standard
CycloneDX is an open standard for software bill of materials (SBOM), listing a project's components, dependencies, and known risks for supply-chain security.
No evidence-backed relationships are recorded.
Syft and Trivy reported 43.78% and 32.71% of lockfile packages across 2,050 JavaScript repositories in an Inria and ANSSI study, against 98.72% for cdxgen. The tool, its version and its flags decide what an SBOM lists, so that recipe belongs under version control.
Reality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
k8s-secure-supply-chain, a kind-based reference build, uses five Kyverno checks to refuse at admission any image that CI did not sign and attest. Its author argues that CI scans and signatures stay advisory until the cluster enforces them.
Reality
AgentWarden scans Markdown skills and MCP configs, exits non-zero on a rule match, and records a SHA-256 in skills.lock. It is also the project whose post documents the missing lockfile.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
Swift Build became the default in Swift Package Manager with the September 15 release, so the engine under every package changed even for teams adopting none of 6.4's interop work. Everything else in the release waits for a source edit.
Reality
"Use .h5 or .keras instead of pickle" is not a mitigation. Scanning pipelines built on the pickle-only model of executable artifacts have a hole in them.
Reality