Exporting a software bill of materials for your repository

You can export a software bill of materials or SBOM for your repository from the dependency graph. SBOMs allow transparency into your open source usage and help expose supply chain vulnerabilities, reducing supply chain risks.

Who can use this feature?

Anyone on GitHub

About the dependency graph and SBOM exports

The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the dependency submission API. For each repository, it shows dependencies, the ecosystems and packages it depends on.

For each dependency, you can see the vulnerability severity. You can also search for a specific dependency using the search bar. Dependencies are sorted automatically by vulnerability severity.

GitHub Enterprise Server does not retrieve license information for dependencies, and does not calculate information about dependents, the repositories and packages that depend on a repository.

You can export the current state of the dependency graph for your repository as a Software Bill of Materials (SBOM) using the industry standard SPDX format:

Via the GitHub UI
Using the REST API

An SBOM is a formal, machine-readable inventory of a project's dependencies and associated information (such as versions and package identifiers). SBOMs help reduced supply chain risks by:

providing transparency about the dependencies used by your repository
allowing vulnerabilities to be identified early in the process
providing insights in the license compliance, security, or quality issues that may exist in your codebase
enabling you to better comply with various data protection standards

If your company provides software to the US federal government per Executive Order 14028, you will need to provide an SBOM for your product. You can also use SBOMs as part of your audit process and use them to comply with regulatory and legal requirements.

Note

Dependents are not included in SBOMs.