From 61c3196454ea1003f60f7960fecd130e926808ed Mon Sep 17 00:00:00 2001
From: ilyakhd <14272298+IlyaKhD@users.noreply.github.com>
Date: Fri, 16 Oct 2026 10:29:10 +0300
Subject: [PATCH 1/3] update to sbom-toolkit@0.17.0

---
 packages/sbom/package.json   |  2 +-
 packages/sbom/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/sbom/package.json b/packages/sbom/package.json
index 21e61a7d9527..3db76c29d113 100644
--- a/packages/sbom/package.json
+++ b/packages/sbom/package.json
@@ -3,7 +3,7 @@
   "version": "26.2.0",
   "private": true,
   "devDependencies": {
-    "@devexpress/sbom-toolkit": "0.16.0"
+    "@devexpress/sbom-toolkit": "0.17.0"
   },
   "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
 }
diff --git a/packages/sbom/pnpm-lock.yaml b/packages/sbom/pnpm-lock.yaml
index a56d6a79fa68..ac7cc3be34e9 100644
--- a/packages/sbom/pnpm-lock.yaml
+++ b/packages/sbom/pnpm-lock.yaml
@@ -19,8 +19,8 @@ importers:
   .:
     devDependencies:
       '@devexpress/sbom-toolkit':
-        specifier: 0.16.0
-        version: 0.16.0
+        specifier: 0.17.0
+        version: 0.17.0
 
 packages:
 
@@ -153,8 +153,8 @@ packages:
     engines: {node: ^20 || ^22 || ^24 || ^25, pnpm: '>=10'}
     hasBin: true
 
-  '@devexpress/sbom-toolkit@0.16.0':
-    resolution: {integrity: sha512-ZTY1rDUsZCFG9+r1L7ncf55OykEkVrV6hUXdGdGZ6X1j62BQGChbC53iwY/B8uTxWQHe2qacJstg/onT5mulxg==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.16.0/326c2153654eba27ad3a04ea4815d651661cc4a9}
+  '@devexpress/sbom-toolkit@0.17.0':
+    resolution: {integrity: sha512-UjqI/TOlIIQOKAgCaMnegR7VQdqtn1oI8Hw9Aq0sen6ROd/y448Lv2+j7xdRpOQCL9BAdRJFQ/ilNfFyRIrHGQ==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.17.0/3827a1ed41e51b9220243cbdc094bb943b896a78}
     hasBin: true
 
   '@gar/promise-retry@1.0.3':
@@ -1073,7 +1073,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@devexpress/sbom-toolkit@0.16.0':
+  '@devexpress/sbom-toolkit@0.17.0':
     dependencies:
       '@cyclonedx/cdxgen': 12.5.1
       spdx-license-ids: 3.0.23

From a4a9741590535f60a062777073923a8fa794178d Mon Sep 17 00:00:00 2001
From: ilyakhd <14272298+IlyaKhD@users.noreply.github.com>
Date: Fri, 16 Oct 2026 11:11:21 +0300
Subject: [PATCH 2/3] specify public and internal packages

---
 packages/sbom/scripts/make.ts | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/packages/sbom/scripts/make.ts b/packages/sbom/scripts/make.ts
index f9b550d797ca..39c681bf26f7 100644
--- a/packages/sbom/scripts/make.ts
+++ b/packages/sbom/scripts/make.ts
@@ -40,7 +40,34 @@ await makeSbom({
   packages: [{ fullName: 'devextreme-extra-deps' }],
   options,
 });
-await makeSbom({ targetDir: REPO_ROOT, outputDir: DIST, packages, options });
+await makeSbom({
+  targetDir: REPO_ROOT,
+  outputDir: DIST,
+  packages,
+  options: {
+    ...options,
+    publicPackages: [
+      '@devexpress/utils',
+      'devexpress-diagram',
+      'devexpress-gantt',
+      'devextreme-angular',
+      'devextreme-quill',
+      'devextreme-react',
+      'devextreme-themebuilder',
+      'devextreme-vue',
+      'devextreme',
+    ],
+    // Deliberately not included: 'devextreme-cldr-data', 'devextreme-internal-tools', 'eslint-config-devextreme'
+    internalPackages: [
+      'devextreme-metadata',
+      'eslint-migration-utils',
+    ],
+    cpeMappings: [
+      { name: 'devextreme-exceljs-fork', vendor: 'devexpress' },
+      { name: 'devextreme-schematics', vendor: 'devexpress' },
+    ],
+  },
+});
 
 for (const { fullName } of packages) {
   const sbomPath = path.join(DIST, `${fullName}.cdx.json`);

From c0ec633c9fb4299c7446c2212501d240b5584d6b Mon Sep 17 00:00:00 2001
From: ilyakhd <14272298+IlyaKhD@users.noreply.github.com>
Date: Fri, 16 Oct 2026 11:27:44 +0300
Subject: [PATCH 3/3] add missing cpe packages

---
 packages/sbom/scripts/make.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/sbom/scripts/make.ts b/packages/sbom/scripts/make.ts
index 39c681bf26f7..cd0c59f9a5bb 100644
--- a/packages/sbom/scripts/make.ts
+++ b/packages/sbom/scripts/make.ts
@@ -57,14 +57,16 @@ await makeSbom({
       'devextreme-vue',
       'devextreme',
     ],
-    // Deliberately not included: 'devextreme-cldr-data', 'devextreme-internal-tools', 'eslint-config-devextreme'
     internalPackages: [
       'devextreme-metadata',
       'eslint-migration-utils',
     ],
     cpeMappings: [
+      { name: 'devextreme-cldr-data', vendor: 'devexpress' },
       { name: 'devextreme-exceljs-fork', vendor: 'devexpress' },
+      { name: 'devextreme-internal-tools', vendor: 'devexpress' },
       { name: 'devextreme-schematics', vendor: 'devexpress' },
+      { name: 'eslint-config-devextreme', vendor: 'devexpress' },
     ],
   },
 });