new metrics dashboard, and product description fields. • Adds Vulnerability Scanning Integration with Dependency Track and OSV support, including team-level configuration and automated weekly scans • Introduces a Vulnerability Dashboard for real-time metrics, historical tracking, and time series analysis • Adds optional product description fields to products for documentation and organization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.16.6

Fri, 18 Jul 2025 18:03:04 GMT

sbomify v0.16.6 adds signed URLs for private SBOM access and `SIGNED_URL_SALT` env var. • Adds `SIGNED_URL_SALT` environment variable to enable secure, time-limited signed URL access for private SBOM components • Enables automatic inclusion of document and product links as external references in generated SBOMs • Adds inline editing functionality with form validation for existing documents Breaking changes: • The `SIGNED_URL_SALT` environment variable is now required for production; omitting it will prevent signed URL functionality Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.16

Mon, 14 Jul 2025 10:54:22 GMT

sbomify v0.16 introduces NTIA compliance validation, versioned release management, and product identifier support. • `/api/v1/releases` API to create versioned releases (e.g., v1.0.0, beta) with automatic 'latest' updates • Support for marking releases as `alpha`, `beta`, or `RC` via the new release status field • `/api/v1/releases/{id}/download` endpoint generates consolidated SBOMs containing only artifacts from a specific release • `products.` and `products.` fields added to product configuration for discoverability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.15

Fri, 04 Jul 2025 15:20:11 GMT

sbomify v0.15 adds a documents hub for specs/reports and configurable S3 buckets via AWS_DOCUMENTS_* env vars • `AWS_DOCUMENTS_*` environment variables added to configure separate S3 buckets for documents, distinct from SBOM storage • Documents hub capability: upload, version, and share specs, manuals, and compliance reports alongside SBOMs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.13

Wed, 25 Jun 2025 17:11:26 GMT

v0.13 introduces comprehensive CRUD API endpoints and Vue.js component architecture overhaul with enhanced billing system • Migrated from Django views to modern REST API endpoints for all CRUD operations on Products, Projects, and Components • Implemented standardized API schemas and validation for the new REST API • Added reusable Vue.js components including `StandardCard.vue`, `StatCard.vue`, and `SbomsTable.vue` with advanced filtering Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.12

Fri, 20 Jun 2025 13:04:16 GMT

SBOMify v0.12 adds OSV-powered CVE scanning, SPDX license validation, and new license management API endpoints • CVE integration using the OSV database for automated vulnerability scanning of SBOM components • Real-time validation of complex license expressions against SPDX standards Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.10.0

Fri, 16 May 2025 15:02:35 GMT

Adds async background processing via Dramatiq/Redis and a dedicated sbomify-worker service for SBOM license analysis • `sbomify-worker` service runs `poetry run dramatiq sbomify.tasks` to process background jobs like SBOM license analysis • Configurable Redis connection via the `REDIS_URL` environment variable with Django caches wired through `django-redis` • Management command `create_test_sbom_environment` for generating test data Breaking changes: • Minimum supported Python version is raised to **3.12** • Redis is now a hard requirement and a worker process must be deployed alongside the web app • Docker build targets renamed; custom dev Dockerfiles were removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.9.0

Wed, 14 May 2025 15:33:00 GMT

sbomify v0.9.0 adds billing module with Stripe caching and new release scripts. • Introduce billing configuration module with is_billing_enabled() and get_unlimited_plan_limits() helpers • Add billing services for fetching Stripe prices with caching via get_stripe_prices() • Add `bin/generate-favicons` script for automated favicon generation • Add `bin/release.sh` for controlled Django migration and release workflow • Update static asset path from `/code/static/` to `/code/staticfiles/` for JS builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.7.0

Tue, 06 May 2025 14:01:21 GMT

sbomify v0.7.0 adds automated Keycloak bootstrapping via bin/keycloak-bootstrap.sh and new .env configuration • Adds `bin/keycloak-bootstrap.sh` script to automatically manage and bootstrap Keycloak in development environments. • Introduces new environment variables in `.env.example` for controlling Keycloak configuration without manual setup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify

sbomify v0.6.0

Mon, 03 Mar 2025 17:06:50 GMT

sbomify v0.6.0 adds Stripe billing with plan limits and a notifications API • `stripe` integration with plan-based usage limits on resource creation (products, projects, components) • New `POST /notifications` endpoint for the dedicated notifications system Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sbomify