timetobail
My stack

GitHub · Forced move · Announced May 12, 2026 · Sources checked Oct 17

Time to bail on Scripts that call GitHub's synchronous SBOM API?

Time to Bail · Boarding pass

FromScripts that call GitHub's synchronous SBOM API
ToYour pick

Act. You can stay.

The synchronous SBOM endpoint is removed November 13, 2026. Switch to sbom/generate-report first.[1]

Act means: change a setting or plan before the date. You can stay.

Gate closes
Removal
Time left
26days
Status
Act

GitHub's synchronous SBOM API is removed November 13, 2026

GitHub removes its old SBOM endpoint on November 13, 2026. It is the synchronous one at /dependency-graph/sbom. Move your scripts to the new endpoint. It gives you a URL to check until the file is ready.

Email me 7 days before Nov 13

One email with the first steps. Nothing else.

We email you one link to confirm (double opt-in). Nothing starts until you click it. Unsubscribe any time. How we use your email.

Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar

How it is winding down

  1. May 12AnnouncedDone
  2. Nov 13RemovalNext

What to do before November 13

Tick steps as you go. Your progress stays in this browser.

  1. Find the calls

    Search scripts and workflows for dependency-graph/sbom.

  2. Switch the endpoint

    Call dependency-graph/sbom/generate-report instead.

  3. Poll for the file

    Wait on the URL it returns, then download the SBOM.

Email me 7 days before Nov 13

One email with the first steps. Nothing else.

We email you one link to confirm (double opt-in). Nothing starts until you click it. Unsubscribe any time. How we use your email.

Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar

Facts we checked

Facts and their sources
RemovalNovember 13, 2026[1]
Old endpoint/{owner}/{repo}/dependency-graph/sbom[1]
New endpoint/{owner}/{repo}/dependency-graph/sbom/generate-report[1]
How the new one worksIt returns a URL that you poll; the finished SBOM is cached for download[1]
AnnouncedMay 12, 2026[1]
Scripts on the old endpointMust move before November 13, 2026[1]

Sources

Check it yourself. Every fact above links here.

  1. Synchronous SBOM API deprecated GitHub · primary · checked Oct 17
Read the published editorial report

What changed

Time to bail on Scripts that call GitHub's synchronous SBOM API? Act. You can stay. The synchronous SBOM endpoint is removed November 13, 2026. Switch to sbom/generate-report first.

On our scale this is Act: change a setting or plan before the date. You can stay.

GitHub removes its old SBOM endpoint on November 13, 2026. It is the synchronous one at /dependency-graph/sbom. Move your scripts to the new endpoint. It gives you a URL to check until the file is ready.

Here are the facts we checked:

  • Removal: November 13, 2026 (GitHub)
  • Old endpoint: /{owner}/{repo}/dependency-graph/sbom (GitHub)
  • New endpoint: /{owner}/{repo}/dependency-graph/sbom/generate-report (GitHub)
  • How the new one works: It returns a URL that you poll; the finished SBOM is cached for download (GitHub)
  • Announced: May 12, 2026 (GitHub)
  • Scripts on the old endpoint: Must move before November 13, 2026 (GitHub)

You can stay on GitHub. You have to change a setting or plan before the date.

Leaving is a choice here, not a must.

GitHub is the main source for this page. GitHub has not said more than what is listed here. If a fact is not on this page, we do not know it yet.

Who is affected

Scripts on the old endpoint: Must move before November 13, 2026.

The date to remember is November 13, 2026. Make the change before then.

What to do before November 13

  1. Find the calls. Search scripts and workflows for dependency-graph/sbom.
  2. Switch the endpoint. Call dependency-graph/sbom/generate-report instead.
  3. Poll for the file. Wait on the URL it returns, then download the SBOM.

A few tips:

  • Make the change yourself before the date. Do not wait for the last reminder email.
  • Write down your current plan or settings first, so you can compare after the change.
  • After the change, open your settings again and check that it worked.

How to tell your users

If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.

If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.

Options people mention

Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.

Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.

Questions people ask

No questions collected yet.

Sources

Thanks.

Did this answer your question?

Run SaaS spend at work? Get these changes before the invoice

Arrivals · for builders

Building where they land?

People on Scripts that call GitHub's synchronous SBOM API can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.

Listing is free. An editor checks it. Not ranked. Not paid.

Open the playbookList your product