diff --git a/CHANGELOG.md b/CHANGELOG.md
index 34e6e67..b5e5068 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 # Changelog
 
-## 1.5.0
+
+## 1.6.1
+
+### Bugfix
+
+* Broken references in SBOM output
+
+## 1.6.0
 
 ### Enhancement
 
diff --git a/package-lock.json b/package-lock.json
index 561241b..fe5bd8e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "retire-site-scanner",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "retire-site-scanner",
-      "version": "1.6.0",
+      "version": "1.6.1",
       "license": "Apache-2.0",
       "dependencies": {
         "cacheable-lookup": "^7.0.0",
diff --git a/package.json b/package.json
index 09eae0b..7c11c1e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire-site-scanner",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "license": "Apache-2.0",
   "description": "A scanner for checking a web site using retire.js",
   "main": "dist/index.js",
diff --git a/src/log.ts b/src/log.ts
index 642ee47..bdbecb5 100644
--- a/src/log.ts
+++ b/src/log.ts
@@ -2,6 +2,7 @@ type LogLevel = "DBG" | "INF" | "ERR" | "WRN" | "TRC";
 import crypto, { randomUUID } from "crypto";
 import { Component } from "retire/lib/types";
 import { unique } from "./utils";
+const pjson = require("../package.json");
 
 const logId = crypto.randomUUID().split("-").slice(-1)[0];
 let color = false;
@@ -83,7 +84,7 @@ type CycloneDXComponent = {
   }>;
 };
 type CycloneDXVulnerability = {
-  "bom-ref": string;
+  "bom-ref"?: string;
   id: string;
   references?: Array<{
     id: string;
@@ -98,6 +99,21 @@ type CycloneDXVulnerability = {
   advisories?: Array<{
     url: string;
   }>;
+  affects: Array<{
+    ref: string;
+    versions: Array<
+      | {
+          version: string;
+          range?: string;
+          status?: "affected" | "unaffected" | "unknown";
+        }
+      | {
+          version?: string;
+          range: string;
+          status?: "affected" | "unaffected" | "unknown";
+        }
+    >;
+  }>;
 };
 
 export type CycloneDXService = {
@@ -235,11 +251,17 @@ export function convertToCycloneDX(resultToConvert: typeof collectedResults) {
               source: { url: `https://nvd.nist.gov/vuln/detail/${i}` },
             }));
           vulnerabilities.push({
-            "bom-ref": comp["bom-ref"],
+            "bom-ref": randomUUID(),
             advisories: v.info.map((u) => ({ url: u })),
             id: id,
             ratings: [{ severity: v.severity }],
             references: otherRefs.length > 0 ? otherRefs : undefined,
+            affects: [
+              {
+                ref: comp["bom-ref"],
+                versions: [{ version: c.version }],
+              },
+            ],
           });
         });
       }
@@ -252,7 +274,7 @@ export function convertToCycloneDX(resultToConvert: typeof collectedResults) {
     version: 1,
     metadata: {
       timestamp: started,
-      tools: [{ name: "retire-scanner" }],
+      tools: [{ name: pjson.name, version: pjson.version }],
       component: {
         type: "application",
         name: resultToConvert.url,
@@ -278,7 +300,6 @@ function mapLicenses(licenses: string[] | undefined) {
   return [{ expression: licenses[0] }];
 }
 
-
 export const jsonLogger: Logger = {
   open: (url: string) => {
     collectedResults.url = url;