Minimum viable 1.6 SBOM for broad compatibility with audit tooling (per various AIs)

min-json-aistudio.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2024-05-20T12:00:00Z",
    "component": {
      "bom-ref": "my-app@1.0.0",
      "type": "application",
      "name": "My Example App",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:npm/lodash@4.17.21",
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "description": "A modern JavaScript utility library delivering modularity, performance & extras.",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "707aac92eb1ffc591948cc1a551ee30a35b6a8f15ee9c5dedb95caa12eb3c577"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "purl": "pkg:npm/lodash@4.17.21"
    }
  ],
  "dependencies": [
    {
      "ref": "my-app@1.0.0",
      "dependsOn": [
        "pkg:npm/lodash@4.17.21"
      ]
    }
  ]
}

min-sbom-chatgpt.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-04-28T00:00:00Z",
    "tools": [
      {
        "vendor": "example",
        "name": "manual",
        "version": "1.0"
      }
    ],
    "component": {
      "type": "application",
      "name": "my-app",
      "version": "1.0.0",
      "purl": "pkg:generic/my-app@1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "left-pad",
      "version": "1.3.0",
      "purl": "pkg:npm/left-pad@1.3.0"
    }
  ]
}

min-sbom-claude.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:<uuid4>",
  "version": 1,
  "metadata": {
    "timestamp": "<ISO8601>",
    "lifecycles": [{ "phase": "build" }],
    "tools": {
      "components": [{ "type": "application", "name": "<tool>", "version": "<ver>" }]
    },
    "authors": [{ "name": "<author or org>" }],
    "component": {
      "type": "application",
      "bom-ref": "<root-ref>",
      "name": "<your-app>",
      "version": "<app-version>"
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:npm/lodash@4.17.21",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "<hash>" }]
    }
  ],
  "dependencies": [
    { "ref": "<root-ref>", "dependsOn": ["pkg:npm/lodash@4.17.21"] },
    { "ref": "pkg:npm/lodash@4.17.21", "dependsOn": [] }
  ]
}

min-sbom-gemini.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e07533e-e39d-471d-84fd-9f430588647b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-04-28T15:25:33Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "Acme Corp",
          "name": "SBOM-Generator",
          "version": "2.0.0"
        }
      ]
    },
    "component": {
      "bom-ref": "main-app@1.0.0",
      "type": "application",
      "name": "MyMinimalApp",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:npm/lodash@4.17.21",
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "6032d36a7985444f84c489745b410526e033e46c761e050f24206c9a35e72d62"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "purl": "pkg:npm/lodash@4.17.21"
    }
  ],
  "dependencies": [
    {
      "ref": "main-app@1.0.0",
      "dependsOn": [
        "pkg:npm/lodash@4.17.21"
      ]
    },
    {
      "ref": "pkg:npm/lodash@4.17.21",
      "dependsOn": []
    }
  ]
}