Skip to main content

CommandCTRL — Third-Party & Open Source Software Inventory

Glen Porter
  • Created:
  • Updated:
CommandCTRL — Open Source & Third-Party Component List

This article provides the official inventory of open source and third-party software components shipped with each release of CommandCTRL. Each release entry links to a downloadable ZIP archive hosted on the Liquidware CDN containing:

  • A CycloneDX 1.6 JSON SBOM and SPDX JSON SBOM for each scan scope — machine-readable Software Bill of Materials including SPDX license IDs and package URLs (purl) for all components
  • A human-readable component table (sbom.table.txt) listing package name, version, and type for each scope
  • A Grype vulnerability scan (vulns.grype.json and vulns.table.txt) with CVE results at time of release

The component list is updated whenever a GA or hotfix release adds, removes, or updates a third-party dependency. The current supported release is 1.6.0.

1.6.0 — CommandCTRL  Current Release

1.6.0  ⭐ LatestNovember 10, 2026  |  Expanded SBOM with dual-scope scans and vulnerability results
Download CommandCTRL_1.6.0_Open_Source_3rd_party.zip
Contains commandctrl-agent-sbom/README.md plus two scan scopes:
  • agent-src/ — source tree (Go modules + npm packages, 135 components)
  • ccagent-binary/ — compiled agent binary (Go stdlib go1.26.8, 33 components)
Each scope includes: sbom.cyclonedx.json  sbom.spdx.json  sbom.table.txt  vulns.grype.json  vulns.table.txt
Contents
  • 135 components in the agent source tree (Go modules and npm packages)
  • 33 components in the compiled agent binary (Go stdlib go1.26.8 + public modules)
  • Both CycloneDX 1.6 and SPDX formats provided for each scope
  • Grype vulnerability scan included per scope — 0 critical, 0 high CVEs found at time of release
Changes from prior release Expanded SBOM format: replaced single CSV/JSON with dual-scope scans covering agent source tree and compiled binary separately. Added SPDX format alongside CycloneDX. Added Grype vulnerability scan results per scope. Component count updated from 39 (1.5) to 135 source / 33 binary.
Product CommandCTRL
Applies To 1.6.0 and later
Updated November 10, 2026

1.5 — CommandCTRL

1.5July 1, 2026  |  Initial open source component release
Download CommandCTRL_1.5_Open_Source_3rd_party.zip
Contains 1.5_Open_Source_3rd_party.csv and 1.5_Open_Source_3rd_party.json (CycloneDX 1.6)
Contents
  • 39 components in the following product group: CommandCTRL Agent
  • Includes all third-party Go library dependencies shipped with the CommandCTRL agent binary
  • CycloneDX 1.6 SBOM includes SPDX license IDs and package URLs (purl) for all components
Changes from prior release Initial component list — no prior 1.x release to compare against.
Product CommandCTRL
Applies To 1.5 and later
Updated July 1, 2026

Related articles