A Software Bill of Materials is a catalog of every living thing in your codebase.
Packages your packages depend on, three, four, five levels down.
Every dependency is a promise. Every transitive dependency is a promise made by a stranger.