A compliance officer at your company asks the platform team to provide a machine-readable inventory of all components used in a critical repository so it can be ingested into a third-party vulnerability management tool that requires the industry-standard format defined by the Linux Foundation. From the repository's dependency graph, which export approach satisfies this request?