Lightworks generates a Software Bill of Materials from your dependency manifests on every push — OSV.dev CVE scan included. The SBOM record lands in your QMS automatically, linked to the commit that triggered it. Section 5 of your DHF, always current.
package.json, requirements.txt, go.mod, Gemfile. Lightworks reads what's already there — no separate config, no manual exports.
OSV.dev integration flags critical vulnerabilities before they reach a release. The SBOM record carries the scan result alongside the dependency list.
The SBOM is section 5 of your Design History File. When you compile a release, the current SBOM is already there — no last-minute scramble.