Software Bill of Materials
EPPlus Software provides a Software Bill of Materials (SBOM) for each EPPlus release from version 7.3 and up. The SBOM lists all third-party dependencies included in EPPlus, along with their versions, licenses and checksums.
All SBOMs are provided in CycloneDX JSON format (specification version 1.6), with SHA-256 checksums for verification. Where available, expand a row to download the SBOM for a specific target framework.
No SBOM files are currently available.
API access & format information
Each SBOM can be accessed directly via a URL. This is useful for automated tools and pipelines that consume SBOM data.
Index of all versions
A machine-readable JSON index of all available SBOM files, including version, release date, download URL and SHA-256 checksum.
https://epplussoftware.com/security/sbom/all.jsonSpecific version
Returns a combined SBOM containing dependencies across all target frameworks for the specified version.
https://epplussoftware.com/security/sbom/{version}.jsonSpecific version and target framework
Each SBOM is also available per target framework, for use with tools that need framework-specific dependency data.
https://epplussoftware.com/security/sbom/{version}/{tfm}.jsonLatest published version
https://epplussoftware.com/security/sbom/latest.jsonThe SBOM is generated in CycloneDX JSON format, specification version 1.6. It includes all NuGet dependencies with versions, licenses and SHA-512 checksums.
- SBOM (Software Bill of Materials)
- A structured, machine-readable list of all third-party components included in a software product — similar to an ingredients list. SBOMs are used by security teams and automated tools to identify known vulnerabilities in a product's dependencies.
- Target Framework (TFM)
- EPPlus is built for multiple .NET versions simultaneously, such as net462 (.NET Framework 4.6.2), netstandard2.0, net8.0, and net9.0. Each of these is called a target framework. Different target frameworks may depend on different NuGet packages or package versions, which is why per-TFM SBOMs can provide more precise dependency information than a combined SBOM.
- CycloneDX
- An open SBOM standard maintained by the OWASP Foundation, widely supported by security tools and scanners. CycloneDX defines a structured JSON (or XML) format for describing software components and their relationships. EPPlus SBOMs use CycloneDX JSON format, specification version 1.6. cyclonedx.org
- SHA-256 Checksum
- A cryptographic fingerprint of a file. By comparing the checksum of a downloaded SBOM against the value listed here, you can verify that the file has not been tampered with or corrupted in transit.
- CVE (Common Vulnerabilities and Exposures)
- A standardized identifier for a publicly known security vulnerability, e.g. CVE-2024-12345. CVE identifiers are assigned by MITRE and referenced in vulnerability databases such as the National Vulnerability Database (NVD). Security scanners use the components listed in an SBOM to check for known CVEs.