The Three Pillars of Continuous Analysis

When building and shipping software, engineering and security teams need clear answers to three core questions:

  • What is in our software? (Component and dependency inventory)
  • Is our software legally compliant? (Licence governance with Grant)
  • Is our software safe from vulnerabilities? (Security posture with Grype)

With SitRep 26.10, we are thrilled to introduce native support for CycloneDX Software Bill of Materials (SBOM), bringing all three areas into one unified workflow.

Alongside this release, we are adopting Calendar Versioning (CalVer) using the YY.MM convention. Starting with 26.10 (October 2026), version numbers directly match the year and month of release.

Why Continuous SBOMs Matter

Whether responding to customer security questionnaires or conducting compliance audits, understanding what dependencies are running across your applications shouldn't require manual archaeology through git logs.

SitRep ingests your CycloneDX SBOMs directly from CI/CD. Every build creates a living, searchable record of what was shipped, what versions were bundled, and where components live across your products.

What's New in Version 26.10

Software Inventory

CycloneDX SBOM Support

Ingest standard CycloneDX SBOMs generated by tools like Syft. Track components, package URLs (PURLs), and versions build-by-build.

Intelligent Discovery

Automatic Categorisation

Components are automatically organized across applications, frameworks, libraries, operating systems, and assets for easy navigation.

Workflow & Triage

Instant Overview Filtering

Clickable summary cards on report pages let you quickly filter down to high-severity vulnerabilities or denied licences in one click.

Compliance & Auditing

On-Demand Data Exports

Download full CycloneDX SBOM archives (.tar.gz) or export vulnerability and licence reports to CSV and JSON directly from your dashboard.

Automated CI/CD Pipeline Integration

Integrating SitRep 26.10 into your existing build workflow requires just a few standard commands in your CI pipeline:

Example CI Pipeline (Syft + Grype + Grant + SitRep)
# 1. Generate CycloneDX SBOM with Syft
syft my-app:latest -o cyclonedx-json=sbom.json

# 2. Run Grype vulnerability scan
grype sbom:sbom.json -o json=vuln.json

# 3. Run Grant licence compliance check
grant check sbom.json --config .grant.yaml -o json > licences.json

# 4. Upload reports to SitRep API
curl -X POST "https://app.sit-rep.co.uk/api/v1/reports?tool=sbom&product=$PRODUCT_UUID&revision=$CI_COMMIT_SHA&ref=$CI_REF&author=$CI_USER" \
  -H "Authorization: Bearer $SITREP_PAT" \
  --data-binary @sbom.json

curl -X POST "https://app.sit-rep.co.uk/api/v1/reports?tool=grype&product=$PRODUCT_UUID&revision=$CI_COMMIT_SHA&ref=$CI_REF&author=$CI_USER" \
  -H "Authorization: Bearer $SITREP_PAT" \
  --data-binary @vuln.json

curl -X POST "https://app.sit-rep.co.uk/api/v1/reports?tool=grant&product=$PRODUCT_UUID&revision=$CI_COMMIT_SHA&ref=$CI_REF&author=$CI_USER" \
  -H "Authorization: Bearer $SITREP_PAT" \
  --data-binary @licences.json

Getting Started with 26.10

SitRep 26.10 is live today. To start tracking CycloneDX SBOMs for your products:

  • Open your Products settings in the SitRep dashboard.
  • Ensure SBOM is enabled under your active scanner tools.
  • Add the Syft SBOM generation and upload step to your build pipeline.
Continuous Analysis, Build by Build

Whether preparing for customer security audits, assessing compliance obligations, or triaging vulnerabilities, SitRep provides a clear single source of truth for your software supply chain.

Archive · Release v2.0

Previous: Introducing SitRep v2.0 (August 2026)

SitRep v2.0 established our extensible multi-scanner platform, introducing native support for Grant open source licence compliance, policy evaluation, and historical licence diffing alongside Grype vulnerability management.