Software Bill of Materials

Document Information

Field	Value
BOM Format	CycloneDX 1.6 (OWASP)
SBOM Author	Provisionr LLC.
Document Created	2026-04-01
Primary Component	`provisionr-io/prv-prd-src-wks-cli`.
Application License	Apache-2.0
Distribution Model	Compiled PHP binary via Homebrew (all dependencies bundled)
Generation Method	Automated via `composer.lock` analysis

Machine-readable SBOM artifacts (sbom.cdx.json and sbom-data.json) are attached to each GitHub release. Download the SBOM matching your installed version. These files are consumable by Dependency-Track, Snyk, FOSSA, Nessus, and other SBOM-aware tools.

Compliance Coverage

This SBOM is structured to satisfy the following frameworks:

Framework	Coverage
CycloneDX 1.6 (OWASP)	Full — JSON artifact + human-readable
NTIA Minimum Elements (EO 14028)	Full — supplier, component, version, identifier, relationship, timestamp, author
NIS2 Directive (EU 2022/2555)	Supply chain risk transparency for essential/important entities
EU Cyber Resilience Act (CRA)	Vulnerability handling and dependency transparency for software with digital elements
OWASP SAMM	Security Practice: Software Dependencies — inventory and risk assessment
NIST SP 800-218 (SSDF)	PS.3 — archive and protect each software release, including dependencies

For a detailed analysis of dependency provenance, supply chain risk assessment, and architectural constraints, see the companion Dependency Narrative.

Summary

Metric	Count
Declared dependencies (`composer.json`)	7
Installed packages (`composer.lock`)	89
Direct (resolved in lock file)	4
Transitive	85

License Inventory

License	Packages	Compliance Action
MIT	82	None required
BSD-3-Clause	4	None required
Apache-2.0	1	None required
BSD-3-Clause / GPL-2.0 / GPL-3.0 (dual)	2	BSD-3-Clause elected (see below)

License Elections

The following packages are dual-licensed. Provisionr elects the permissive license for distribution.

Component	Available Licenses	Elected License	Rationale
`nette/schema` v1.3.5	BSD-3-Clause, GPL-2.0-only, GPL-3.0-only	BSD-3-Clause	Permissive license elected per Nette’s published licensing terms
`nette/utils` v4.1.3	BSD-3-Clause, GPL-2.0-only, GPL-3.0-only	BSD-3-Clause	Permissive license elected per Nette’s published licensing terms

Direct Dependencies

These packages are explicitly declared in the application’s composer.json.

Component	Version	License	Purpose
`laravel-zero/framework`	12.1.0	MIT	CLI application framework
`laravel/prompts`	0.3.16	MIT	Interactive CLI prompts, forms, and tables
`provisionesta/datadumper`	dev-main	MIT	CSV, JSON, and YAML data export with diff changelog
`symfony/uid`	7.4.8	MIT	UUID/ULID generation

illuminate/http, illuminate/log, and illuminate/validation are declared as direct dependencies but are resolved by Composer via laravel/framework’s replace directive. See the Dependency Narrative for a full explanation of this resolution mechanism and its implications.

Transitive Dependencies

Framework Core (Required at Runtime)

These packages are required by laravel-zero/framework or laravel/framework and are exercised at runtime.

Component	Version	License	Required By
`laravel/framework`	12.56.0	MIT	Composer `replace` resolution for `illuminate/*`
`symfony/console`	7.4.8	MIT	laravel-zero/framework
`symfony/process`	7.4.8	MIT	laravel-zero/framework
`symfony/event-dispatcher`	7.4.8	MIT	laravel-zero/framework
`symfony/error-handler`	7.4.8	MIT	laravel-zero/framework
`symfony/finder`	7.4.8	MIT	laravel-zero/framework
`symfony/var-dumper`	7.4.8	MIT	laravel-zero/framework
`symfony/string`	8.0.8	MIT	symfony/console
`symfony/yaml`	7.4.8	MIT	provisionesta/datadumper
`guzzlehttp/guzzle`	7.10.0	MIT	laravel-zero/framework
`guzzlehttp/promises`	2.3.0	MIT	guzzlehttp/guzzle
`guzzlehttp/psr7`	2.9.0	MIT	guzzlehttp/guzzle
`nesbot/carbon`	3.11.3	MIT	provisionesta/datadumper
`monolog/monolog`	3.10.0	MIT	laravel/framework
`vlucas/phpdotenv`	5.6.3	BSD-3-Clause	laravel-zero/framework
`nunomaduro/collision`	8.9.2	MIT	laravel-zero/framework
`nunomaduro/termwind`	2.4.0	MIT	laravel-zero/framework
`nunomaduro/laravel-console-summary`	1.14.0	MIT	laravel-zero/framework
`nunomaduro/laravel-console-task`	1.11.0	MIT	laravel-zero/framework
`laravel-zero/foundation`	12.54.1	MIT	laravel-zero/framework
`laravel/serializable-closure`	2.0.10	MIT	laravel/framework
`ramsey/uuid`	4.9.2	MIT	laravel-zero/framework
`ramsey/collection`	2.1.1	MIT	ramsey/uuid
`brick/math`	0.14.8	MIT	ramsey/uuid
`filp/whoops`	2.18.4	MIT	nunomaduro/collision
`spatie/simple-excel`	3.9.0	MIT	provisionesta/datadumper

Framework Transitive (Not Invoked by Application Code)

These packages are present in the dependency tree because laravel/framework is installed as a monolith via Composer’s replace mechanism. They are never called by Provisionr Workspace CLI application code.

Component	Version	License	Why Present
`symfony/mailer`	7.4.8	MIT	laravel/framework requires it for email
`symfony/mime`	7.4.8	MIT	laravel/framework requires it for email
`symfony/routing`	7.4.8	MIT	laravel/framework requires it for HTTP routing
`symfony/http-foundation`	7.4.8	MIT	laravel/framework requires it for HTTP
`symfony/http-kernel`	7.4.8	MIT	laravel/framework requires it for HTTP
`symfony/css-selector`	8.0.8	MIT	laravel/framework (email HTML inlining chain)
`symfony/translation`	8.0.8	MIT	nesbot/carbon (i18n support)
`symfony/clock`	8.0.8	MIT	nesbot/carbon
`fruitcake/php-cors`	1.4.0	MIT	laravel/framework (CORS middleware)
`dragonmantank/cron-expression`	3.6.0	MIT	laravel/framework (task scheduling)
`egulias/email-validator`	4.0.4	MIT	laravel/framework (email validation)
`doctrine/inflector`	2.1.0	MIT	laravel/framework (pluralization)
`doctrine/lexer`	3.0.1	MIT	egulias/email-validator
`league/commonmark`	2.8.2	BSD-3-Clause	laravel/framework (Markdown parsing)
`league/config`	1.2.0	BSD-3-Clause	league/commonmark
`league/flysystem`	3.33.0	MIT	laravel/framework (filesystem abstraction)
`league/flysystem-local`	3.31.0	MIT	laravel/framework
`league/mime-type-detection`	1.16.0	MIT	league/flysystem
`league/uri`	7.8.1	MIT	laravel/framework
`league/uri-interfaces`	7.8.1	MIT	league/uri
`tijsverkoyen/css-to-inline-styles`	2.4.0	BSD-3-Clause	laravel/framework (email HTML inlining)
`dflydev/dot-access-data`	3.0.3	MIT	league/commonmark
`nette/schema`	1.3.5	BSD-3-Clause (elected)	league/config
`nette/utils`	4.1.3	BSD-3-Clause (elected)	nette/schema
`openspout/openspout`	4.32.0	MIT	spatie/simple-excel (XLSX/ODS engine, unused)
`nunomaduro/laravel-desktop-notifier`	2.10.0	MIT	laravel-zero/framework
`jolicode/jolinotif`	2.7.3	MIT	nunomaduro/laravel-desktop-notifier
`jolicode/php-os-helper`	0.1.0	MIT	jolicode/jolinotif
`voku/portable-ascii`	2.0.3	MIT	laravel/framework
`guzzlehttp/uri-template`	1.0.5	MIT	laravel/framework

PSR Interfaces

Standard PHP-FIG interface contracts. Minimal code, no runtime behavior.

Component	Version	License	Required By
`psr/clock`	1.0.0	MIT	nesbot/carbon
`psr/container`	2.0.2	MIT	symfony/service-contracts
`psr/event-dispatcher`	1.0.0	MIT	symfony/event-dispatcher-contracts
`psr/http-client`	1.0.3	MIT	guzzlehttp/guzzle
`psr/http-factory`	1.1.0	MIT	guzzlehttp/psr7
`psr/http-message`	2.0	MIT	guzzlehttp/psr7
`psr/log`	3.0.2	MIT	laravel-zero/framework
`psr/simple-cache`	3.0.0	MIT	laravel/framework

Symfony Contracts and Polyfills

Component	Version	License	Notes
`symfony/deprecation-contracts`	3.6.0	MIT
`symfony/event-dispatcher-contracts`	3.6.0	MIT
`symfony/service-contracts`	3.6.1	MIT
`symfony/translation-contracts`	3.6.1	MIT
`symfony/polyfill-ctype`	1.33.0	MIT	ctype functions
`symfony/polyfill-intl-grapheme`	1.33.0	MIT	intl grapheme functions
`symfony/polyfill-intl-idn`	1.33.0	MIT	IDN functions
`symfony/polyfill-intl-normalizer`	1.33.0	MIT	intl Normalizer class
`symfony/polyfill-mbstring`	1.33.0	MIT	mbstring functions
`symfony/polyfill-php80`	1.33.0	MIT	Dead code (app requires PHP 8.4)
`symfony/polyfill-php83`	1.33.0	MIT	Dead code (app requires PHP 8.4)
`symfony/polyfill-php84`	1.33.0	MIT	Dead code (app requires PHP 8.4)
`symfony/polyfill-php85`	1.33.0	MIT	Future PHP 8.5 backfills
`symfony/polyfill-uuid`	1.33.0	MIT	UUID functions

Other Transitive

Component	Version	License	Required By
`carbonphp/carbon-doctrine-types`	3.2.0	MIT	nesbot/carbon
`graham-campbell/result-type`	1.1.4	MIT	vlucas/phpdotenv
`phpoption/phpoption`	1.9.5	Apache-2.0	graham-campbell/result-type
`ralouphie/getallheaders`	3.0.3	MIT	guzzlehttp/psr7
`provisionesta/gitlab-api-client`	4.2	MIT	provisionesta/datadumper
`provisionesta/google-api-client`	4.2	MIT	provisionesta/datadumper

Vulnerability Disclosure

Provisionr monitors dependencies for known vulnerabilities using automated scanning integrated into our CI/CD pipeline. If you discover a vulnerability in any dependency listed here, please report it to [email protected]. See responsible disclosure to learn more.

Introduction

Commands

Software Bill of Materials

Document Information

Compliance Coverage

Summary

License Inventory

License Elections

Direct Dependencies

Transitive Dependencies

Framework Core (Required at Runtime)

Framework Transitive (Not Invoked by Application Code)

PSR Interfaces

Symfony Contracts and Polyfills

Other Transitive

Vulnerability Disclosure

​Document Information

​Compliance Coverage

​Summary

​License Inventory

​License Elections

​Direct Dependencies

​Transitive Dependencies

​Framework Core (Required at Runtime)

​Framework Transitive (Not Invoked by Application Code)

​PSR Interfaces

​Symfony Contracts and Polyfills

​Other Transitive

​Vulnerability Disclosure

Document Information

Compliance Coverage

Summary

License Inventory

License Elections

Direct Dependencies

Transitive Dependencies

Framework Core (Required at Runtime)

Framework Transitive (Not Invoked by Application Code)

PSR Interfaces

Symfony Contracts and Polyfills

Other Transitive

Vulnerability Disclosure