Which GitHub feature provides a software bill of materials (SBOM) for repository dependencies?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The Dependency Graph is GitHub's built-in software inventory. It reads your manifest files (package.json, requirements.txt, pom.xml, etc.) and builds a map of every dependency — essentially your SBOM. It's also the foundation for Dependabot alerts.
Full explanation below image
Full Explanation
GitHub's Dependency Graph feature analyzes repository manifest files and lock files to identify all direct and transitive dependencies. It supports languages including JavaScript (npm, Yarn), Python (pip), Ruby (Bundler), Java (Maven, Gradle), .NET (NuGet), Go, and more. The dependency graph serves as a software bill of materials (SBOM) that can be exported in SPDX format for compliance. It also powers Dependabot alerts (which reference the graph to find vulnerable packages) and Dependency Review (which shows PR changes to dependencies). Code scanning finds code vulnerabilities, not dependency inventories. The GitHub Advisory Database is the vulnerability data source. Dependabot updates dependencies but the Dependency Graph is the inventory foundation.