The European Union has activated the compliance phase of its Cyber Resilience Act (CRA), making a Software Bill of Materials (SBOM) mandatory for any software sold into critical infrastructure across the bloc.
What an SBOM Must Contain
Each SBOM must list every direct and transitive dependency, its version, its license, and a known-vulnerability feed reference. The standard aligns with SPDX 3.0 and CycloneDX 1.6.
- Direct dependencies: full version + license
- Transitive dependencies: resolved graph to depth 5
- VEX feed: exploitability status, refreshed every 30 days
"Visibility into the supply chain is no longer optional - it is the law," said EU Commissioner Margrethe Vestager.
The Open-Source Dilemma
Thousands of volunteer-maintained libraries form the foundation of European critical software. Maintainers argue that generating and refreshing SBOMs for free is unsustainable. The FSFE is negotiating a stewards carve-out shifting compliance to downstream distributors.
Large distros including Debian and SUSE have already stood up automated SBOM pipelines. The question is whether smaller projects can keep up before the 18-month grace period expires.
Related Articles
Rust Overtakes Go as the Most Wanted Programming Language in 2026
Stack Overflow's annual survey reveals a seismic shift in developer preferences, with Rust's safety guarantees and performance driving adoption across the industry.
GitHub Copilot X Now Writes Entire Codebases Autonomously
The latest version of GitHub's AI coding assistant can scaffold complete projects, implement features from natural language descriptions, and even write its own tests.
The End of Traditional Databases? Vector DBs Are Taking Over
As AI-native applications surge, vector databases are becoming the default choice for a new generation of developers. PostgreSQL and MySQL aren't going anywhere — but the conversation has shifted.
Comments (0)
Log in or sign up to leave a comment.
No comments yet. Be the first to share your thoughts.