Registry / devops / rollup-plugin-sbom

rollup-plugin-sbom

library3.1.0jsnpmunverified

Rollup and Vite plugin to generate Software Bill of Materials (SBOM) for your application. Current stable version is 3.1.0, released March 2026. Supports CycloneDX and SPDX formats. Key differentiators: native Vite support, virtual module filtering, and configuration via rollup or vite config. Active development with next versions adding rolldown support. Requires Node >=20.19.0.

devops serialization data

npm install rollup-plugin-sbom

github ↗package ↗

INSTALL

IMPORT

SIG · ROLLUP-PLUGIN-SBOM

rollup-plugin-sbom

devopsjavascriptv3.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

rollupPluginSbom

✓ import { rollupPluginSbom } from 'rollup-plugin-sbom'

✗ const rollupPluginSbom = require('rollup-plugin-sbom')

ESM-only package; CommonJS require not supported.

default export

✓ import rollupPluginSbom from 'rollup-plugin-sbom'

✗ import { default as rollupPluginSbom } from 'rollup-plugin-sbom'

Named export also works; default export is the same function.

vitePluginSbom

✓ import { vitePluginSbom } from 'rollup-plugin-sbom'

✗ import { vitePluginSbom } from 'rollup-plugin-sbom/vite'

Exported from main entry; no separate subpath.

Configures rollup-plugin-sbom in a Vite project to generate CycloneDX JSON and SPDX JSON SBOMs.

import { rollupPluginSbom } from 'rollup-plugin-sbom'; import { defineConfig } from 'vite'; export default defineConfig({ plugins: [ rollupPluginSbom({ format: ['cyclonedx-json', 'spdx-json'], outputDir: './sbom', encoding: 'utf-8', includeDev: false, globals: { componentName: 'my-app', componentVersion: '1.0.0', supplier: 'Example Corp' } }) ] });

Debug

Known issues

breakingRequires Node.js >=20.19.0

fix

Update to Node.js 20.19.0 or higher.

affects: >=3.0.0

breakingESM-only; no CommonJS support

fix

Use import syntax instead of require().

affects: >=3.0.0

gotchaVirtual modules not following vite/rollup conventions are filtered out

fix

Ensure custom virtual modules follow naming conventions.

affects: >=3.0.5

gotchaDependency information can be missing; plugin logs module info for debugging

fix

Enable verbose logging to see which modules are missing info.

affects: >=3.0.5

deprecatedOlder options like 'sbomFormat' and 'sbomOutput' removed in v3

fix

Use 'format' and 'outputDir' options.

affects: >=3.0.0

Errors

Common errors & fixes

ERR_REQUIRE_ESM: require() of ES Module not supported

Using CommonJS require() on an ESM-only package.

fix

Use import syntax or dynamic import().

Error: The SBOM plugin requires Node.js version >=20.19.0. Current version: <...>

Node version too low.

fix

Upgrade Node to 20.19.0 or later.

TypeError: rollupPluginSbom is not a function

Incorrect import (maybe default vs named) or using old version without named export.

fix

Ensure import { rollupPluginSbom } from 'rollup-plugin-sbom'.

Upgrade

Version history

3.1.0latest on npm

Audit

Dependencies

viteoptionalPeer dependency for Vite integration

rollupoptionalPeer dependency for Rollup integration

xmlbuilder2requiredUsed for XML SBOM output format

Agent activity

12 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/janbiasi/rollup-plugin-sbom ↗

packagehttps://www.npmjs.com/package/rollup-plugin-sbom ↗