Announced: LabVIEW 2026 Q3 will have SBOM Generation

[SumRunner]

At NI Connect, we announced that LabVIEW 2026 Q3 will include SBOM generation. The engineers are still working on the exact implementation of this, but it will be a menu option that will create a first-level SBOM in CycloneDX format (1.5) from a menu option. It will also run from the command line, so that it can be included in a CI/CD pipeline. It will be included with the Professional version only. We expect 2026 Q3 to be available for download in early August. 

The SBOM generation was actually developed by JKI and we have licensed it into LabVIEW. The JKI Security Suite, which has SBOM generation and a lot of other features, including SAST and documentation tools, will not become part of LabVIEW. I do recommend that you look at the JKI Security Suite (JKI Security Suite | LabVIEW Cybersecurity Analysis & Compliance Tool) as it has a lot of great features for secure code development. 

We will create documentation and announcements as we get closer, but I thought this community would be interested to hear about this coming feature.

[alexderjuengere]

so, in a nutshell, labview 2026q3 will have a sbom tool like visual studio, or python's https://github.com/CycloneDX/cyclonedx-python

- I appreciate!

So, can  I put it like that:

[ LabVIEW Source Code ]
│
▼ (Step 1: Code Check, optional)
[ JKI Security Suite ] ──► Detects internal security flaws & CWE bugs in your VIs
│
▼ (Step 2: Build & Generate, SBOM Generation)
[ LabVIEW 2026 Q3 Build ] ──► Compiles binary + Generates CycloneDX SBOM JSON
│
▼ (Step 3: Periodic Analysis, SBOM Analysis)
[ Third-Party Enterprise Scanners ] ──► Continuously monitors the SBOM against CVE databases
(e.g., BlackDuck, Dependency-Track, Trivy)

By the way, can we look up the SBOM for a (older)  Labview Runtimes (eg. labview 2020 64-bit windows SBOM), as we already can do for certain python realses eg. https://www.python.org/downloads/release/python-3146/

Regards

Alex

[SumRunner]

At a high level, yes, your post is correct. I would add that if you are using the JKI Security Suite, in addition to a static code scan for vulnerabilities, you can also generate the SBOM. Or, as you list, you can generate the SBOM from LabVIEW 2026 Q3 or later. You would then use a 3rd party tool to run the SBOM (which is a standard CycloneDX format) to scan public databases for posted vulnerabilities. 

There are two SBOMs, so there are two answers to your question - one for LabVIEW, and one for your LabVIEW project. 

We cannot generate SBOMs for older versions than LabVIEW 2025 Q1. We had to manually insert many hooks into the LabVIEW code to make this work, so it's not something we can retroactively do for earlier versions.

I just saw the SBOM generation function to generate SBOMs from your LabVIEW application today for the first time - so I need to do some testing to see how to generate for projects in version earlier than the current version. I'll post what I find here. 

[joerg.hampel]

For details on the SBOM generation, I suggest to peruse this page: https://docs.vipm.io/preview/sbom/

If you look at the workflows, you can see that using vipm.toml is the preferred way in the future, with .dragon and .vipc being listed as deprecated.

https://docs.vipm.io/preview/vipm-toml/ suggests a manual approach via command line, so it's not a 1:1 replacement for .vipc just yet.

As for versions, the scanning of .lvproj files for SBOM generation requires LabVIEW 2024 or later. For legacy and reuse code, you will have to prepare .toml, .dragon or .vipc files.