Your parts list, in machine-readable form.
Your project drags along a few hundred third-party packages. An SBOM is the parts list for all of them — and from 11 December 2027 the Cyber Resilience Act requires it in machine-readable form.
Drop in a dependency management file — package-lock.json, composer.lock, go.mod or one of a total of 24 from 12 ecosystems — and get back a valid CycloneDX or SPDX document covering your entire declared dependency tree.
Files are parsed in memory, the result is returned, the input is discarded. Dependency management files expose package names and versions — never source code.
You can download it right here — no email address required.
12 ecosystems, 24 dependency management files
If your build produces one of these, it produces an SBOM here. Mixed-language repos: drop every dependency management file at once.
Node.js
package-lock.json
yarn.lock
pnpm-lock.yaml
bun.lock
Python
requirements.txt
poetry.lock
Pipfile.lock
uv.lock
Java / JVM
pom.xml
*gradle.lockfile
*.sbt.lock
.NET
packages.lock.json
packages.config
.deps.json
Directory.Packages.props
PHP
composer.lock
Go
go.mod
Rust
Cargo.lock
Ruby
Gemfile.lock
Swift / iOS
Package.resolved
Podfile.lock
Dart / Flutter
pubspec.lock
Elixir
mix.lock
C / C++
conan.lock
The SBOM is an essential part of the CRA. But only the beginning.
Regulation (EU) 2024/2847 arrives in stages. A generated SBOM is a one-off artefact; the obligations behind it are continuous.
CRA compliance with cralityIn force
Three-year transition period begins.
Reporting obligations apply
Actively exploited vulnerabilities and severe incidents must be reported to ENISA and the national CSIRT — within 24 hours.
Full compliance required
Products with digital elements placed on the EU market must meet every requirement — SBOM in machine-readable form included.
Frequently Asked Questions
Here you will find answers to the most important questions.
Do you keep my dependency management file?
No. It is parsed in memory, the SBOM is returned, the buffer is dropped. Nothing is written to disk, nothing is logged beyond a request count.
Is the output CRA-acceptable?
The document is schema-valid CycloneDX 1.6 or SPDX 2.3 with names, versions, licences and purls. The CRA asks for the format; keeping it current over the product lifetime is the part a generator can't do for you.
Declared tree or resolved tree?
Declared — we read what your dependency management file states, we don't install anything. Deterministic, reproducible, and it never runs your build scripts.
What does a crality account offer me?
With crality, you can also add SBOM entries manually, run scans automatically, and generally keep track of vulnerabilities at all times.
One SBOM is a file. Compliance is a process.
A free crality account keeps SBOMs per product and version, watches them against new CVEs, and prepares the artefacts you'll need to meet the reporting obligations. Same price as this page: free.