<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="https://devzone.nordicsemi.com/cfs-file/__key/system/syndication/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/f/nordic-q-a/128052/dependencies-and-vulnerability</link><description>Goal: Create SBOM with correct version numbers, CPE search strings, PURLs, and licenses. Use that to scan and assess vulnerabilities. Platform: NRF Connect SDK 2.9.1 or newer. Problem: No simple solution appears to exists: No meaning full public list</description><dc:language>en-US</dc:language><generator>Telligent Community 13</generator><lastBuildDate>Thu, 03 Sep 2026 13:19:25 GMT</lastBuildDate><atom:link rel="self" type="application/rss+xml" href="https://devzone.nordicsemi.com/f/nordic-q-a/128052/dependencies-and-vulnerability" /><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/570894?ContentTypeID=1</link><pubDate>Thu, 03 Sep 2026 13:19:25 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:d0416af0-beac-4367-8da6-2d48faa87db3</guid><dc:creator>&amp;#216;yvind</dc:creator><description>&lt;p&gt;Hello and my sincere apologies for the late reply.&amp;nbsp; Have you been able to solve this?&lt;br /&gt;&lt;br /&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;Here is a potential work-around from our team:&lt;br /&gt;west ncs-sbom should work without scancode as well. Scancode is one of the detectors used by sbom tool.&lt;/p&gt;
&lt;p&gt;maybe you can try the suggested workaround for mac: &lt;a title="https://scancode-toolkit.readthedocs.io/en/stable/getting-started/installation/install-scancode-from-release-archives.html#install-scancode-on-mac" href="https://scancode-toolkit.readthedocs.io/en/stable/getting-started/installation/install-scancode-from-release-archives.html#install-scancode-on-mac" rel="noopener noreferrer" target="_blank"&gt;https://scancode-toolkit.readthedocs.io/en/stable/getting-started/installation/install-scancode-fro…&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;Install ScanCode from releases archives — ScanCode-Toolkit documentation&lt;/p&gt;
&lt;p&gt;&lt;span&gt;&amp;nbsp;Kind regards,&lt;br /&gt;Øyvind&lt;/span&gt;&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566134?ContentTypeID=1</link><pubDate>Fri, 08 May 2026 15:26:54 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:e3f74a6e-3ea1-4263-941b-e159b1b45861</guid><dc:creator>BobBobing</dc:creator><description>&lt;p&gt;The firmware is compiled on a MAC. ie west ncs-sbom is called on the MAC build machine.&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566133?ContentTypeID=1</link><pubDate>Fri, 08 May 2026 15:21:07 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:84448cf4-0c2d-434d-8dac-50012f2c2c5b</guid><dc:creator>&amp;#216;yvind</dc:creator><description>&lt;p&gt;Could you please clarify what OS you are running?&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566129?ContentTypeID=1</link><pubDate>Fri, 08 May 2026 14:05:17 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:0a703b06-8894-4162-9d5b-172de87cdd92</guid><dc:creator>BobBobing</dc:creator><description>&lt;p&gt;thank you&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566073?ContentTypeID=1</link><pubDate>Fri, 08 May 2026 06:50:04 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:82a16d42-2fe7-499c-9d39-436bd42f459f</guid><dc:creator>&amp;#216;yvind</dc:creator><description>&lt;p&gt;Thanks for clarifying. I will reach out to our team working on this solution to get their feedback on this. I hope to have an answer by end of Wednesday due to the teams workload.&lt;/p&gt;
&lt;p&gt;Kind regards,&lt;br /&gt;Øyvind&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566059?ContentTypeID=1</link><pubDate>Thu, 07 May 2026 18:23:30 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:09b2e43c-b176-4080-8908-263b9f06c273</guid><dc:creator>BobBobing</dc:creator><description>&lt;p&gt;Yes - I was referring to the ncs-sbom.&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item><item><title>RE: Dependencies and Vulnerability</title><link>https://devzone.nordicsemi.com/thread/566042?ContentTypeID=1</link><pubDate>Thu, 07 May 2026 12:38:50 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:e23d0a3a-bc8c-4c4a-9655-9b29208d6dee</guid><dc:creator>&amp;#216;yvind</dc:creator><description>&lt;p&gt;Hello,&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Just to verify:&lt;/p&gt;
[quote user=""]User Zyphers or Nordics SBOM to find the licenses.[/quote]
&lt;p&gt;Are you referring to the&amp;nbsp;&lt;a href="https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/scripts/west_commands/sbom/README.html"&gt;Nordic Software Bill of Materials (west ncs-sbom)&lt;/a&gt;?&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Kind regards,&lt;br /&gt;Øyvind&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item></channel></rss>