Software Bill of Materials

The SBOM is generated in CycloneDX JSON format, specification version 1.6. It includes all NuGet dependencies with versions, licenses and SHA-512 checksums.

cyclonedx.org

SBOM (Software Bill of Materials)

A structured, machine-readable list of all third-party components included in a software product — similar to an ingredients list. SBOMs are used by security teams and automated tools to identify known vulnerabilities in a product's dependencies.

Target Framework (TFM)

EPPlus is built for multiple .NET versions simultaneously, such as net462 (.NET Framework 4.6.2), netstandard2.0, net8.0, and net9.0. Each of these is called a target framework. Different target frameworks may depend on different NuGet packages or package versions, which is why per-TFM SBOMs can provide more precise dependency information than a combined SBOM.

CycloneDX

An open SBOM standard maintained by the OWASP Foundation, widely supported by security tools and scanners. CycloneDX defines a structured JSON (or XML) format for describing software components and their relationships. EPPlus SBOMs use CycloneDX JSON format, specification version 1.6. cyclonedx.org

SHA-256 Checksum

A cryptographic fingerprint of a file. By comparing the checksum of a downloaded SBOM against the value listed here, you can verify that the file has not been tampered with or corrupted in transit.

CVE (Common Vulnerabilities and Exposures)

A standardized identifier for a publicly known security vulnerability, e.g. CVE-2024-12345. CVE identifiers are assigned by MITRE and referenced in vulnerability databases such as the National Vulnerability Database (NVD). Security scanners use the components listed in an SBOM to check for known CVEs.