DruBOM Beta2 Adds Dependency Mapping to Drupal Security Inventory

A new release of DruBOM helps Drupal site teams trace which packages introduce software dependencies. Version 1.0.0-beta2, released on 12 October 2026, adds dependency mapping to the software bill of materials (SBOM) module. Creator Paolo Mainardi, co-founder and CTO of SparkFabrik, announced the update following a substantial rewrite of the project.

The DruBOM module generates an inventory of software components used by a Drupal website, helping administrators identify dependencies and investigate security findings. Its latest release shows which Drupal project, extension or root package introduces a dependency, providing information that can help teams trace the source of an affected component rather than examining advisory results alone.

Beta2 introduces an interactive graph based on the site's latest inventory snapshot. Administrators can select a package to view the dependency chains leading to it or filter the graph to components with open security findings. Package-origin information also appears in the inventory and security findings tables. When JavaScript or WebGL2 is unavailable, the dependency-map tab links to those tables instead of displaying the graph. Public packages link to Drupal.org, Packagist or npmjs.com; private packages have no public registry links. The redesigned overview shows whether installed packages have open findings, whether any are listed as known exploited, and when snapshots and advisory checks were last completed. Findings distinguish packages that were checked, could not be checked or returned no source data, while declared-only findings remain separate from installed packages.

The broader rewrite arrived with DruBOM 1.0.0-beta1 on 11 October. The earlier implementation used external Syft and Grype scanning tools. Mainardi says the rewritten version no longer requires external scanning binaries and operates in PHP and covers Composer packages, Drupal modules, themes, profiles, declared asset libraries, and JavaScript dependencies managed through npm, Yarn or pnpm. Components that cannot be inventoried are identified as coverage gaps rather than silently excluded.

Security advisory checking is optional and uses Drupal.org advisories, the Packagist advisory database and OSV.dev. DruBOM also draws on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue and ENISA's European Vulnerability Database for additional vulnerability information. The former documents vulnerabilities known to have been exploited, while the latter provides broader vulnerability records and exploitation-status information. Mainardi says the advisory-checking workflow is opt-in and does not send private packages to external services.

The rewrite also introduces Vulnerability Exploitability eXchange (VEX) decisions, allowing authorised users to record whether a reported vulnerability affects their installation, provide a reason and set an optional review date. These assessments are associated with specific package versions, retain a decision history and require confirmation after new inventory snapshots. DruBOM can export package inventories, dependencies, security findings and assessment decisions using the SPDX 3.0.1 standard.

Administrators can review this information through the software inventory dashboard under Drupal's Reports section. The module also provides Drush commands for generating snapshots, examining findings and exporting SBOMs. Its drush drubom:check command can fail a continuous integration pipeline when open findings meet a configured severity threshold or the inventory is incomplete.

Paolo introduced DruBOM at DrupalCon Lille in October 2023. Describing the latest rewrite in a LinkedIn post, he said development involved Claude and Codex coding agents, automated testing and human oversight of architectural decisions and code merges. He reported more than 300 automated tests and approximately 34,000 lines of code, tests and documentation produced in under 48 hours. Those figures are developer-reported and were not independently verified.

DruBOM 1.0.0-beta2 requires Drupal 11.3 or later within the Drupal 11 series, or Drupal 12, and a configured private file system for storing snapshots. According to the beta2 release notes, updating from beta1 requires no update hooks or configuration changes; administrators should clear caches after updating. Sites moving from the older Syft- and Grype-based implementation should follow the separate migration guidance for the rewritten module. The project has not yet reached a supported stable release; users should not assume the beta has the security advisory coverage associated with supported stable releases.

Further information, including installation instructions, release notes and technical documentation, is available on the DruBOM project page on Drupal.org.