Support for SBOM Generation in pnpm

[jjh4450]

Description:
Hi pnpm team,

I'd like to inquire about potential plans for Software Bill of Materials (SBOM) support in pnpm. Many package managers, including npm with its npm sbom command, now provide capabilities to generate SPDX or CycloneDX reports - crucial tools for managing supply chain security, vulnerability assessments, and compliance requirements.

Given the growing significance of SBOM in the software development ecosystem, I'm particularly interested in learning about:

1. Plans for built-in SBOM generation functionality (comparable to npm sbom)
2. Potential integrations with established SBOM tools (e.g., CycloneDX)
3. Any current alternatives or recommended methods for generating SBOMs in pnpm projects

Looking forward to your insights on this topic. Thank you for maintaining such an excellent package manager! 🚀

[0mniteck]

I also would be very interested in SBOMs for pnpm this is an important feature of npm

[jjh4450]

Adding a bit more context and linking this with an existing feature request.

There is already an open feature request for built-in SBOM generation:

• Generate sbom files Generate sbom files #9088

That issue includes:

• A clear user story (SCA / DependencyTrack integration)
• Willingness from the author to implement the feature
• Multiple real-world blockers reported (pnpm list JSON limits, large dependency trees, CI failures)
• Downstream impact on tools like JFrog, Trivy, Syft, etc.

At this point, SBOM generation is no longer a "nice to have":

• Many orgs now require SBOMs for audits and compliance
• npm already provides npm sbom
• pnpm users are forced to rely on external tools, many of which have incomplete or fragile pnpm support

It feels like the missing piece is not demand, but:

• agreement on scope (SPDX vs CycloneDX, prod-only vs full tree)
• guidance from maintainers on the preferred implementation direction

If maintainers or contributors are interested in reviewing or co-owning this effort, #9088 seems like the right place to coordinate implementation.

I'm happy to help with testing or validation from a real CI / SCA pipeline perspective.

[Saturate]

This is being released in an upcoming version :)