Software Bill of Materials (SBOM)
permalink: customerhostedsbom
Introduction
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all third-party and open-source components used in building the ProcessFactorial platform. It provides transparency into the software supply chain, enabling customers to:
- Track known vulnerabilities (CVEs) affecting their deployed components
- Ensure compliance with organisational licensing and security policies
- Plan patching and upgrade cycles with full visibility of dependencies
- Meet regulatory and audit requirements (e.g., Executive Order 14028, NTIA minimum elements)
This article covers the external libraries only — the .NET NuGet packages, npm packages, and their runtime dependencies that ship as part of a Customer Hosted Model deployment.
What is NOT included
The platform's own source code, ProcessFactorial-internal libraries, and Azure infrastructure components (e.g., Azure Functions runtime, APIM, Storage Accounts) are excluded from this SBOM. These are Microsoft-managed components with their own SBOMs available via the Microsoft Security Response Center.
Minimum SBOM Elements
Per NTIA (National Telecommunications and Information Administration) guidelines, every SBOM entry includes:
| Element | Description |
|---|---|
| Supplier Name | The entity that created the component (e.g., NuGet publisher, npm author) |
| Component Name | The identifier of the component |
| Version String | The specific version used |
| Dependency Relationship | Whether the dependency is direct or transitive |
| License | The license under which the component is distributed |
Component Inventory
The platform comprises several deployable components that customers host in their Azure subscription. Below is the dependency inventory grouped by these deployable units.
.NET Function Apps (Azure Functions Isolated Worker)
All .NET-based Function Apps target .NET 8.0 using the Azure Functions isolated worker model and share the following SDK layer:
| Package | Version | License |
|---|---|---|
Microsoft.ApplicationInsights.WorkerService |
2.23.0 | MIT |
Microsoft.Azure.Functions.Worker |
2.0.0 | MIT |
Microsoft.Azure.Functions.Worker.ApplicationInsights |
2.0.0 | MIT |
Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore |
2.0.2 | MIT |
Microsoft.Azure.Functions.Worker.Extensions.OpenApi |
1.5.1 | MIT |
Microsoft.Azure.Functions.Worker.Extensions.Timer |
4.3.1 | MIT |
Microsoft.Azure.Functions.Worker.Sdk |
2.0.5 | MIT |
System.Net.Http |
4.3.4 | MIT |
System.Text.RegularExpressions |
4.3.1 | MIT |
Each function app then adds its own specific dependencies as listed below.
Config Function App (npobp_config)
Manages business objects, flows, forms, and platform configuration. Exposes the management API consumed by the ProcessFactorial Portal.
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
JsonDiffPatch.Net |
2.3.0 | MIT | Artifact change comparison |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
Execution Engine (npobp_exec)
Processes form submissions, evaluates flows, and orchestrates actions (create, update, delete, conditions, branching, etc.).
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Messaging.ServiceBus |
7.20.1 | MIT | Service Bus messaging (queue/trigger) |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Azure.Functions.Worker.Extensions.ServiceBus |
5.23.0 | MIT | Service Bus trigger/binding |
Microsoft.Azure.WebJobs.Core |
3.0.41 | MIT | WebJobs SDK core |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
Polling Engine (npobp_poll)
Handles time-based and event-driven flow triggers, including scheduled actions and wait-for-event polling.
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Azure.WebJobs.Core |
3.0.41 | MIT | WebJobs SDK core |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
Translation Layer — Dataverse (npobp_trdataverse)
Translates ProcessFactorial actions into Microsoft Dataverse API operations (create, update, delete, query records).
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Azure.WebJobs.Core |
3.0.41 | MIT | WebJobs SDK core |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
Microsoft.PowerPlatform.Dataverse.Client |
1.2.9 | MIT | Dataverse API client |
Microsoft.PowerPlatform.Dataverse.Client.Dynamics |
1.2.9 | MIT | Dataverse Dynamics client |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
System.Text.RegularExpressions |
4.3.1 | MIT | Security patch (CVE-2019-0820) |
Translation Layer — SQL (npobp_trsql)
Translates ProcessFactorial actions into SQL database operations, supporting PostgreSQL via Npgsql.
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Azure.WebJobs.Core |
3.0.41 | MIT | WebJobs SDK core |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Npgsql |
9.0.3 | PostgreSQL | PostgreSQL database driver |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
Master Maintenance Service (npobp_mastmaint)
Handles platform-level metric rollups, data retention policies, and scheduled maintenance tasks.
| Package | Version | License | Purpose |
|---|---|---|---|
Azure.Data.Tables |
12.11.0 | MIT | Azure Table storage |
Azure.Identity |
1.14.2 | MIT | Azure authentication |
Azure.Security.KeyVault.Secrets |
4.8.0 | MIT | Key Vault secret retrieval |
Azure.Storage.Blobs |
12.25.0 | MIT | Blob storage operations |
HtmlAgilityPack |
1.12.2 | MIT | HTML parsing (form rendering) |
Microsoft.ApplicationInsights |
2.23.0 | MIT | Telemetry |
Microsoft.AspNetCore.Mvc.Core |
2.3.0 | MIT | ASP.NET Core MVC |
Microsoft.Azure.WebJobs.Core |
3.0.41 | MIT | WebJobs SDK core |
Microsoft.Data.SqlClient |
6.1.2 | MIT | SQL Server connectivity |
Microsoft.Extensions.Logging.Abstractions |
9.0.7 | MIT | Logging abstractions |
Microsoft.IdentityModel.Protocols.OpenIdConnect |
8.12.1 | MIT | OpenID Connect protocol |
MongoDB.Bson |
3.5.2 | Apache-2.0 | BSON serialization |
MongoDB.Driver |
3.5.2 | Apache-2.0 | MongoDB / Cosmos DB driver |
Newtonsoft.Json |
13.0.3 | MIT | JSON serialization |
NJsonSchema |
11.5.0 | MIT | JSON Schema validation |
Polly |
8.6.2 | BSD-3-Clause | Resilience and retry logic |
StackExchange.Redis |
2.11.8 | MIT | Redis caching |
System.IdentityModel.Tokens.Jwt |
8.12.1 | MIT | JWT token handling |
Custom Functions Function App (npobp_common)
Hosts custom Python-based functions for extending platform behaviour. This component does not use .NET NuGet packages; its runtime dependencies are Python-based.
npm Packages — Customer Portal (React Application)
The Customer Portal is a React single-page application built with Vite and TypeScript.
Runtime Dependencies
| Package | Version | License |
|---|---|---|
@azure/msal-browser |
^3.5.0 | MIT |
@azure/msal-react |
^2.0.7 | MIT |
@fluentui/react-components |
^9.37.2 | MIT |
@fluentui/react-data-grid-react-window |
9.0.0-beta.23 | MIT |
@fluentui/react-icons |
^2.0.200 | MIT |
@fluentui/react-skeleton |
^9.0.3 | MIT |
@lukemorales/query-key-factory |
^1.2.0 | MIT |
@monaco-editor/react |
^4.7.0 | MIT |
@puckeditor/core |
^0.21.1 | MIT |
@react-querybuilder/fluent |
^6.4.1 | MIT |
@tanstack/react-query |
^4.29.3 | MIT |
axios |
^1.3.5 | MIT |
classnames |
^2.3.2 | MIT |
d3-hierarchy |
^3.1.2 | ISC |
dayjs |
^1.11.9 | MIT |
focus-trap-react |
^11.0.4 | MIT |
formik |
^2.2.9 | Apache-2.0 |
monaco-editor |
^0.53.0 | MIT |
nprogress |
^0.2.0 | MIT |
react |
^18.2.0 | MIT |
react-beautiful-dnd |
^13.1.1 | Apache-2.0 |
react-dom |
^18.2.0 | MIT |
react-modern-drawer |
^1.2.0 | MIT |
react-querybuilder |
^6.4.1 | MIT |
react-router-dom |
^6.14.1 | MIT |
reactflow |
11.7.1 | MIT |
recharts |
^2.7.2 | MIT |
scheduler |
^0.20.0 | MIT |
uuid |
^11.0.3 | MIT |
yup |
^1.1.1 | MIT |
Build & Development Dependencies
| Package | Version | License |
|---|---|---|
@types/react |
^18.0.28 | MIT |
@types/react-dom |
^18.0.11 | MIT |
@typescript-eslint/eslint-plugin |
^5.58.0 | MIT |
@typescript-eslint/parser |
^5.58.0 | BSD-2-Clause |
@vitejs/plugin-react-swc |
^3.0.0 | MIT |
eslint |
^8.38.0 | MIT |
husky |
^8.0.3 | MIT |
prettier |
^2.8.7 | MIT |
sass |
^1.62.0 | MIT |
tailwindcss |
^3.3.2 | MIT |
typescript |
^4.9.3 | Apache-2.0 |
vite |
^4.2.0 | MIT |
npm Packages — Customer Portal Backend (Node.js)
The Portal Backend is a Node.js Express application providing API middleware for the Customer Portal.
| Package | Version | License |
|---|---|---|
applicationinsights |
^2.7.0 | MIT |
cors |
^2.8.5 | MIT |
dotenv |
^16.0.3 | BSD-2-Clause |
express |
^4.21.2 | MIT |
express-rate-limit |
^6.7.0 | MIT |
jsonwebtoken |
^9.0.0 | MIT |
needle |
^3.2.0 | MIT |
npm Packages — DEM Engine (Front-End Rendering)
The DEM Engine is a JavaScript-based front-end rendering pipeline using Gulp and Jest.
Direct Dependencies
| Package | Version | License |
|---|---|---|
gulp |
^4.0.2 | MIT |
gulp-concat |
^2.6.1 | MIT |
gulp-header |
^2.0.9 | MIT |
gulp-order |
^1.2.0 | MIT |
gulp-rename |
^2.0.0 | MIT |
gulp-uglify |
^3.0.2 | MIT |
jest |
^29.7.0 | MIT |
jest-environment-jsdom |
^30.0.0-beta.3 | MIT |
Vulnerability Management
Active Scanning
ProcessFactorial uses Snyk for continuous vulnerability scanning of all NuGet and npm dependencies. Identified vulnerabilities are tracked and patched via explicit <PackageReference> overrides. These patches are already reflected in the component tables above.
Customers are encouraged to
- Run their own vulnerability scanning against their deployed instances
- Subscribe to GitHub Advisory Database or NVD for CVE notifications
- Apply patch releases promptly as they become available
SBOM Generation
Recommended Tools
Customers can generate their own SBOM from a deployed instance using any of the following industry-standard tools:
| Tool | Format | Command |
|---|---|---|
| Trivy | SPDX, CycloneDX | trivy fs --format cyclonedx --output sbom.cdx.json <path> |
| Syft | SPDX, CycloneDX | syft <path> -o cyclonedx-json=sbom.cdx.json |
| Microsoft SBOM Tool | SPDX | sbom-tool generate -b <path> -bc <path> -pn ProcessFactorial -pv <version> |
| dotnet list package | Custom | dotnet list package --include-transitive |
For .NET projects
# List all NuGet packages (including transitive) for a project
dotnet list package --include-transitive
# Export to a machine-readable format
dotnet list package --include-transitive --format json
For npm projects
# List all npm packages (including transitive)
npm list --all
# Export existing lockfile (already contains the full dependency tree)
# package-lock.json or yarn.lock
SBOM Maintenance & Release Cadence
| Activity | Frequency |
|---|---|
| Dependency vulnerability scanning | Continuous (via Snyk) |
| SBOM snapshot published with each release | Per release cycle |
| Emergency patches for critical CVEs | As needed |
| Full dependency audit | Quarterly |
The SBOM is updated and published alongside each release cycle. Customers receiving individual version deployment steps will find the corresponding SBOM snapshot referenced in the release notes.
Related Topics
- Security Considerations — Overall security posture for the Customer Hosted Model
- Release Cycles — Understanding the release cadence
- Hosted Model Deployment Guide — How to deploy and update a customer-hosted instance