From 924ef7448ec76693fd41a56500a3a930b56ca397 Mon Sep 17 00:00:00 2001
From: "ilya.kharchenko" <14272298+IlyaKhD@users.noreply.github.com>
Date: Fri, 16 Oct 2026 08:51:04 +0000
Subject: [PATCH] fix(sbom): update dx package attributions

---
 packages/sbom/package.json    |  2 +-
 packages/sbom/pnpm-lock.yaml  | 10 +++++-----
 packages/sbom/scripts/make.ts | 31 ++++++++++++++++++++++++++++++-
 3 files changed, 36 insertions(+), 7 deletions(-)

diff --git a/packages/sbom/package.json b/packages/sbom/package.json
index 56fa4dc5762b..4337798285d2 100644
--- a/packages/sbom/package.json
+++ b/packages/sbom/package.json
@@ -3,7 +3,7 @@
   "version": "26.1.6",
   "private": true,
   "devDependencies": {
-    "@devexpress/sbom-toolkit": "0.16.0"
+    "@devexpress/sbom-toolkit": "0.17.0"
   },
   "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
 }
diff --git a/packages/sbom/pnpm-lock.yaml b/packages/sbom/pnpm-lock.yaml
index 1b4b08dcc474..35c5b92b84f2 100644
--- a/packages/sbom/pnpm-lock.yaml
+++ b/packages/sbom/pnpm-lock.yaml
@@ -19,8 +19,8 @@ importers:
   .:
     devDependencies:
       '@devexpress/sbom-toolkit':
-        specifier: 0.16.0
-        version: 0.16.0
+        specifier: 0.17.0
+        version: 0.17.0
 
 packages:
 
@@ -153,8 +153,8 @@ packages:
     engines: {node: ^20 || ^22 || ^24 || ^25, pnpm: '>=10'}
     hasBin: true
 
-  '@devexpress/sbom-toolkit@0.16.0':
-    resolution: {integrity: sha512-ZTY1rDUsZCFG9+r1L7ncf55OykEkVrV6hUXdGdGZ6X1j62BQGChbC53iwY/B8uTxWQHe2qacJstg/onT5mulxg==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.16.0/326c2153654eba27ad3a04ea4815d651661cc4a9}
+  '@devexpress/sbom-toolkit@0.17.0':
+    resolution: {integrity: sha512-UjqI/TOlIIQOKAgCaMnegR7VQdqtn1oI8Hw9Aq0sen6ROd/y448Lv2+j7xdRpOQCL9BAdRJFQ/ilNfFyRIrHGQ==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.17.0/3827a1ed41e51b9220243cbdc094bb943b896a78}
     hasBin: true
 
   '@gar/promise-retry@1.0.3':
@@ -1073,7 +1073,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@devexpress/sbom-toolkit@0.16.0':
+  '@devexpress/sbom-toolkit@0.17.0':
     dependencies:
       '@cyclonedx/cdxgen': 12.5.1
       spdx-license-ids: 3.0.23
diff --git a/packages/sbom/scripts/make.ts b/packages/sbom/scripts/make.ts
index f9b550d797ca..cd0c59f9a5bb 100644
--- a/packages/sbom/scripts/make.ts
+++ b/packages/sbom/scripts/make.ts
@@ -40,7 +40,36 @@ await makeSbom({
   packages: [{ fullName: 'devextreme-extra-deps' }],
   options,
 });
-await makeSbom({ targetDir: REPO_ROOT, outputDir: DIST, packages, options });
+await makeSbom({
+  targetDir: REPO_ROOT,
+  outputDir: DIST,
+  packages,
+  options: {
+    ...options,
+    publicPackages: [
+      '@devexpress/utils',
+      'devexpress-diagram',
+      'devexpress-gantt',
+      'devextreme-angular',
+      'devextreme-quill',
+      'devextreme-react',
+      'devextreme-themebuilder',
+      'devextreme-vue',
+      'devextreme',
+    ],
+    internalPackages: [
+      'devextreme-metadata',
+      'eslint-migration-utils',
+    ],
+    cpeMappings: [
+      { name: 'devextreme-cldr-data', vendor: 'devexpress' },
+      { name: 'devextreme-exceljs-fork', vendor: 'devexpress' },
+      { name: 'devextreme-internal-tools', vendor: 'devexpress' },
+      { name: 'devextreme-schematics', vendor: 'devexpress' },
+      { name: 'eslint-config-devextreme', vendor: 'devexpress' },
+    ],
+  },
+});
 
 for (const { fullName } of packages) {
   const sbomPath = path.join(DIST, `${fullName}.cdx.json`);