rollup-plugin-sbom weekly downloads statistics

rollup-plugin-sbom

Create SBOMs (Software Bill of Materials) in CycloneDX format for your Vite and Rollup projects, including only the software you're really shipping to production.

A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. A SBOM is a nested inventory, a list of ingredients that make up software components.

– CISA (.gov) [full article]

Documentation

• Requirements and compatibility
• Installation
• Usage guide
  • Usage with Vite
  • Usage with Rollup
  • Usage with Rolldown
  • Configuration options and defaults
  • Debugging
  • Sequence chart
• Contributing
  • Contribution workflow
  • Make your first contribution
  • Contributors

---

Requirements and Compatibility

Plugin	Vite	Rollup	Rolldown	Node (latest LTS)	CDX Spec
v1	4, 5	3, 4	-	18, 20	1.5
v2	4, 5, 6	3, 4	-	18, 20, 22	1.6
v3	5, 6, 7, 8	4	1	20, 22, 24	1.6
v4	6, 7, 8	4	1	22, 24, 26	1.7

We're always supporting LTS Node.js versions and versions which still have security support. Plugin support will be dropped once a Node.js version reaches its final EOL.

[!NOTE] We currently support both CommonJS and ESM formats for now. We strongly recommend using the ESM format instead of CommonJS. The ESM format is compatible with modern platforms and runtimes, and most new libraries are now distributed only in ESM format. Learn more at https://nodejs.org/en/learn/modules/publishing-a-package#how-did-we-get-here

Installation

You can install the plugin via NPM with your favorite package manager:

npm install --save-dev rollup-plugin-sbom
pnpm install -D rollup-plugin-sbom
yarn add --dev rollup-plugin-sbom
bun add --dev rollup-plugin-sbom

Usage

Usage with Vite

import { defineConfig } from "vite";
import sbom from "rollup-plugin-sbom";

export default defineConfig({
  plugins: [sbom()],
});

// or

export default defineConfig({
  build: {
    // use rollupOptions for Vite < 8
    rolldownOptions: {
      plugins: [sbom()],
    },
  },
});

Usage with Rollup

import sbom from "rollup-plugin-sbom";

export default {
  plugins: [sbom()],
};

Usage with Rolldown

import { defineConfig } from "rolldown";
import sbom from "rollup-plugin-sbom";

export default defineConfig({
  plugins: [sbom()],
});

Configuration Options

Name	Default	Description
specVersion	1.7	The CycloneDX specification version to use
rootComponentType	application	The root component type, can be library or application
outDir	cyclonedx	The output directory where the BOM file will be saved.
outFilename	bom	The base filename for the SBOM files.
outFormats	['json']	The formats to output. Can be any of json and xml (note: xml requires xmlbuilder2).
saveTimestamp	true	Whether to save the timestamp in the BOM metadata.
autodetect	true	Whether to get the root package registered automatically.
generateSerial	false	Whether to generate a serial number for the BOM.
includeWellKnown	true	Whether to generate a SBOM in the well-known directory.
supplier	-	Provide organizational entity information
beforeCollect	-	Enhance the BOM before before collecting dependencies
afterCollect	-	Transform the BOM before after collecting dependencies

Optional Peer Dependencies

Some features require optional peer dependencies — see package.json for version details.

• Serialization to XML on Node.js requires any of:
  • xmlbuilder2

Debugging…