SBOM
Also called Software bill of materials
A list of every component in your software, including what your dependencies depend on, with exact versions. An ingredients label, generated from what you really built.
When an advisory lands, the first question is "do we have this?", and the answer is often in a package nobody here chose. With a list it takes seconds. An agent can add a dependency in one line of a diff, so the list is worth more than anyone's memory.
Say it to your agent
“Add a CI step that generates a CycloneDX SBOM with syft from the build output, and saves it next to the release. Then answer from it, and not from package.json: do we ship any version of zod below 4?”