ST-2026-007 · API endpoints & versions
GitHub deprecates the synchronous SBOM REST API ahead of November removal
GitHub deprecated the synchronous dependency-graph SBOM endpoint and will remove it on 13 November 2026, requiring integrations to request an asynchronous report and poll the returned URL for completion.
Previous state
Integrations could synchronously request an SBOM from /{owner}/{repo}/dependency-graph/sbom and receive the generated result through the older request pattern.
Current state
Integrations must call /{owner}/{repo}/dependency-graph/sbom/generate-report, receive a report URL and poll until the asynchronous computation is complete.
Affected users
Who needs to care
Software-supply-chain tools, compliance scripts and integrations that generate GitHub repository SBOMs through the synchronous REST endpoint.
Required response
What to do
Replace the old endpoint, implement polling and retry logic for the returned report URL, validate caching and error handling, and deploy the integration change before 13 November 2026.
Evidence boundary
What the source does not prove
The notice defines the endpoint replacement and removal date. It does not state that existing client libraries automatically adopt the asynchronous flow or that report completion time is fixed.
Lifecycle history
Dated event sequence
- Synchronous API deprecated
GitHub announced the asynchronous replacement and a six-month removal window.
- Removal date
The older synchronous SBOM endpoint is scheduled for removal.
Evidence ledger
First-party sources
- 01GitHub Changelog — Synchronous SBOM API deprecated
Official API deprecation notice · 2026-05-12
Open official source ↗