SBOM and VEX: Knowing What You Ship with CycloneDX 1.7 and SPDX 3
An SBOM is the machine-readable list of components in a release, and its real value is querying which version of which product is affected when a new CVE arrives, without building anything; VEX then states, with a justification, whether it is affected. For Bookstore we produce and verify .NET, Angular and image SBOMs, query them in Dependency-Track and apply OpenVEX and CycloneDX VEX with real output.
14 Nov 2026
·
13 min
·
5
