Issues

• Resolve free-form license strings (e.g. from Maven POMs) to SPDX license kinds

  bazel-contrib/supply-chain#235 · Filter by author darkrift opened on Oct 18, 2026

• package_metadata must be able to support more than one instance of any given attribute kind.

  bazel-contrib/supply-chain#228 · Filter by author aiuto opened on Oct 13, 2026
  3

• Add support for license conclusions

  bazel-contrib/supply-chain#227 · Filter by author darkrift opened on Oct 10, 2026
  5

• SBOM deduplication loses platform-specific dependency graphs

  bazel-contrib/supply-chain#226 · Filter by author darkrift opened on Oct 10, 2026

• Need basic test coverage before declaring 1.0

  bazel-contrib/supply-chain#214 · Filter by author darkrift opened on Sep 28, 2026

• Discussion: Vulnerability disclosure ecosystem

  bazel-contrib/supply-chain#211 · Filter by author anders-alfredsson-zenseact opened on Sep 17, 2026

• Provide working example in datadog/Agent.

  bazel-contrib/supply-chain#206 · Filter by author aiuto opened on Aug 27, 2026
  

• Add metadata to some core rules

  bazel-contrib/supply-chain#205 · Filter by author aiuto opened on Aug 27, 2026

• Need an example of "dual" Purls

  bazel-contrib/supply-chain#204 · Filter by author aiuto opened on Aug 27, 2026

• Add check in BCR process to look for metadata

  bazel-contrib/supply-chain#203 · Filter by author aiuto opened on Aug 27, 2026

• Add metadata to some core package manager rules

  bazel-contrib/supply-chain#202 · Filter by author aiuto opened on Aug 27, 2026

• Remove 'experimental' from documenation

  bazel-contrib/supply-chain#201 · Filter by author aiuto opened on Aug 27, 2026

• Add module extension to allow new PURL or update PURL definitions

  module > metadata > coretype > feature-request
  bazel-contrib/supply-chain#185 · Filter by author darkrift opened on May 15, 2026
  10

• Best way to integrate into rules_apko

  module > toolstype > feature-request
  bazel-contrib/supply-chain#172 · Filter by author xnox opened on May 6, 2026
  6

  

• Toolchains impact in builds

  module > metadatamodule > toolstype > feature-request
  bazel-contrib/supply-chain#166 · Filter by author darkrift opened on Apr 24, 2026 · tools-1.0.0
  2

• Provide dependencies/components relationship

  module > metadatamodule > toolstype > feature-request
  bazel-contrib/supply-chain#165 · Filter by author darkrift opened on Apr 24, 2026 · metadata-1.0.0
  1

  

• Narrow renovate updates to examples

  bazel-contrib/supply-chain#141 · Filter by author mzeren-vmw opened on Dec 18, 2025

• Add attribute for authors or contributors of a package.

  module > metadatatype > feature-request
  bazel-contrib/supply-chain#123 · Filter by author aiuto opened on Nov 13, 2025

• examples are bad examples of package(default_visibility = public)

  bazel-contrib/supply-chain#117 · Filter by author mzeren-vmw opened on Nov 7, 2025 · metadata-1.0.0
  1

• Release automation should allow separate versions for package_metadata, supplychain-go, supply_chain_tools, etc.

  bazel-contrib/supply-chain#111 · Filter by author mzeren-vmw opened on Nov 6, 2025
  2

• Create a release branch or release-v* branches

  process
  bazel-contrib/supply-chain#50 · Filter by author jacky8hyf opened on Aug 12, 2025
  6

  

• More metadata fields

  bazel-contrib/supply-chain#44 · Filter by author aiuto opened on Jul 25, 2025
  1

• Create an SBOM declaration rule.

  module > metadata > coremodule > metadatatype > feature-request
  bazel-contrib/supply-chain#42 · Filter by author aiuto opened on Jul 25, 2025
  5

  

• Tracking bug: Prototype bundling dependencies in Golang binaries.

  type > feature-request
  Task

  bazel-contrib/supply-chain#37 · Filter by author aiuto opened on Jul 17, 2025
  3

• Dependency Dashboard

  type > feature-request
  Task

  bazel-contrib/supply-chain#27 · Filter by author renovate opened on Jul 3, 2025
  3