Introducing Avrea SBOM

Avrea now builds a software bill of materials (SBOM) for every repository you connect. Avrea clones the default branch, resolves the dependency tree, and resolves the license each package ships under. The summary lands on the repository's SBOM tab, and the full documents are one download away.

An enterprise company sends you a security questionnaire and wants a dependency inventory before procurement will move. Customer's legal team asks which copyleft licenses are in the build, and an auditor asks what was in the release you shipped in March.

Whoever picks it up runs a tool on a laptop, patches the gaps by hand, and sends a spreadsheet nobody can tie back to a commit. Three months on, the question comes back and the work starts over. Procurement waits on it both times.

We built it for our own repository first. The same tool generates Avrea's dependency inventory and license summary, committed alongside our code, and the question it answers turned out to be one every team eventually gets asked.

The Cyber Resilience Act makes it a standing requirement

The EU Cyber Resilience Act (CRA) turns that occasional request into a permanent one. Products with digital elements placed on the EU market carry a software bill of materials, in a commonly used machine-readable format, as part of their technical documentation. A market surveillance authority can request it, and you have to produce it.

The catch is that one needs a record per release, stored for years after the version ships, tied to the code it describes.

Two dates that matter. From 11 September 2026, actively exploited vulnerabilities and severe incidents have to be reported. From 11 December 2027 the regulation applies in full, the software bill of materials included.

The reporting duty lands first, and an inventory is what makes it answerable. Deciding whether an actively exploited vulnerability reaches you starts with knowing what you ship.

Deadlines aside, the inventory earns its keep. A vulnerability scanner is only as good as what you feed it. An up-to-date dependency list turns "were we exposed to this?" from an afternoon of investigation into a query. It answers the question your security team, your customers and your own engineers keep asking. That is what is actually inside the thing you ship.

Avrea pins every run to the commit it analysed. Generate an SBOM at a release and the document you archive matches exactly the code it covers.

What you get

• CycloneDX and SPDX, the two formats compliance tooling already consumes
• Production dependencies only, matching what you actually ship
• Every copyleft dependency named, not just counted
• Per-commit history on the SBOM tab, with a full dependency drill-down

How it works

Avrea resolves your dependency tree across Python, Go, npm, Rust, Ruby, PHP, Maven and NuGet, plus container base images and vendored source. Each package then resolves to the license it actually ships under, read from the package where it carries one and from the ecosystem registry where it does not.

If a license cannot be resolved, the report says so instead of guessing. One can filter those packages straight out, so the gaps are a short list you can work through rather than a silence you have to notice.

The SBOMs cover production dependencies. Your test runners, linters and build tooling stay out of the document, because they are not what customers or auditors are interested in.

Reports are built to diff cleanly. Wall-clock timestamps and per-run identifiers are stripped out. So a diff between two runs shows what moved in your dependencies, not noise from the run itself.

Generating an SBOM is its own job. Dependency trees move, so press Generate SBOM whenever you need a current one.

Getting started

SBOM generation is live in preview. Install the Avrea GitHub App at console.avrea.com, and Avrea analyses the default branch of every repository you connect. Open a repository's SBOM tab for the first summary.

The next time someone asks what's in your software, whether that's a prospect's security team or a market surveillance authority, the answer is already sitting on the commit it describes. Grab it, attach it, get back to work.