winget install --id CycloneDX.cdxgenAbout CycloneDX Generator (cdxgen)
Generate Software Bill of Materials (SBOM) for most applications and container images with a single command. Generate Operations Bill of Materials (OBOM) for Linux and Windows hosts. Integrate with any CI/CD pipeline. Automatically submit the generated BOM to your dependency track server for analysis.
What's new in 12.8.3
What's Changed JavaScript / TypeScript / Node.js - pnpm cjs alias by @prabhu in #4306 Java / Kotlin / Scala / Clojure - sbt tree parsing was buggy by @prabhu in #4307 C# / .NET - Dotnet CPM support by @prabhu in #4305 Ruby - [ruby] rubygems parsing improvements by @prabhu in #4295 AI-BOM / Machine Learning / MCP - custom license spec compat by @prabhu in #4297 Full Changelog: v12.8.2...v12.8.3
Version history
| Version | Updated | Notes |
|---|---|---|
| 12.8.3 | What's Changed JavaScript / TypeScript / Node.js - pnpm cjs alias by @prabhu in #4306 Java / Kotlin / Scala / Clojure - sbt tree parsing was buggy by @prabhu in #4307 C# / .NET - Dotnet CPM support by @prabhu in #4305 Ru... | |
| 12.8.2 | Unknown | What's Changed - use semantics slices for persisting rusi, golem, and dosai reports by @prabhu in #4293 Full Changelog: v12.8.1...v12.8.2 |
| 12.8.1 | Unknown | What's Changed Java / Kotlin / Scala / Clojure - fix(sbt): memoize jar distribution lookups and discover projects via sbt to fix hang (#4291) by @prabhu in #4292 C# / .NET - fix: decompress gzip/deflate/br responses in u... |
| 12.8.0 | Unknown | What's Changed JavaScript / TypeScript / Node.js 🚀 - better bun support by @prabhu in #4247 - Upgrade to typescript 7 by @prabhu in #4246 - deno support by @prabhu in #4250 Docker / Containers / Infrastructure 🐳 - fix(os... |
| 12.7.1 | Unknown | What's Changed JavaScript / TypeScript / Node.js 🚀 - fix yarn alias parsing and add tests by @AvKat by @prabhu in #4230 - pnpm workspace + pdm file components by @prabhu in #4235 Python 🐍 - Include more python build pack... |
| 12.7.0 | Unknown | What's Changed Go - [go] Fix crash on empty go.mod file by @malice00 in #4179 Java / Kotlin / Scala / Clojure - [gradle] Fix incorrect SBOM with unresolved dependencies by @malice00 in #4173 - Strip scala version suffix... |
| 12.6.0 | Unknown | This minor release includes two new features: - Support for dynamic/trace BOM generation using instrumentation. Powered by safer-exec. - New tui mode powered by cdxui. Please try with the --tui argument. What's Changed J... |
| 12.5.1 | Unknown | cdxgen now supports generating AI/ML-BOM with the new -t ai type. For JavaScript and Python projects, AI-BOM would also include the exact occurrence evidence. evinse is now supported for Rust projects. Pass --profile res... |
| 12.5.0 | Unknown | Highlights This release introduces go evinse with golem integration for deep, data-flow-aware analysis of go projects. The JavaScript analyzer gains type-only import detection, better Vue.js scope resolution, and new npm... |
| 12.4.4 | Unknown | What's Changed - java maven improvements #4064 - component type filter #4063 - javascript improvements #4066 - pass exclude arguments to atom #4069 Full Changelog: v12.4.3...v12.4.4 |
| 12.4.3 | Unknown | This release includes one security fix. - [Security] harden maven shell metacharacters in #4059. Thanks, @aleff-github Full Changelog: v12.4.2...v12.4.3 |
| 12.4.2 | Unknown | What's Changed 🤖 AI-auto Changes - Handle object-form GitHub Actions runs-on by @Copilot in #4057 - Upgrade to dosai v3 by @prabhu in #4058 Full Changelog: v12.4.1...v12.4.2 |
| 12.4.1 | Unknown | Optimise SEA binaries. What's Changed 🤖 AI-auto Changes - fix: profile standalone binary dependencies by @prabhu in #4053 Full Changelog: v12.4.0...v12.4.1 |
| 12.4.0 | Unknown | What's Changed 🤖 AI-auto Changes - Enhance dry-run mode with symlink, spawn I/O, and archive extraction tracing by @Copilot in #3969 - package visibility, cbom and obom improvements by @prabhu in #4002 - feat: caxa v3 ba... |
| 12.3.3 | Unknown | This release includes security fixes and some features. What's Changed 🤖 AI-auto Changes - Trim non-runtime files from published npm artifacts, image context, and SEA bundles by @Copilot in #3957 - Add collider.lock supp... |
| 12.3.2 | Unknown | What's Changed 🤖 AI-auto Changes - Enforce CycloneDX 1.7 TLP validation for sensitive BOM properties by @Copilot in #3954 Full Changelog: v12.3.1...v12.3.2 |
| 12.3.1 | Unknown | cdxgen can now identify the MCP configurations and skills used in your project. It can also predict supply-chain attacks against your cargo dependencies. What's Changed 🤖 AI-auto Changes - Expand Cargo predictive audit c... |
| 12.3.0 | Unknown | cdxgen v12.3.0 Full changelog: v12.2.1...v12.3.0 v12.3.0 is a big release for cdxgen. It expands the project beyond BOM generation with new capabilities for upstream dependency risk prioritisation, SPDX conversion/export... |
| 12.2.1 | Unknown | This release focuses on Node.js dependency accuracy, server-side submission hardening, and CI/build maintenance. lang:node #3920 added WASM and WASI detection in the JS analyzer with test coverage updates. #3924 fixed np... |
| 12.2.0 | Unknown | > The beginning of the cycle where the AI agents write more code than humans. cdxgen continues to lose weight. We have removed more dependencies such as sqlite3 and jws by rewriting code to make use of native Node module... |