CycloneDX

Standard descriptions of software composition

Visit CycloneDX official site

What it does

CycloneDX provides bill-of-materials standards and tooling information describing components, services, dependencies, and related composition details.

When to use it

When exchanging supply-chain documents, consult schemas and capability guides to match the components and relationships that need to be recorded.

OSV

Vulnerability records linked to package versions

  • security
  • dependencies

Research

osv-scanner

Dependency checks against vulnerability data

  • security
  • dependencies

Research