An SBOM lists components and versions, not support dates. What CycloneDX and SPDX can carry about end of life, and how to add lifecycle data to an SBOM.
What's covered
- What the two SBOM formats can carry
- Why the gap exists
- How to find end-of-life components in an SBOM
Full guide with every version, risk scores, and live updates: https://endoflife.ai/article-sbom-end-of-life
Top comments (0)