Visualizing SBOMs with the Dependency Radar: A Practical Approach to Dependency Management

Dependency graphs get harder to reason about as a project grows — tracking which libraries, frameworks, and known vulnerabilities are actually in play stops being something you can hold in your head. Software Bills of Materials in the CycloneDX format are one structured way to document that surface area, but a raw SBOM is still just a long, flat list. This piece — published on sigs.de and building on Thomas Ronzon's earlier JavaSPEKTRUM article (6/2024) — is about turning that list into something engineers actually look at.

From a Flat List to a Radar

The core idea is a small tool that takes jbom-generated CycloneDX SBOMs and feeds them into a Zalando Tech Radar-style visualization — the same quadrant-and-ring format teams already use to track technology choices, repurposed here to make dependency risk legible at a glance instead of buried in a JSON file.

The full article is published on sigs.de, in German. Continue reading: the full article on sigs.de →