CycloneDX SBOM, TurboPack/swc, and build tools support

[jkazimierczak-eficode]

Summary

Hello! We need to create SBOM in CycloneDX format. The CycloneDX organization provides tools that can be integrated into build tools, and we were wondering - is Webpack our only option for production builds in this case, where we can utilize already-available plugins for producing SBOMs?

Seeing that Next.js uses TurboPack by default from Next.js 16, we were also wondering - for how long will the Webpack be supported? From what I understand TurboPack uses swc underneath. Given CycloneDX doesn't provide a plugin for swc, Webpack seems to be the only path forward for us.

Our setup:

• Nx monorepo, with all dependencies stored in root package.json,
• pnpm as a package manager, unsupported by CycloneDX (last supported version is pnpm@9, we're using latest aka v10),
• Next.js 16 (not yet implemented, but planned).

Additional information

No response

Example

No response

[anntnzrb]

Webpack remains supported in Next.js 16 - run next build --webpack to use the CycloneDX webpack plugin for SBOM generation since Turbopack doesn't support webpack plugins. For package manager compatibility, note that CycloneDX tools officially support pnpm up to v9, so pnpm v10 may cause issues with dependency detection.

[jkazimierczak-eficode]

Thanks for the reply! I'm aware that Next.js 16 supports Webpack - the question was more about for how many releases Next will support Webpack. It would be a bummer to pick Next.js, only to discover that in next major release support is dropped or deprecated, due to TurboPack taking precedence onwards.

For pnpm the lockfile major version didn't change, so there's a chance it could work, but we'll have to test it in practice most probably. Thanks for the input on this!