Software composition analysis

- SBOM generation (CycloneDX, SPDX) and verification - Direct and transitive dependencies (npm, pip, Maven, Go modules) - Vulnerability scanning (Snyk, Grype, OSV, Dependabot) - License compliance and policy - Outdated and unmaintained packages