What your SBoM cannot say, and what happens when Dependency-Track reads it | Hacker News Reader