Evidence boundary: GitHub's SBOM capability continues. The retiring behaviour is the synchronous request-and-response workflow.
What changes
Clients must submit an SBOM generation request, follow the returned location and poll until the generated result is available instead of expecting the complete SBOM in the initial response.
Who is affected
- Automation that assumes one request returns a complete SBOM.
- Compliance and inventory pipelines with fixed request timeouts.
- Tools that do not persist or follow the returned polling location.
Timeline
The synchronous workflow retires on 13 November 2026.
Required action
- Update API clients to handle asynchronous job creation.
- Store and poll the returned location with bounded retry logic.
- Handle pending, completed and failed generation states.
- Retest downstream parsing and evidence collection.
What is not affected
The record does not describe a retirement of SBOM generation itself or of GitHub's wider dependency-security features.
PlatformTrace analysis
This is a contract-level workflow change: clients may continue calling a familiar endpoint family but fail because their control flow assumes immediate completion.
Sources
Corrections and updates
No correction is currently open. Any deadline or response-contract change will be dated.