Introduction
This guide helps you troubleshoot missing dependencies in an SBOM report generated by Spectra Assure. If libraries appear in your system content but are not included in the report, follow the steps below to improve component detection and regenerate the SBOM.
Issue description
Some customers may notice that certain libraries are missing from the SBOM report even though they are present in the project files or system content. In many cases, this happens when the project does not include a package.json manifest file, which helps Spectra Assure identify dependencies accurately.
Signs
Libraries or packages expected in the SBOM are not listed in the report.
The project content contains dependencies, but Spectra Assure reports incomplete component coverage.
The SBOM output does not reflect the full set of application dependencies.
Basic troubleshooting steps
Checklist:
Confirm that the missing libraries are actually part of the project and not only installed in the environment.
Check whether a package.json file exists in the project root.
Verify that the manifest file includes the dependencies you expect to see in the SBOM.
Make sure the project is uploaded again after any manifest changes.
Advanced troubleshooting steps
Step 1: Create a package.json manifest file
Generate a package.json file for your project if one does not already exist. This file should describe the project dependencies so Spectra Assure can detect them during analysis.
Step 2: Store the manifest in your project
Place the package.json file in the appropriate project location, typically the project root, so it is included when the project is scanned.
Step 3: Re-upload the project to Spectra Assure
Upload the updated project again so Spectra Assure can re-scan the content and generate a more accurate SBOM report with the missing components included.
Next steps
If the SBOM still appears incomplete after adding the manifest and re-uploading the project, collect the project details and contact support for further investigation.
Additional information
For best results, ensure your project includes accurate dependency metadata before generating an SBOM. A complete manifest helps Spectra Assure identify components more reliably and reduces the chance of missing libraries in the report.
Disclaimer
Results may vary depending on project structure, available metadata, and the contents of the uploaded package. Use this guide as general troubleshooting information and consult support if you need additional assistance.