SBOM generation in 2026 Q3 fails due to VI in conditional disable structure and channels

[AustinMan@NI]

Hi Everyone,

Want to let you know LabVIEW R&D are investigating this issue.

I will keep you updated on progress as best I can.

Regards,

David Corney.

[cordm]

Looks like a big project.

> I had to search for the output for a while! Is there a parameter available to specifiy the target folder?

Yes, you can. The parameter to --output is a path, both relative and absolute should work.

> And the json file is small.

How small? The one it generated for one of my projects with ~20 dependencies was about 20kB and contained this section about NI Modbus library :

Spoiler

    {
      "bom-ref": "pkg:vipm/ni_lib_modbus_library@1.2.1.42",
      "description": "Modbus is a de facto standard for industrial communication which supports both serial- and TCP/IP-based communication. The core of the protocol consists of a function code (read or write) and data (what to read, what to write). Different packet forms are used, depending on the underlying bus, but that core set of information does not change.\r\n\r\nThis library allows for low-level access to that core function set and provides an API which includes both master (client) and slave device (server) functionality. ",
      "hashes": [
        {
          "alg": "MD5",
          "content": "cd7841a5d37a5c8cabd21adeba7d8ee5"
        },
        {
          "alg": "SHA-256",
          "content": "0e10bcc22fa54d8105eff690dc1b1d4d4ab14297ee74cd811de2c768e88b2a46"
        }
      ],
      "licenses": [
        {
          "license": {
            "name": "NI Sample Code License"
          }
        }
      ],
      "name": "ni_lib_modbus_library",
      "properties": [
        {
          "name": "vipm:display-name",
          "value": "NI Modbus Library"
        }
      ],
      "purl": "pkg:vipm/ni_lib_modbus_library@1.2.1.42",
      "supplier": {
        "name": "National Instruments"
      },
      "type": "library",
      "version": "1.2.1.42"
    },
    {

The TCP/IP components are part of runtime/operating system I assume. So it falls under pkg:nipkg/ni-labview-2025-coreother or pkg:nipkg/ni-labview-2025-vilib. Same with nilvaiu.dll: it is part of DAQmx and does not appear in the SBOM by itself.

User32.dll is part of windows and not shipped with your software. It depends on the version where the software is used and should not appear in your SBOM.

[A-T-R]

---

@cordm wrote:

Looks like a big project.

---

Not at all! But without a predefined path, the sbom file was placed in the user folder:

"C:\Users\johndoe\sbom.json"

---

@cordm wrote:

How small? The one it generated for one of my projects with ~20 dependencies was about 20kB and contained this section about NI Modbus library :

Spoiler

    {
      "bom-ref": "pkg:vipm/ni_lib_modbus_library@1.2.1.42",
      "description": "Modbus is a de facto standard for industrial communication which supports both serial- and TCP/IP-based communication. The core of the protocol consists of a function code (read or write) and data (what to read, what to write). Different packet forms are used, depending on the underlying bus, but that core set of information does not change.\r\n\r\nThis library allows for low-level access to that core function set and provides an API which includes both master (client) and slave device (server) functionality. ",
      "hashes": [
        {
          "alg": "MD5",
          "content": "cd7841a5d37a5c8cabd21adeba7d8ee5"
        },
        {
          "alg": "SHA-256",
          "content": "0e10bcc22fa54d8105eff690dc1b1d4d4ab14297ee74cd811de2c768e88b2a46"
        }
      ],
      "licenses": [
        {
          "license": {
            "name": "NI Sample Code License"
          }
        }
      ],
      "name": "ni_lib_modbus_library",
      "properties": [
        {
          "name": "vipm:display-name",
          "value": "NI Modbus Library"
        }
      ],
      "purl": "pkg:vipm/ni_lib_modbus_library@1.2.1.42",
      "supplier": {
        "name": "National Instruments"
      },
      "type": "library",
      "version": "1.2.1.42"
    },
    {

---

Hm...I have no entry in the sbom file regarding the Modbus library.

But it's strange: I definitely have the toolkit installed in my LV environment...see the screenshot...but still VIPM allows me to install it...as if it's not installed already. And the application is using those Modbus VIs!

Maybe there's some flag missing, telling VIPM (and JKI sbom generator) that this component is installed? Where does the sbom generator look for installed (and used!) components? On the pallettes? Or in lvproj file?

A.

[cordm]

Without an absolute path the file will be placed relative to the current working directory. Which is the current users directory when launching from the start menu. You could change to the project folder and have the file placed next to your project or something like ../build/sbom.json.

If VIPM does not know about it, then that looks like a probable cause. Maybe it is related to this bug? https://github.com/vipm-io/vipm-desktop-issues/issues/130

[Jim_Kring]

---

@Mads wrote:

.Net calls seem to cause issues as well. I had a Browse for Folder VI in another project and this will cause the SBOM generator to complain about System.Windows.Forms...:

error: 1 file referenced in the project could not be found on disk
- C:\Program Files (x86)\National Instruments\LabVIEW 2026\user.lib\System.Windows.Forms (linker)

So two of our most important projects fail (so far) with the 2026 Q3 SBOM feature as they are.

To check if anything would pass I tried the SBOM feature on a minimum project that just had some VISA calls and a few OpenG Array functions and that went through fine...but we rarely have projects that simple 😮

---

Hi Mads,

We created an issue in our tracker here for the .Net Assembly issue you mentioned:
https://github.com/vipm-io/vipm-desktop-issues/issues/149

One thing you may consider is a Post-Build Custom Action (that calls the vipm cli's sbom command) instead of using the checkbox in the Advanced settings of the build spec.

Regards,

Jim

[Jim_Kring]

JKI has been made aware of this thread and we are watching it.

FYI: we have a public issue tracker where you can report bugs and an "sbom" label you can use to see one's related to sbom-generation.

Thanks for your patience on this -- the 2026 Q3 release was the first integration with LabVIEW's App Builder and it's providing a lot more users to help find all the corner-cases that are tough to even know about prior to a lot of end-user testing. We'll do our best to get these fixed.

[Jim_Kring]

Hi Everyone,

You may know (and I may have mentioned it): There is a new release of VIPM Desktop 2026 Q3 f2, with various fixes -- see the release notes here.

You can download here or upgrade directly from VIPM Desktop (check for updates).

Please let us know if you continue to have issues, after this upgrade.

[Mads]

The f2 version of VIPM seems to have fixed the issue with DLLs, so that is great.😀👍

The problem with links to VIs that are excluded in the current project by being in a conditional disable structure remains though 🙁.

Here is the error message e.g. of an SBOM of a Windows application build failing due to a real-Time-only VI in a conditional disable(d) case:

"1 file referenced in the project could not be found on disk
- <vilib>/rtutility.llb/RT LEDs.vi (linker)"