SBOM

Anchore is highlighting the challenge of 'Bring Your Own SBOM' practices, where software buyers increasingly request a software bill of materials from vendors. Individually an SBOM is straightforward, but organizations handling thousands of them across suppliers face major difficulties in storing, updating and acting on the data. The company promotes its platform as a way to manage SBOMs at scale for security and compliance.

The OWASP Foundation's Dependency-Track project has shipped version 5.2.0 of its software supply chain component analysis platform, which uses SBOMs to identify risk in third-party dependencies. The release was announced by security firm Secburg, whose writeup covers the new version's changes for teams tracking component vulnerabilities and license compliance.

The Linux Foundation has released OpenChain Automotive SBOM Framework 1.0, a standardized framework for software bills of materials aimed at improving reliability and traceability in automotive software. The release gives carmakers and suppliers a common way to document the components in vehicle software, supporting compliance and supply chain transparency as software becomes central to modern vehicles.