SBOM scans (nested) dependencies used in open source libraries to detect known vulnerabilities from potentially harmful packages.
To enable recursive check: Workflow > Workflow name > SBOM > Enable dependency check for source code.
Example scan result
Supported ecosystems: Python (PyPI), Node.js (npm, including TypeScript and CoffeeScript projects), Java and other Maven/Gradle languages, .NET (NuGet), Ruby, PHP. Dependency data is not available for C/C++, Go, Rust, Dart, Elixir, Swift, Julia or R.
Dependency depth: 1. The engine lists the direct dependencies of each detected package. It does not follow them further.
Note: dependency check applies to source code only. For container images, the engine reports the operating-system packages installed in the image, not application packages.