These CycloneDX 1.5 files are partial installer inventories. They record identified installer contents. They are not a complete account of all product dependencies, and they do not describe the software installed on a particular system. A valid schema and a matching file hash do not establish completeness.
Partial SBOM: identifies known installer contents. Some embedded and transitive components and versions remain unverified; installation depends on selected features and system conditions. An omitted component is not proof of absence.
Installer membership does not establish installation or execution. MSI feature selection, architecture, operating-system conditions, existing system state, and installation settings affect which components are installed. These files do not claim a specific machine's installed state or runtime behavior.
The installers include the Microsoft .NET Framework 4.8 Full redistributable. Its nested inventory remains incomplete. Cache and ParameterInfo entries have unresolved content mappings, and the older Core and Extended maintenance packages have unresolved cabinet-source and behavior questions. Their presence in a redistributable does not prove that they are installed.
Evidence identifies selected native components in service payloads, but native and transitive dependencies have not been exhaustively analyzed.
SNMPMibReader contains an OpenSSL 1.0.2e self-reported marker and evidence of embedded Net-SNMP code. The Net-SNMP version, and the exact source and patch provenance, are unknown.
For 2026.11 only, the classic client declares MailKit and MimeKit assembly references (assembly version 4.18.0.0). Matching loose DLLs were not found in the scanned MSI payload. Separate bundle package entries do not establish how the classic client resolves these references. Successful runtime binding is unverified. This observation does not establish an application failure.
Unknown or unresolved versions, identities, and relationships reflect gaps in the available evidence. They are not intentionally redacted. An absent entry must not be taken as proof that a component or dependency is absent.