CycloneDX/cyclonedx-gomod

View on GitHub

Creates CycloneDX Software Bill of Materials (SBOM) from Go modules

Stars: 187
Forks: 40
Open beginner issues: 0
Indexed issues: 33
Avg merge: 1d 7h
Merged PRs (30d): 14

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 7, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Open All

33 open issues indexed

Optionally infer external references from CI environment Open

enhancement

CycloneDX/cyclonedx-gomod#6 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Use `go list` instead of `go mod graph` to build dependency graph Open

enhancement

CycloneDX/cyclonedx-gomod#64 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`bin`: Support macOS universal binaries Open

enhancement go:1.18

CycloneDX/cyclonedx-gomod#120 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Capture compiler information Open

enhancement

CycloneDX/cyclonedx-gomod#128 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Capture file licenses Open

enhancement

CycloneDX/cyclonedx-gomod#129 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Capture vendored modules in stdlib Open

enhancement

CycloneDX/cyclonedx-gomod#132 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
mod failed due to calculating has of non go file Open

bug triage:needs-reproducer

CycloneDX/cyclonedx-gomod#201 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Using the gh-gomod-generate-sbom action, fails when execution the "Cheap trick" gocmd.ModWhy call Open

bug triage:needs-reproducer

CycloneDX/cyclonedx-gomod#230 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support optional name input Open

enhancement

CycloneDX/cyclonedx-gomod#328 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
I just want to plug in SBOM for my project, use cyclonedx-gomd command why download cyclonedx-go first, how to solve this problem Open

CycloneDX/cyclonedx-gomod#386 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
No Author information in SBOM Open

enhancement

CycloneDX/cyclonedx-gomod#388 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Add license text and copyright to SBOM Open

CycloneDX/cyclonedx-gomod#392 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Last repository tag picked over first reachable when determining version Open

CycloneDX/cyclonedx-gomod#419 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Failed to load stdlib module when executing cyclonedx-gomod Open

CycloneDX/cyclonedx-gomod#423 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Module cloned with --shared fails version retrieval Open

CycloneDX/cyclonedx-gomod#436 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Display errors from go command Open

enhancement

CycloneDX/cyclonedx-gomod#476 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Indirect dependencies not added BOM file while generation BOM using Cyclonedx Open

question

CycloneDX/cyclonedx-gomod#485 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
update created tools section to v1.6 Open

enhancement good first issue

CycloneDX/cyclonedx-gomod#528 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
stop creating an MD5 hash Open

CycloneDX/cyclonedx-gomod#529 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Disable HTML escaping when output in JSON Open

enhancement

CycloneDX/cyclonedx-gomod#555 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
GoReleaser issues (SBOM) Open

CycloneDX/cyclonedx-gomod#586 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Different naming of Golang standard library between trivy and cyclonedx-gomod Open

CycloneDX/cyclonedx-gomod#587 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Incorrect License Names in cyclonedx-gomod mod -licenses Open

question

CycloneDX/cyclonedx-gomod#611 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
cmd/cert_manager and otel: Failed to load package: main module does not contain package Open

CycloneDX/cyclonedx-gomod#618 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The upstream go-scanner that we're based on top of, cyclonedx-gomod, is currently (in its v1.9.0) bundling GoLang v1.23.4. Open

CycloneDX/cyclonedx-gomod#619 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
VCS references have non-existing URLs Open

bug

CycloneDX/cyclonedx-gomod#630 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Unable to Detect License for Go Stdlib with `-std` Open

CycloneDX/cyclonedx-gomod#639 · 0 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
failed to determine version of main module: git: unsupported object type Open

CycloneDX/cyclonedx-gomod#640 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add licenses from internal libraries on private repositories like gitlab Open

CycloneDX/cyclonedx-gomod#645 · 2 comments · 5 reactions · 0 assignees · Indexed Sep 15, 2026
The GOOS and GOARCH PURL qualifiers should not be included in mod SBOM Open

CycloneDX/cyclonedx-gomod#662 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
SBOM- ERR error="failed to load package: no Go files in /builds/platform/<project_repo>" Open

CycloneDX/cyclonedx-gomod#702 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
cyclonedx-gomod creates circular dependency when package depends on older version of itself Open

CycloneDX/cyclonedx-gomod#720 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Panic when running `cyclonedx-gomod mod` on a project with no source files. Open

CycloneDX/cyclonedx-gomod#734 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026

CycloneDX/cyclonedx-gomod

Get new issues in your inbox