Data Model for SBOM release notes

  • Release version: Store
  • Updated June 11, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Data Model for SBOM Release Notes

    The Data Model for SBOM application on the ServiceNow Store provides structured tables, roles, and security configurations to manage Software Bill of Materials (SBOM) data. It supports uploading, parsing, and ingesting SBOM information, enabling organizations to track software components, dependencies, licenses, and vulnerabilities effectively within the ServiceNow platform.

    Show full answer Show less

    Key Features and Enhancements by Version

    • Version 4.2.4 (June 2026): Updated SBOM Data Model tables to comply with ServiceNow Platform Security guidance, introduced read-only dictionary fields, and renamed fix scripts to avoid update conflicts with Security Operations plugins.
    • Version 4.2.2 (April 2026): Added a "Timeout" status for BOM documents to track processing delays; introduced tracking fields for processing start time and duration to monitor BOM workflows more effectively.
    • Version 4.2.1 (December 2025): Fixed Activity tab issues for SBOM License records and improved dependency navigation by enabling “Depends on” related lists and removing duplicate filters.
    • Version 4.1.1 (August 2025): Improved query performance with new indexes on contact info, build-component relationships, dependencies, and hashes; enhanced component table to store unprocessed JSON data and SHA-256 hashes for asynchronous processing and integrity.
    • Version 4.0.0 (February 2025): Added support for bulk deletion of BOM entity records and related components directly from the Software Bill of Materials Workspace.
    • Prior Releases (2023-2024): Introduced foundational features including support for license administration, DevOps use cases with unique SBOMs per build, PURL validation, enhanced ACLs and roles for security, and the initial release with essential tables and roles for SBOM data management.

    Practical Benefits for ServiceNow Customers

    • Improved security compliance through updated data models aligned with platform security best practices.
    • Enhanced tracking and visibility into BOM processing with new status options and timing metrics, enabling better operational insights.
    • Performance optimizations via indexing to speed up queries related to components, dependencies, and contact data.
    • Greater flexibility in managing SBOM data, including bulk deletion and asynchronous processing capabilities.
    • Robust role and access control configurations safeguard SBOM data integrity and privacy.
    • Support for evolving software development workflows and license management needs within the ServiceNow ecosystem.

    What to Expect

    By leveraging this application and its evolving data model, ServiceNow customers can efficiently manage SBOM data for vulnerability response and software risk management. The release notes highlight continuous improvements that enhance security, performance, and usability to meet enterprise requirements in software supply chain transparency and compliance.

    Version history for the Vulnerability Response Data Model for SBOM application on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 4.2.4 - June 2026
    • The following enhancements and changes support internal security directives:
      • Updates for the SBOM Data Model tables to align with ServiceNow Platform Security guidance.
      • Read-only dictionary fields for SBOM Data Model tables.
      • Renamed fix script to a per-plugin name to avoid update-set conflicts with sibling Security Operations plugins.
    Version 4.2.2 - April 2026
    • New:
      • Added "Timeout" status option to the BOM document status field to help you better track BOMs that exceed their processing time limits.
      • Introduced new tracking fields on BOM document records, including processing_started(timestamp when processing begins) and processing_duration(total time spent in processing), enabling you to better monitor and analyze BOM processing workflows.
    Version 4.2.1 - December 2025
    • Fixed:
      • Fixed an issue where the Activity tab in SBOM License records failed to persist historical state changes.
      • Enabled the “Depends on” related list for intermediate SBOM entities and removed duplicate active filters for accurate dependency navigation.
    Version 4.1.1 - August 2025
    New:Added new indexes to improve query performance on key tables: unique indexes for contact information (phone/email/name), build-component relationships, component dependencies, external references, and component hashes. Enhanced the sn_sbom_component table with two new fields: unprocessed_sbom_data to store non-critical attributes as JSON for asynchronous processing, and hash_sha256 for direct storage of the component's SHA-256 hash value.
    Version 4.0.0 - February 2025
    Improvements to support deleting BOM entity records and their related components from the Software Bill of Materials Workspace with bulk edit.
    Version 3.0.5 - December 2024
    Fixed: Minor fix for this release.
    Version 3.0.4 - November 2024
    New: Data model improvements to support the License administration module.
    Version 2.0.2 - August 2024
    New: Table improvements to support new features in SBOM Response and SBOM Core.
    Version 1.4.3 - May 2024
    New: Data model and framework enhancements to support DevOps use cases that require unique SBOMs for the multiple builds of a BOM Entity.
    Version 1.3.1 - February 2024
    Updated data model to support PURL validation and author of the BOM document.
    Version 1.1.2 - November 2023
    • Changed:
      • Added Report View ACL to the [sn_sbom_m2m_bom_comptable] table.
      • Added New Roles and ACL to the [sn_sbom_doc] table.
    Version 1.0.4 - September 2023
    New: Display name is a new field on the BOM Component table. The Display name field uses the name and version as the displayed value of a component.
    Version 1.0.3 - August 2023
    Initial release: This application includes the tables, ACLs, and roles that are required to upload, parse, and ingest SBOM data.