# Csaf articles

## Pages

- [Announcing sbomify v26.9.0: The One That Speaks SPDX 3](https://sbomify.com/2026/09/24/announcing-sbomify-v26-9-0-the-one-that-speaks-spdx-3/) (2026-09-24): sbomify v26.9.0 makes SPDX 3 a first-class format end to end, ships a v2 API that calls things what the product calls them, adds a Helm chart for self-hosting on Kubernetes, puts certification badges and CSAF 2.0 discovery on the Trust Center, and rebuilds vulnerability browsing around a real findings table.
- [BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks](https://sbomify.com/2026/08/20/bsi-tr-03183-four-parts-cra-update/) (2026-08-20): BSI published TR-03183-1 in version 1.0.0 on 31 July 2026, completing a four-part CRA guideline family. Here is what changed across TR-03183, the Commission's July 2026 guidance, and the ENISA Single Reporting Platform before 11 September.
- [Announcing sbomify v26.7.1: The One That Says "Not Affected"](https://sbomify.com/2026/07/30/announcing-sbomify-v26-7-1-the-one-that-says-not-affected/) (2026-07-30): sbomify v26.7.1 ships end-to-end VEX support across CycloneDX, OpenVEX, and CSAF, with in-product triage, Dependency-Track sync, and scheduled drift detection. CBOM ingestion now covers every lineage, the Trust Center exposes VEX and CBOM per release, and vulnerability counts finally reflect your current posture.

---

From sbomify: https://sbomify.com/tags/csaf/