CycloneDX Generator (cdxgen) 13.5.0

What's new in 13.5.0

cdxgen 13.5.0
cdxgen 13.5.0 turns the hardware BOM toward Windows, puts PHP runtimes on the record, and reworks how certificates in a CBOM are identified, linked and judged. Go projects get service and module evidence that finally matches what the Go toolchain does, OS scans draw on osquery 5.24.0 with new package tables for pacman, snap, flatpak and MacPorts, and several ways a scan could run the scanned project's own code are now closed. The bundled plugins move to 4.2.0, and the container images ride the October 2026 Node.js security releases.
Hardware BOMs on Windows
The hbom command now inventories Windows machines. It reads the platform facts, host, CPU, memory, board, firmware and chassis, along with storage and network adapters, display adapters, monitors, audio devices and cameras, PnP devices with USB and PCI topology and driver signing state, and the machine's trust, power and privileged state. Everything is collected over CIM and PowerShell with serials, instance GUIDs and hardware identifiers redacted, and where PowerShell is missing or locked down by constrained language mode, a fallback that avoids the registry keeps the core inventory working. On the cdxgen side, the compliance and performance rules understand Windows, the secure-mode preflight plans the right Windows commands, volumes are joined to osquery logical drives in merged host views, and the permission-denied finding now says which elevation is actually missing. Real captures from Windows hardware back the test suite, and the Windows troubleshooting guide documents the permissions each collector needs, with a matrix measured on real sessions down to what a standard user loses when smphost is not running.
PHP runtimes, finally on the record
PHP was the one runtime a BOM never named. Scans now probe php and composer alongside the other toolchains and record both in the formulation as platform components with their CPEs. The PHP_CMD and COMPOSER_CMD environment variables select the binaries, the same as the other probes. OS scans go further and look for PHP that no package manager installed, in the usual source-build locations such as /usr/local, the Apache module directories and Homebrew, skipping every file a package database owns, and container scans read the build version out of unpackaged PHP binaries. Composer lock files contribute their platform requirements, the PHP version and the extensions they name, kept as cdx:composer properties. …

Full release notes »