The SBOM is made up of third-party open-source libraries, vendor-provided packages, and first-party artifacts built by the organization. What is an SBOM?Ī software bill of materials, often abbreviated as SBOM, is a list of all software components used in an application.

The answer is a software bill of materials. More importantly, how can they check if the dependencies are not vulnerable to security issues? How do they know what dependencies are included? In the article Best practices for managing Java dependencies, I discussed the options and tools available for setting up a dependency management strategy.īut what if you deliver your Java application to a customer? Recently, we discussed why and how we should maintain our dependencies carefully. This means that the amount of Java packages included in your application is often not really transparent.Īs a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using. And each Java package that is imported likely also depends on more libraries. When building applications in Java, we highly depend on external libraries and frameworks. Co-leading the Virtual JUG, NLJUG and DevSecCon community. Passionate about Java, (Pure) Functional Programming, and Cybersecurity. Java Champions & Developer Advocate and Software Engineer for Snyk.

Remind slack example