GitHub deprecates the synchronous dependency-graph SBOM API

What changed

GitHub deprecated the older synchronous SBOM REST endpoint after releasing an asynchronous SBOM API. The synchronous endpoint at /{owner}/{repo}/dependency-graph/sbom is scheduled for removal on November 13, 2026.

The replacement is /{owner}/{repo}/dependency-graph/sbom/generate-report, which returns a URL to poll until the SBOM is ready, then download from cache.

Who is affected

Scripts, CI jobs, security tooling, and compliance pipelines that still call the synchronous dependency-graph/sbom endpoint and expect an immediate SBOM payload in the response.

What you need to do

Required before November 13, 2026 if you still use the synchronous endpoint:

1. Switch callers to /{owner}/{repo}/dependency-graph/sbom/generate-report.
2. Implement poll-for-completion against the returned URL.
3. Download the cached SBOM once generation finishes.
4. Retest any automation that assumed a single synchronous response.

GitHub documents this as a performance and reliability improvement over the previous method.

Migration effort

Likely medium: endpoint change plus asynchronous polling/state handling. Not a multi-system rewrite, but callers must stop treating SBOM generation as a single blocking GET.

Cost impact

Unknown. GitHub’s changelog describes an API shape/workflow change and does not establish pricing direction for SBOM export or related tooling. Absence of pricing detail is not evidence of neutral impact.